beefproject/beef — Issue #406: vTigerCRM Module Enhancements
Author: passbe
Created: 2011-12-10 23:10:54+00:00
State: open

1. Randomise the filename of the uploaded file
2. Multi-version handling (See below from Yori):
Christian,

That's great to hear. I think the custom php inject is a good idea. That way the user can see what's actually being sent and have a chance to notice that it might not work on the target machine.

I've been doing some research into the vulnerability in vTigerCRM and found the following which you may or may not want to add to the exploit:

Version 5.0.4:
- The exploit works because bad extensions are checked with a case sensitive compare, hence .PHP works but .php doesn't

Version 5.2.0:
- They fixed the case sensitivity but have left out the .phtml extension from their bad extensions list. Many apache configs execute anything with a .phtml as a php file

Version 5.2.1:
- Same as above except they don't filter .shtml which is much less common but still sometimes seen. .shtml runs Server Side Includes if apache is configured with SSI which can be used to exec any command by including the following in the file: <!--#exec cmd="ls" -->

As you did with the custom php code option. It may be worth adding in a custom extension option and have a drop down with the following prefills:

VER: 5.0.4
EXT: .PHP
FILE_CONTENTS: <?php passthru("...shell code here..."); ?>

VER: 5.2.0
EXT: .phtml
FILE_CONTENTS: <?php passthru("...shell code here..."); ?>

VER: 5.2.1
EXT: .shtml
FILE_CONTENTS: <!--#exec cmd="...shell code here..." -->

I tested both the 5.2.0 and 5.2.1 vulnerabilities and they both work with the correct apache config. On my ubuntu install of apache 2.2, .phtml was parsed as php by default but server side includes were not. Therefore I would say that the options listed above are less likely to work (with 5.0.4 as guaranteed to work) as you go down.
Google Code Issue: http://code.google.com/p/beef/issues/detail?id=217