-
Notifications
You must be signed in to change notification settings - Fork 13.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add module for SmarterMail Build 6985 - dotNET Deserialization Remote Code Execution (CVE-2019-7214) #18170
Conversation
Thanks for your pull request! Before this pull request can be merged, it must pass the checks of our automated linting tools. We use Rubocop and msftidy to ensure the quality of our code. This can be ran from the root directory of Metasploit:
You can automate most of these changes with the
Please update your branch after these have been made, and reach out if you have any problems. |
Co-authored-by: adfoster-r7 <[email protected]>
Co-authored-by: adfoster-r7 <[email protected]>
* Small fixes in Description - removed backticks * Implemented Windows Command target * Removed PowerShell Stager, in Targets and in exploit method * Implemented Rex::Socket::Tcp in place of TCPSocket * Updated TARGET section in documentation * Added TARGET 0 - Windows Command scenario * Removed PowerShell Stager scenario * Replaced 'Using configured payload' lines to use Windows Command payload for the 2nd, 3rd, and 4th scenarios. Did not rerun the scenarios, however
Thanks for the high quality PR 👍 To the tester on the Metasploit side that picks this up, we'll just want to verify the module works via a socks proxy, i.e. |
* Msftidy complains about Line 2 of the exploit template comment having * http:// protocol instead of https:// protocol * Reference in PR rapid7#18170, commit hash ad0d3e7, where Msftidy lint test fails * to pass, but in the next commit 591fee1, the test passes.
Works directly against windows server 2016, as well as via a socks5 proxy sitting the middle, ie. Attacker VM (192.168.123.132) -> socks proxy (192.168.123.144) -> target (10.20.0.143)
|
Release NotesAdds a new module for SmarterMail Build 6985 - dotNET Deserialization Remote Code Execution (CVE-2019-7214). The vulnerability affects SmarterTools SmarterMail Version less than or equal to 16.3.6989.16341 (all legacy versions without a build number), or SmarterTools SmarterMail Build less than 6985 |
* Msftidy complains about Line 2 of the exploit template comment having * http:// protocol instead of https:// protocol * Reference in PR rapid7#18170, commit hash ad0d3e7, where Msftidy lint test fails * to pass, but in the next commit 591fee1, the test passes.
* Msftidy complains about Line 2 of the exploit template comment having * http:// protocol instead of https:// protocol * Reference in PR rapid7#18170, commit hash ad0d3e7, where Msftidy lint test fails * to pass, but in the next commit 591fee1, the test passes.
Related issue for mixin/rex socket usage - #18060
Verification Steps
EXE
legacy versions and builds from a dropdown menu at Legacy Builds, specifically SmarterMail 16.x, Build 6970 and Build 6985.SmarterMail_6970.exe
) and follow the instructions provided. If reinstalling a different version/build, simply chooseUse an existing site
when prompted inSite Configuration Type
, and selectSmarterMail
in the next option.http://localhost:9998/interface/root#/login
. Set Admin username and password to beadmin:admin
(or anything arbitrary) if prompted.Set-MpPreference -DisableRealtimeMonitoring $true
.msfconsole
and follow along with default options.use exploit/windows/http/smartermail_rce
set RHOSTS [SMARTERMAIL_SERVER_IP]
set LHOST eth0
exploit
HttpClient
for the Check and Ruby's defaultsocket
library for the Exploit.Scenarios
SmarterMail Build 6970 on Windows 10 Pro
SmarterMail Version 16.3.6989 on Windows 10 Pro
Mail
:SmarterMail Build 6985 on Windows 10 Pro
SmarterMail Build 6919 on Windows 10 Pro (Algernon from Proving Grounds Practice)
We will also accept demonstrations of successful module execution even if your module doesn't meet the above conditions. It's not a necessity, but it may help us land your module faster!
Demonstration of successful module execution can take the form of a packet capture (pcap) or a screen recording. You can send pcaps and recordings to [email protected]. Please include a CVE number in the subject header (if applicable), and a link to your PR in the email body.
If you wish to sanitize your pcap, please see the wiki.