php imap_open RCE #10987

h00die · 2018-11-19T02:34:25Z

Saw this: https://web.archive.org/web/20181118213536/https://antichat.com/threads/463395

PHP's imap_open call on Debian based systems can potentially be passed a parameter that is given to rsh which is mapped to SSH, which allows for RCE.

I only coded based on the forum, I didn't discover this exploit or conribute to it in any way, all credit goes to twoster

Apps Reported Vulnerable:

~~instantcms~~ (https://github.com/instantsoft/icms2/search?q=imap_open&unscoped_q=imap_open)
- Doesn't seem to be any reference to imap_open in source code
~~HostCMS~~(https://github.com/HostCMS/hostcms6.free/blob/1d54bdefcd6c28918cb09dd7cb6aea404879b93f/modules/core/mail/imap.php#L140)
- After clicking through all of HostCMS, I'm not seeing where the admin can enter the IMAP info. I believe it has the core plumbing there, simply for use by add-on modules. I'm going to abandon it for now.
e107 v2 (https://github.com/e107inc/e107/blob/7570b7ce4e17c03e9759c90889db8e750d566e53/e107_handlers/pop_bounce_handler.php#L83)
prestashop
SuiteCRM
SugarCRM
- no more free edition to try. If anyone has a server running SugarCRM that will let me play with, let me know!

Additional Apps Possible Vulnerable:

osTicket: https://github.com/osTicket/osTicket-1.7/blob/4b94d0a2cd98d32d6bb6f63523b2db13b936e026/include/class.mailfetch.php#L138
most likely a bunch of drupal plugins
most likely a bunch of wordpress plugins (the most popular with 20k install when searching for 'imap' was Postie, but i can't get it to save the config, opened a help ticket with them)
faveo-helpdesk: https://github.com/ladybirdweb/faveo-helpdesk/blob/01ba284021b1fa8e89c0e184b3560321150cb910/vendor/tedivm/fetch/src/Fetch/Server.php#L291
yetiforceCRM; https://github.com/YetiForceCompany/YetiForceCRM/blob/68bb62fe638cddb6c3996ae3989fe1d6a96addca/modules/OSSMail/models/Record.php#L151
postfixadmin: https://github.com/postfixadmin/postfixadmin/blob/b1795ab596e2d87cc172e698ba1f536095d5e777/model/MailboxHandler.php#L682

This is fine to land now, its VERY time consuming to install the CMS, figure out where the vuln is, write the exploit with all the darn nuances of every CMS and no core libraries (not that i think any should be added). When I get time i'll add them to here until it lands. After that i'll just make new PRs.

@todb-r7 I didn't see a CVE, but maybe you have more insight? According to https://danwin1210.me this was leaked on Nov 14th.

Verification

See docs

Verify docs are in good working order.

modules/exploits/linux/http/php_imap_open_rce.rb

Green-m · 2018-11-19T10:02:18Z

modules/exploits/linux/http/php_imap_open_rce.rb

+        }
+      })
+
+      /form method="post" action="index\.php\?controller=AdminCustomerThreads&amp;token=(?<token>\w{32})/ =~ res.body


This way of using regular match seems to confuse me, I am not sure it is better than
res.body =~/form method="post" action="index\.php\?controller=AdminCustomerThreads&token=(?<token>\w{32})/ ?

bcoles · 2018-11-20T07:51:58Z

Jenkins test this please

h00die · 2018-11-20T23:40:11Z

Added suiteCRM today. As description update says, this is OK to land now. New PRs can be added as people find time to write in the other systems.

h00die · 2018-11-24T01:19:03Z

e107 is now exploitable. Note it is a special case where $IFS$() was getting encoded, however "\t" (not '\t') will bypass the filters and execute.

syrius01 · 2018-11-24T03:32:47Z

Great share there @h00die ! I was wondering if there are some 3rd party softwares you've identified that uses php imap_open with no authentication required? This would be very critical.

