Update wanem_exec exploit module

[bcoles]

This PR updates the linux/http/wanem_exec exploit module; primarily adding documentation, meterpreter cmdstager, and support for WANem 3.x targets.

The original exploit module was written in 2012 and targeted WANem version 2.x. Since then, the developers released version 3.0 Beta and 3.0 Beta 2 in 2013 and 2014 respectively. The new versions patched the exploit (perhaps accidentally) but didn't resolve the underlying issue.

Exploitation methods vary between the 2.x and 3.x branches - largely due to updating the version of the underlying Knoppix operating system in use by the ISO distributions, rather than changes to the code base.

3.x Targets

The targets need to be set manually with set TARGET [0 or 1] due to differences between the two branches. Adding auto targeting wasn't worth the time investment.

          [ 'WANem 2', { 'CmdStagerFlavor' => [ :echo, :wget ] }],
          [ 'WANem 3', { 'CmdStagerFlavor' => [ :echo, :bourne, :printf, :wget ] }]

Payload and Command Stager

Updated to use a command stager, because why not?

In the process, the poor payload URL encoding in the original exploit has been fixed, and the send_request_cgi HTTP method has been updated from GET to POST to decrease the chances of the payload appearing in HTTP access logs.

Due to the change in operating system version and shell, different cmdstager::flavors were tested and known-good flavors are specified for each target, as per above.

'Privileged' => false

The original exploit specified 'Privileged' => true and took advantage of a dosu binary which allowed execution of arbitrary commands as root. This binary has been removed from the 3.x branch, but there's still half a dozen ways to get root from the www-data user largely due to a weak sudo configuration.

Modifying the exploit to privesc for each target version was not worth the time investment. Instead, I opted to set 'Privileged' => false, and document the privesc methods in the documentation.

Additionally, it's worth noting that the dosu privesc method in the original exploit made use of client.shell_command_token in on_new_session which would only work for command shell sessions. It would not work for meterpreter sessions, as dosu effectively launches a new shell in a similar fashion to sudo /bin/sh.

Documentation

Documentation to keep h00die happy.

References

The OSVDB references have been removed and the original reference URL reinstated.

The reference URL was erroneously removed from this module a while ago. The script used to clean up dead URLs in module references doesn't take into account instances where the reference URL specified http but the URL now redirects to https - flagging them as dead.

[sempervictus]

Nothing like spackle over the fissure to "fix a vuln" eh?
Related thought bubble: For http targets, would be great to find generic http-session-reuse/proxy mechanisms to tunnel comms - env vars, pipes, files, etc. We have a lot of functional exploits which can be broken at later stages by generic defenses preventing rev connect, binds, etc, so inline tunneling for these sorts of vulns seems a good direction.

[jrobles-r7]

execute_cmdstager info specifies @return [void]. res is being set to nil even when the exploit works. Maybe the unless res and unless res.code ... checks should be moved to the execute_command function?
@bcoles

[bcoles]

fixed

[bcoles]

Jenkins test this please

[jrobles-r7]

@bcoles During testing HTTP response times for WANem servers:
WANem v2.0: ~90 sec
WANem v3.0beta: ~180 sec
WANem v3.0beta2: ~180 sec
Since the check is occurring before the exploit attempt, the timeout for the check will have to increase for the exploit to be successful. The check could be removed from the exploit function to make it faster but I guess that would affect the excellent ranking. Maybe there is an alternative way to check/detect if a WANem server is vulnerable.

[bcoles]

@jrobles-r7 That's unusual. The check method times out much faster for me.

Closing because I don't care enough about this module enough to bother pursuing it.

[bcoles]

Thanks anyway @jrobles-r7