A] Default behavior

By default, this module attempts to automatically locate and then fetch
the confluence database. This is all possible thanks to the fact that
the LFI primitive will turn into a directory listing whenever a directory
is specified instead of a file.

To perform the attack on the CLI one may type from $CANVAS_ROOT: (takes some time)
python2 exploits/remote/universal/confluence_macro_lfi/confluence_macro_lfi.py -t 10.161.0.241 -p 8090 -Ovhost:‘10.161.0.241’

There are however a couple of limitations:

1. The search algorithm is rather naive and will not be able to handle
installation with too specific installation paths.

2. A huge problem with Confluence is the way Java handles the memory when
the LFI primitive is used. Because of this, whenever the file included
with the LFI primitive is too big (couple of megabytes), the server process
may actually crash being unable to allocate enough. This is in particular
true with the confluence database which is more than 20 megabytes initially.

Note: Linux seems much less stable than Windows in that regard.

3. There is a limitation to how much the server can send. Our tests though
show that most of the time, while truncated, the partial DB will include
user information (such as potentially user hashes which may later be cracked).

B] Targeting arbitrary files

First of all it should be noticed that both absolute paths can be used
by the attacker on directories (directory listing) or files (file inclusion)
thus depending on the configuration of the confluence service, several things
could be attempted:

- Kerberos tickets retrieval
- Shadow leak (if confluence is running as root)
- Any sensitive credentials in general without ACL protection

This may or may not lead to RCE.

1. Linux examples
-----------------

Chosen absolute path:

python2 exploits/remote/universal/confluence_macro_lfi/confluence_macro_lfi.py -t 10.161.0.239 -p 8090’

2. Windows examples
-------------------

Chosen relative path:

python2 exploits/remote/universal/confluence_macro_lfi/confluence_macro_lfi.py -t 10.161.0.241 -p 8090 -Oremote_file:…/web.xml

#Chosen absolute path:
python2 exploits/remote/universal/confluence_macro_lfi/confluence_macro_lfi.py -t 10.161.0.241 -p 8090 -Oremote_file:‘C:\windows\win.ini’

Tested against:
- Confluence 6.6.11 (Ubuntu)
- Confluence 6.10.1 (Windows 2008 R2)

VENDOR: Atlassian
CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3396
CVE Name: CVE-2019-3396