Thanks

h00die · 2018-11-24T12:18:24Z

There's 108,000 lines of PHP code which reference "imap_open(": https://github.com/search?q=%22imap_open%28%22&type=Code
I have simply been coding what was already identified and have not been looking for new sources. Feel free to fork this PR and submit new exploitable things. I'd like to HIGHLY encourage that.

h00die · 2018-11-24T13:57:30Z

After clicking through all of HostCMS, I'm not seeing where the admin can enter the IMAP info. I believe it has the core plumbing there, simply for use by add-on modules. I'm going to abandon it for now.

h00die · 2018-11-24T19:19:56Z

@syrius01 I created a new target "custom" (no docs yet) which can be used similar to web_delivery for exploiting custom targets. I believe I've found a wordpress plugin that i'll be adding shortly, but the list is endless.

h00die · 2018-11-24T21:28:38Z

Looks like freescout-helpdesk only accepts itself, so not exploitable https://github.com/freescout-helpdesk/freescout/blob/52c763849ea1e73ced39b960d1e95fb06d264473/vendor/webklex/laravel-imap/src/IMAP/Client.php#L455

h00die · 2018-11-25T16:02:11Z

Added "Custom" target, and finished documenting it, so you can now get the string to use, and have a listener for attempts to exploit custom apps, similar to web_delivery.

I'm most likely done now. I updated the description to incorporate all the additional findings.

busterb · 2018-11-27T22:29:53Z

Wow, this is nice! I'm going to go ahead and get it into master so folks can take advantage of it. Sounds like plenty to add over time.

todb-r7 · 2018-11-27T22:44:05Z

Thanks @h00die ! I'm alerting the DWF right now, they should kick out a CVE for you/twoster.

…eb apps

busterb · 2018-11-27T22:53:03Z

Release Notes

The exploits/linux/http/php_imap_open_rce module has been added to the framework. This exploits the PHP imap_open call against various web apps, allowing for remote code execution.

todb-r7 · 2018-11-27T22:55:57Z

Based on your notes, @h00die , I am presuming you were testing the very latest PHP, PHP 7.3.0RC6 , or at least something close enough that this functionality is quite likely to be present there. In any event, the 7.3 release branch doesn't mention imap_open at all in the UPGRADING notes, so I'm assuming it's untouched.

h00die · 2018-11-27T23:04:26Z

@todb-r7 I think I only tested 7.0 but will check a little later and confirm the version and try the latest and post back

todb-r7 · 2018-11-27T23:05:12Z

And @busterb just found this CVE listing:

https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-19518

Which says the bug is in U of W IMAP Toolkit, whatever that is, not PHP, which seems incorrect. Hmm. Will let DWF sort it out.

busterb · 2018-11-27T23:11:56Z

Also original PHP bug report from months ago: https://bugs.php.net/bug.php?id=76428

h00die · 2018-11-27T23:13:41Z

@todb-r7 that reference the original code from @Bo0oM so we can go with that. I'll put in a new PR to update this code w/ the CVE you found (nice find!)

todb-r7 · 2018-12-06T20:48:49Z

Got a CVE from DWF: CVE-2018-1000859

I can edit up the module nowish to mention it.

h00die · 2018-12-06T20:59:33Z

Thanks @todb-r7 that would be great. I think I may have a new target soon but can't start till my laptop gets fixed (hoping to get parts in today).

