Description
This module exploits a ViewState .NET deserialization vulnerability in web-based MS SQL Server management tool myLittleAdmin, for version 3.8 and likely older versions, due to hardcoded <machineKey> parameters in the web.config file for ASP.NET.
Popular web hosting control panel Plesk offers myLittleAdmin as an optional component that is selected automatically during "full" installation. This exploit caters to the Plesk target, though it should work fine against a standalone myLittleAdmin setup.
Successful exploitation results in code execution as the user running myLittleAdmin, which is IUSRPLESK_sqladmin for Plesk and described as the "SQL Admin MSSQL anonymous account."
Tested on the latest Plesk Obsidian with optional myLittleAdmin 3.8.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/http/plesk/mylittleadmin_viewstatemsf undefined(mylittleadmin_viewstate) > show actions ...actions...msf undefined(mylittleadmin_viewstate) > set ACTION < action-name >msf undefined(mylittleadmin_viewstate) > show options ...show and set options...msf undefined(mylittleadmin_viewstate) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub