Skip to content

Commit 7ec7248

Browse files
author
Tod Beardsley
committed
Land rapid7#2610, new Supermicro modules
2 parents 5b5ebd6 + 91639db commit 7ec7248

File tree

3 files changed

+402
-0
lines changed

3 files changed

+402
-0
lines changed

‎modules/auxiliary/scanner/http/smt_ipmi_cgi_scanner.rb

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
##
2+
# This module requires Metasploit: http//metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'uri'
7+
require 'msf/core'
8+
9+
class Metasploit3 < Msf::Auxiliary
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
include Msf::Auxiliary::Scanner
13+
include Msf::Auxiliary::Report
14+
15+
def initialize(info = {})
16+
super(update_info(info,
17+
'Name' => 'Supermicro Onboard IPMI CGI Vulnerability Scanner',
18+
'Description' => %q{
19+
This module checks for known vulnerabilities in the CGI applications of
20+
Supermicro Onboard IPMI controllers. These issues currently include
21+
several unauthenticated buffer overflows in the login.cgi and close_window.cgi
22+
components.
23+
},
24+
'Author' =>
25+
[
26+
'hdm', # Discovery and analysis
27+
'juan vazquez' # Metasploit module
28+
],
29+
'License' => MSF_LICENSE,
30+
'References' =>
31+
[
32+
[ 'CVE', '2013-3621' ],
33+
[ 'CVE', '2013-3623' ],
34+
[ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2013/11/06/supermicro-ipmi-firmware-vulnerabilities']
35+
],
36+
'DisclosureDate' => 'Nov 06 2013'))
37+
38+
end
39+
40+
def is_supermicro?
41+
res = send_request_cgi(
42+
{
43+
"uri" => "/",
44+
"method" => "GET"
45+
})
46+
47+
if res and res.code == 200 and res.body =~ /ATEN International Co Ltd\./
48+
return true
49+
else
50+
return false
51+
end
52+
end
53+
54+
def send_close_window_request(sess)
55+
res = send_request_cgi({
56+
'method' => 'POST',
57+
'uri' => "/cgi/close_window.cgi",
58+
'encode_params' => false,
59+
'vars_post' => {
60+
'sess_sid' => sess
61+
}
62+
})
63+
64+
return res
65+
end
66+
67+
def check_close_window
68+
safe_check = Rex::Text.rand_text_alpha(20)
69+
trigger_check = Rex::Text.rand_text_alpha(132)
70+
71+
res = send_close_window_request(safe_check)
72+
73+
unless res and res.code == 200 and res.body =~ /Can't find action/
74+
return false
75+
end
76+
77+
res = send_close_window_request(trigger_check)
78+
79+
unless res and res.code == 500
80+
return false
81+
end
82+
83+
return true
84+
end
85+
86+
def send_login_request(name)
87+
res = send_request_cgi({
88+
'method' => 'POST',
89+
'uri' => "/cgi/login.cgi",
90+
'encode_params' => false,
91+
'vars_post' => {
92+
'name' => name,
93+
'pwd' => Rex::Text.rand_text_alpha(4)
94+
}
95+
})
96+
97+
return res
98+
end
99+
100+
101+
def check_login
102+
safe_check = Rex::Text.rand_text_alpha(20)
103+
trigger_check = Rex::Text.rand_text_alpha(300)
104+
105+
res = send_login_request(safe_check)
106+
107+
unless res and res.code == 200 and res.body =~ /ATEN International Co Ltd\./ and res.body =~ /top\.location\.href = location\.href/
108+
return false
109+
end
110+
111+
res = send_login_request(trigger_check)
112+
113+
unless res and res.code == 500
114+
return false
115+
end
116+
117+
return true
118+
end
119+
120+
121+
def run_host(ip)
122+
vprint_status("#{peer} - Checking if it's a Supermicro IPMI web interface...")
123+
if is_supermicro?
124+
vprint_good("#{peer} - Supermicro IPMI web interface found")
125+
else
126+
vprint_error("#{peer} - Supermicro IPMI web interface not found")
127+
return
128+
end
129+
130+
vprint_status("#{peer} - Checking CVE-2013-3621 (login.gi Buffer Overflow) ...")
131+
result = check_login
132+
if result
133+
print_good("#{peer} - Vulnerable to CVE-2013-3621 (login.cgi Buffer Overflow)")
134+
report_vuln({
135+
:host => rhost,
136+
:port => rport,
137+
:proto => 'tcp',
138+
:name => "Supermicro Onboard IPMI login.cgi Buffer Overflow",
139+
:refs => self.references.select do |ref| ref.ctx_val == "2013-3621" end
140+
})
141+
end
142+
143+
vprint_status("#{peer} - Checking CVE-2013-3623 (close_window.gi Buffer Overflow) ...")
144+
result = check_close_window
145+
if result
146+
print_good("#{peer} - Vulnerable to CVE-2013-3623 (close_window.cgi Buffer Overflow)")
147+
report_vuln({
148+
:host => rhost,
149+
:port => rport,
150+
:proto => 'tcp',
151+
:name => "Supermicro Onboard IPMI close_window.cgi Buffer Overflow",
152+
:refs => self.references.select { |ref| ref.ctx_val == "2013-3623" }
153+
})
154+
end
155+
156+
end
157+
158+
end