See discussion on rapid7#10987. Now that I said that out loud, I realize that the original PR for this module is a really funny PR number.

php_imap_open_rce

4b09584

h00die added module docs labels Nov 19, 2018

h00die added 2 commits November 18, 2018 21:38

fix markdown formatting

aca3f44

fix normalize and date

a28feed

Green-m reviewed Nov 19, 2018

View reviewed changes

modules/exploits/linux/http/php_imap_open_rce.rb Outdated Show resolved Hide resolved

Green-m reviewed Nov 19, 2018

View reviewed changes

h00die added 2 commits November 20, 2018 18:33

added suitecrm to imap_open exploit

4c59a27

fix module description

4111a61

h00die added 3 commits November 20, 2018 19:30

edb and author

31ad58f

remove eol spaces

acf421f

e107 exploitable now

e36cef3

update php_imap_open docs

45f2c5b

denji mentioned this pull request Nov 24, 2018

imap_open psecio/iniscan#113

Closed

add custom php_imap target

945755b

cleaned up code, added custom

e2d58af

busterb self-assigned this Nov 27, 2018

busterb merged commit e2d58af into rapid7:master Nov 27, 2018

busterb added a commit that referenced this pull request Nov 27, 2018

Land #10987, add exploit for PHP imap_open function against various w…

b05bb61

…eb apps

msjenkins-r7 pushed a commit that referenced this pull request Nov 27, 2018

Land #10987, add exploit for PHP imap_open function against various w…

7daedb4

…eb apps

todb-r7 added the hotness Something we're really excited about label Nov 27, 2018

h00die deleted the php_imap_open_rce branch November 28, 2018 01:28

h00die mentioned this pull request Nov 28, 2018

update imap_open refs #11033

Merged

gdavidson-r7 added the rn-exploit label Dec 4, 2018

todb-r7 pushed a commit to todb-r7/metasploit-framework that referenced this pull request Dec 6, 2018

Add CVE as issued by DWF

1408332

See discussion on rapid7#10987. Now that I said that out loud, I realize that the original PR for this module is a really funny PR number.

todb-r7 mentioned this pull request Dec 6, 2018

Add CVE as issued by DWF #11078

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

php imap_open RCE #10987

php imap_open RCE #10987

h00die commented Nov 19, 2018 •

edited

Green-m Nov 19, 2018 •

edited

bcoles commented Nov 20, 2018

h00die commented Nov 20, 2018

h00die commented Nov 24, 2018

syrius01 commented Nov 24, 2018

h00die commented Nov 24, 2018

h00die commented Nov 24, 2018

h00die commented Nov 24, 2018

h00die commented Nov 24, 2018 •

edited

h00die commented Nov 25, 2018

busterb commented Nov 27, 2018

todb-r7 commented Nov 27, 2018

busterb commented Nov 27, 2018 •

edited by gdavidson-r7

todb-r7 commented Nov 27, 2018

h00die commented Nov 27, 2018

todb-r7 commented Nov 27, 2018

busterb commented Nov 27, 2018

h00die commented Nov 27, 2018

todb-r7 commented Dec 6, 2018

h00die commented Dec 6, 2018

php imap_open RCE #10987

php imap_open RCE #10987

Conversation

h00die commented Nov 19, 2018 • edited

Apps Reported Vulnerable:

Additional Apps Possible Vulnerable:

Verification

Green-m Nov 19, 2018 • edited

Choose a reason for hiding this comment

bcoles commented Nov 20, 2018

h00die commented Nov 20, 2018

h00die commented Nov 24, 2018

syrius01 commented Nov 24, 2018

h00die commented Nov 24, 2018

h00die commented Nov 24, 2018

h00die commented Nov 24, 2018

h00die commented Nov 24, 2018 • edited

h00die commented Nov 25, 2018

busterb commented Nov 27, 2018

todb-r7 commented Nov 27, 2018

busterb commented Nov 27, 2018 • edited by gdavidson-r7

Release Notes

todb-r7 commented Nov 27, 2018

h00die commented Nov 27, 2018

todb-r7 commented Nov 27, 2018

busterb commented Nov 27, 2018

h00die commented Nov 27, 2018

todb-r7 commented Dec 6, 2018

h00die commented Dec 6, 2018

h00die commented Nov 19, 2018 •

edited

Green-m Nov 19, 2018 •

edited

h00die commented Nov 24, 2018 •

edited

busterb commented Nov 27, 2018 •

edited by gdavidson-r7