‎modules/auxiliary/scanner/http/smt_ipmi_static_cert_scanner.rb

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
##
2+
# This module requires Metasploit: http//metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Auxiliary
9+
10+
include Msf::Exploit::Remote::Tcp
11+
include Msf::Auxiliary::Scanner
12+
include Msf::Auxiliary::Report
13+
14+
PRIVATE_KEY = <<-EOF.gsub(/^ {4}/, '')
15+
-----BEGIN RSA PRIVATE KEY-----
16+
MIICXQIBAAKBgQC1q1kR6chWLfwspD84Asyy6EFV6SYRGy/gILsYGtn9kCQi2RFo
17+
bNxS5CvphbGWn9D9n5gJpTVWLWb3LwJxGuBKSRj2wrHLlejzw6kSmF+3xFCuMfxV
18+
FSj8TM8JqlOqM1c6lvH2MSXnN7pJBVcekNKbBUEfptakPSejStljbXecSwIDAQAB
19+
AoGAah4/FzGiboTKCyGeNA+eltsIXzCjpdZlrtwvrbLxpyXtldWKT59XS6ww4mXQ
20+
CJYuNBhnbSrt7vrybG0vVfZHEOCvK+5YKBOtvRgrWDgs1Bkc5hsdI5gLx3jE7g6M
21+
PuUvD7ueF4OzYeYRrOLWr957jl32n+hD/k65bKWAUp3aTDECQQDqnEPZWlmoH7Jp
22+
6woRnEp+1cullHv8DviM5Huh+JeBotSa03p4unhKlRYSqnHdeHU2343n1VUDzvnV
23+
LQWi5G+FAkEAxjt0S67lyuuVD842uZRHt2WSQvwt23aKzQ+EJwV0IXYzfefeLzEm
24+
dDdvc1AJ31gweAQK89/5/1EEF40K7BJdjwJBAJDFdtTT/QlS7eyQPjlZwVp9IVp+
25+
wvdqYZPHlkb/uLYlPZ6Aq01+e6ZCU0mXZgYtQ99lmhKaQQjFmsMiMh0va2UCQA2T
26+
NLuaFpJ235ZdgNHknaSpiAKeUmWdEJRKY7poXTONbKlKn6SLsR50TWWQLZzl5SvS
27+
2w0oYW5ile0m84CHIXECQQCrABn0HY4Ll9/4FX+OCWamqwENltU1GcGIogeyFymK
28+
ZVX8QdAVoUiZoUaVku946j63WNSkI1sU/UWhL6XDt4gx
29+
-----END RSA PRIVATE KEY-----
30+
EOF
31+
32+
33+
def initialize
34+
super(
35+
'Name' => 'Supermicro Onboard IPMI Static SSL Certificate Scanner',
36+
'Description' => %q{
37+
This module checks for a static SSL certificate shipped with Supermicro Onboard IPMI
38+
controllers. An attacker with access to the publicly-available firmware can perform
39+
man-in-the-middle attacks and offline decryption of communication to the controller.
40+
This module has been on a Supermicro Onboard IPMI (X9SCL/X9SCM) with firmware
41+
version SMT_X9_214.
42+
},
43+
'Author' =>
44+
[
45+
'hdm', # Discovery and analysis
46+
'juan' # Metasploit module
47+
],
48+
'License' => MSF_LICENSE,
49+
'References' =>
50+
[
51+
[ 'CVE', '2013-3619' ],
52+
[ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2013/11/06/supermicro-ipmi-firmware-vulnerabilities']
53+
],
54+
'DisclosureDate' => 'Nov 06 2013'
55+
)
56+
57+
register_options(
58+
[
59+
Opt::RPORT(443),
60+
], self.class)
61+
end
62+
63+
# Fingerprint a single host
64+
def run_host(ip)
65+
connect(true, {"SSL" => true}) #Force SSL
66+
cert = OpenSSL::X509::Certificate.new(sock.peer_cert)
67+
disconnect
68+
69+
unless cert
70+
vprint_error("#{ip}:#{rport} - No certificate found")
71+
return
72+
end
73+
74+
pkey = OpenSSL::PKey::RSA.new(PRIVATE_KEY)
75+
result = cert.verify(pkey)
76+
77+
if result
78+
print_good("#{ip}:#{rport} - Vulnerable to CVE-2013-3619 (Static SSL Certificate)")
79+
# Report with the the SSL Private Key hash for the host
80+
digest = OpenSSL::Digest::SHA1.new(pkey.public_key.to_der).to_s.scan(/../).join(":")
81+
report_note(
82+
:host => ip,
83+
:proto => 'tcp',
84+
:port => rport,
85+
:type => 'supermicro.ipmi.ssl.certificate.pkey_hash',
86+
:data => digest
87+
)
88+
89+
report_vuln({
90+
:host => rhost,
91+
:port => rport,
92+
:proto => 'tcp',
93+
:name => "Supermicro Onboard IPMI Static SSL Certificate",
94+
:refs => self.references
95+
})
96+
end
97+
end
98+
99+
end

0 commit comments

Comments
 (0)